When European Union leaders introduced a 125-page draft law to regulate artificial intelligence in April 2021, they hailed it as a global model for handling the technology. E.U. lawmakers had gotten input from thousands of experts for three years about A.I., when the topic was not even on the table in other countries. The result was a “landmark” policy that was “future proof,” declared Margrethe Vestager, the head of digital policy for the 27-nation bloc.
Then came ChatGPT.
The eerily humanlike chatbot, which went viral last year by generating its own answers to prompts, blindsided E.U. policymakers. The type of A.I. that powered ChatGPT was not mentioned in the draft law and was not a major focus of discussions about the policy. Lawmakers and their aides peppered one another with calls and texts to address the gap, as tech executives warned that overly aggressive regulations could put Europe at an economic disadvantage.
Even now, E.U. lawmakers are arguing over what to do, putting the law at risk. “We will always be lagging behind the speed of technology,” said Svenja Hahn, a member of the European Parliament who was involved in writing the A.I. law.
Lawmakers and regulators in Brussels, in Washington and elsewhere are losing a battle to regulate A.I. and are racing to catch up, as concerns grow that the powerful technology will automate away jobs, turbocharge the spread of disinformation and eventually develop its own kind of intelligence. Nations have moved swiftly to tackle A.I.’s potential perils, but European officials have been caught off guard by the technology’s evolution, while U.S. lawmakers openly concede that they barely understand how it works.
The result has been a sprawl of responses. President Biden issued an executive order in October about A.I.’s national security effects as lawmakers debate what, if any, measures to pass. Japan is drafting nonbinding guidelines for the technology, while China has imposed restrictions on certain types of A.I. Britain has said existing laws are adequate for regulating the technology. Saudi Arabia and the United Arab Emirates are pouring government money into A.I. research.
At the root of the fragmented actions is a fundamental mismatch. A.I. systems are advancing so rapidly and unpredictably that lawmakers and regulators can’t keep pace. That gap has been compounded by an A.I. knowledge deficit in governments, labyrinthine bureaucracies and fears that too many rules may inadvertently limit the technology’s benefits.
Even in Europe, perhaps the world’s most aggressive tech regulator, A.I. has befuddled policymakers.
The European Union has plowed ahead with its new law, the A.I. Act, despite disputes over how to handle the makers of the latest A.I. systems. A final agreement, expected as soon as Wednesday, could restrict certain risky uses of the technology and create transparency requirements about how the underlying systems work. But even if it passes, it is not expected to take effect for at least 18 months — a lifetime in A.I. development — and how it will be enforced is unclear.
“The jury is still out about whether you can regulate this technology or not,” said Andrea Renda, a senior research fellow at the Center for European Policy Studies, a think tank in Brussels. “There’s a risk this E.U. text ends up being prehistorical.”
The absence of rules has left a vacuum. Google, Meta, Microsoft and OpenAI, which makes ChatGPT, have been left to police themselves as they race to create and profit from advanced A.I. systems. Many companies, preferring nonbinding codes of conduct that provide latitude to speed up development, are lobbying to soften proposed regulations and pitting governments against one another.
Without united action soon, some officials warned, governments may get further left behind by the A.I. makers and their breakthroughs.
“No one, not even the creators of these systems, know what they will be able to do,” said Matt Clifford, an adviser to Prime Minister Rishi Sunak of Britain, who presided over an A.I. Safety Summit last month with 28 countries. “The urgency comes from there being a real question of whether governments are equipped to deal with and mitigate the risks.”
Europe takes the lead
In mid-2018, 52 academics, computer scientists and lawyers met at the Crowne Plaza hotel in Brussels to discuss artificial intelligence. E.U. officials had selected them to provide advice about the technology, which was drawing attention for powering driverless cars and facial recognition systems.
The group debated whether there were already enough European rules to protect against the technology and considered potential ethics guidelines, said Nathalie Smuha, a legal scholar in Belgium who coordinated the group.
But as they discussed A.I.’s possible effects — including the threat of facial recognition technology to people’s privacy — they recognized “there were all these legal gaps, and what happens if people don’t follow those guidelines?” she said.
In 2019, the group published a 52-page report with 33 recommendations, including more oversight of A.I. tools that could harm individuals and society.
The report rippled through the insular world of E.U. policymaking. Ursula von der Leyen, the president of the European Commission, made the topic a priority on her digital agenda. A 10-person group was assigned to build on the group’s ideas and draft a law. Another committee in the European Parliament, the European Union’s co-legislative branch, held nearly 50 hearings and meetings to consider A.I.’s effects on cybersecurity, agriculture, diplomacy and energy.
In 2020, European policymakers decided that the best approach was to focus on how A.I. was used and not the underlying technology. A.I. was not inherently good or bad, they said — it depended on how it was applied.
So when the A.I. Act was unveiled in 2021, it concentrated on “high risk” uses of the technology, including in law enforcement, school admissions and hiring. It largely avoided regulating the A.I. models that powered them unless listed as dangerous.
Under the proposal, organizations offering risky A.I. tools must meet certain requirements to ensure those systems are safe before being deployed. A.I. software that created manipulated videos and “deepfake” images must disclose that people are seeing A.I.-generated content. Other uses were banned or restricted, such as live facial recognition software. Violators could be fined 6 percent of their global sales.
Some experts warned that the draft law did not account enough for A.I.’s future twists and turns.
“They sent me a draft, and I sent them back 20 pages of comments,” said Stuart Russell, a computer science professor at the University of California, Berkeley, who advised the European Commission. “Anything not on their list of high-risk applications would not count, and the list excluded ChatGPT and most A.I. systems.”
E.U. leaders were undeterred.
“Europe may not have been the leader in the last wave of digitalization, but it has it all to lead the next one,” Ms. Vestager said when she introduced the policy at a news conference in Brussels.
A blind spot
Nineteen months later, ChatGPT arrived.
The European Council, another branch of the European Union, had just agreed to regulate general purpose A.I. models, but the new chatbot reshuffled the debate. It revealed a “blind spot” in the bloc’s policymaking over the technology, said Dragos Tudorache, a member of the European Parliament who had argued before ChatGPT’s release that the new models must be covered by the law. These general purpose A.I. systems not only power chatbots but can learn to perform many tasks by analyzing data culled from the internet and other sources.
E.U. officials were divided over how to respond. Some were wary of adding too many new rules, especially as Europe has struggled to nurture its own tech companies. Others wanted more stringent limits.
“We want to be careful not to underdo it, but not overdo it as well and overregulate things that are not yet clear,” said Mr. Tudorache, a lead negotiator on the A.I. Act.
By October, the governments of France, Germany and Italy, the three largest E.U. economies, had come out against strict regulation of general purpose A.I. models for fear of hindering their domestic tech start-ups. Others in the European Parliament said the law would be toothless without addressing the technology. Divisions over the use of facial recognition technology also persisted.
Policymakers were still working on compromises as negotiations over the law’s language entered a final stage this week.
A European Commission spokesman said the A.I. Act was “flexible relative to future developments and innovation friendly.”
The Washington game
Jack Clark, a founder of the A.I. start-up Anthropic, had visited…