On the necessary regulation of AI

a robot issuing a parking ticket, generated by deepai.org

I wrote a piece for Chartist on AI & its regulation, which I have signposted on LInkedin. I look at its likely macro-economic effects and the essential defence of Article 22 of the GDPR, where I say,

… the most important defences that we as citizens, workers, and consumers have is the EU’s GDPR, which in Article 22 & Recital 71 establishes what they call a right to “freedom from profiling”. This, through the rulings of the CJEU, has become quite extensive and now prohibits such things as ‘general monitoring’, a legal protection brought forcefully to light by the French supervisory authority fining Amazon €32m for violations of the GDPR within their workforce management regime.

In the article, I talk about the problem of Authority vs Popularity, the need for open source, and source citation. I also review the need for some innovators for privacy and competitive advantage and the possible future of regulation of AI to ensure decency and accountability. I also look at the patchy European response and the paradoxical attitude of the US.

I conclude.

In summary, there are plenty of laws to ensure that AI and its owners behave decently, and in some European countries, the will and resources to enforce them, but it’s not universal. Also, there are important economic countervailing forces opposing the creation of a privately owned “Global Intellect” even if the current technology is capable of such a task.

 …

Can’t make it up

Can’t make it up

A note on LinkedIn on why managements need IT usage policies to prove their compliance and to act legally and fairly towards their employees. I suggest that ISO27001 is useful as a technical standard and COBIT as an organisational one.

This was written in the light of a couple of cases I had to deal with as an accompanying rep. or as an advisor.

You can’t claim that users are not performing if you can’t prove the IT systems work as documented. You can’t pursue a conduct disciplinary against people operating a policy. You can’t fulfil FOI or SAR requests if the data retention policy is suspect. You can’t be sure that corruption has not occurred if there is inadequate segregation of duties.

Having policy will help the organisation answer the following questions. Is our software supported?  Why and how was that data deleted? What should be logged? Who has permission to read, amend and run these programs and/or this data? Are our vendors signed up to our IT security goals? Why do you not know this?

This is all defined in these standards, and the GDPR makes certification to good practice evidence of good will. ISO27001 and COBIT are the big boys in town to prove technical and organisational protection.

You can’t make it up anymore. …