How To Regulate AI? Follow The Harm

Latest stories Deeper India-Philippines ties boost US aims in South China Sea South Korea's rich lobbying spree isn't paying off in DC Flavio Bolsonaro flees Brazil to US after loss to Lula

The emerging patchwork of rules has yet to establish a regulatory architecture that connects protected interests, institutional obligations and individual rights across AI technologies. Protected interests are rights recognized by the law, such as property ownership and personal privacy.

A harm-centered approach would begin with those interests and use them to shape legal obligations that span relevant systems, organizations and people.

Types of harm

A harm-centered approach starts by identifying the fundamental interests that AI systems can threaten. These overlapping interests include:

Privacy: when AI systems improperly collect, process or disclose personal information. Autonomy: when AI systems target a person's vulnerabilities and manipulate their choices or encourage unhealthy dependence. Equality: when AI systems discriminate or reinforce bias. Safety: when AI systems cause physical, psychological or security harms.

These examples are not exhaustive. Other interests may also be at stake as AI technologies evolve.

The same interest can be threatened by different technologies and different entities. A teenager's safety can be harmed by the engagement mechanisms of a social media platform or by an AI companion designed to sustain an emotional relationship.

Designing regulations based on a concept of harm allows laws and principles to follow problems as the technology changes. And it helps determine obligations imposed on developers, deployers and other stakeholders involved in AI.

For instance, AI developers could be required to conduct harm assessments throughout the development of AI systems, identifying reasonably foreseeable harms, documenting how they tested for them and explaining what mitigation measures they took.

Companies or government agencies that deploy AI systems could also have duties to monitor harms after deployment. Serious or recurring harms could trigger obligations to report them to relevant regulators, affected individuals or the public, depending on the nature and severity of the harm.

A harm-centered framework could also recognize corresponding rights for people affected by AI systems, including rights to notice and opportunities to seek redress where appropriate. These rights would arise from the same protected interests that justify obligations on companies.

The point is to build a regulatory architecture on the detection and reduction of harm across AI applications, developers and users. What matters most is whether and how AI-enabled design or operation contribute to harm.

A common basis for law

This mindset is followed in other areas of law.

Environmental law, for instance, has long regulated industries by focusing on their environmental effects rather than on technology alone. It requires regulated companies to monitor emissions and discharges, maintain records and report specified releases to regulators. Some reporting requirements also make information available to the public.

Environmental review under the National Environmental Policy Act requires federal agencies to assess environmental effects and provides opportunities for public participation.