The EU’s landmark AI act “fails to effectively protect the rule of law and civic space,” according to the European Centre for Not-for-Profit Law (ECNL).

The group of civil society law experts are saying that the EU’s AI Act, which is the first major attempt to legislate the rapidly proliferating technology, prioritises industry interests above the public.

A study developed by the group says that while the Act creates high standards for the technical development of AI systems, it does little to protect what it deems as “fundamental rights, including key civic rights and freedoms.”

“They are riddled with far-reaching exceptions, lowering protection standards, especially in the area of law enforcement and migration,” ECNL said.

It is not the first group to say that the EU AI Act does not go far enough to protect fundamental rights, especially in terms of law enforcement and migration.

Amnesty International raised criticisms that, while the law restricted the use of biometric facial recognition in public spaces and in most law enforcement applications, it allowed the use of this AI technology for migrants and refugees in Europe.

ECNL says that the exceptions real time biometrics essentially undermine any prohibitions for the technology, as law enforcement are able to use it to search for missing persons, preventing terrorist attacks, or identifying suspects of serious crimes.

The exceptions, the law group says, are too far reaching and essentially negate the point of the Act.

Further, the AI Act allows companies to self-assess the risk level of their AI applications, the group says. Even if a company or public authority does fall into the high risk category, they are able to self-identify as not falling into the category of high risk, and therefore can continue to use their AI without the extra stipulations provided in the act.

“The final version of the AI Act is likely to lead to a fragmented application of the law, leaving it to Member States and national authorities to close the loopholes and monitor the self-assessment activities of AI developers and deployers,” the ECNL said.

Recommended reading

• The EU Agreed on an AI Act, What Now?
• Where Will Companies Look to For AI Regulation Guidance?
• EHRC: UK’s Proposed AI Regulations “Do Not Go Far Enough”

One of the most glaring loopholes brought up by the ECNL  is a blanket exception for national security to use AI, with AI systems developed solely for national security are protected from scrutiny of the law. This means that use cases of AI that have received blanket bans could still be used if there is a case for national security, which can be invoked by the government and law enforcement to justify otherwise banned uses of AI.

This leaves much of the AI Act up to the interpretation of governing EU bodies, but governments and law enforcement can largely exempt themselves from the laws scrutiny via these loopholes.

Also paramount to the Act’s shortcomings is its lack of commitment to the right to participation.

Public authorities and companies are not required to engage with outside stakeholders when addressing and assessing its fundamental rights impacts of AI. While civil society can participate in AI regulation via a membership to the advisory forum in the AI Office and AI Board, the set up of these will be integral in determining the direction of AI implementation.