The real winners in AI policymaking are lawyers

With all the unknowns and scams online, it’s only natural our lawmakers are concerned and rushing to squash the most harmful consumer threats happening in this new AI enabled world. This is actually the third big wave of consumer privacy policymaking since the dawn of digitized and commercialized data, and you’d think we’d have learned a few things.

Modern day consumer privacy and protection started with the mass aggregation and commercial use of data, and one of the earliest was the Fair Credit and Reporting Act in 1971. Then a few years later in 1974 came along the Privacy Act that governed the use of personal information by the government and the Family Education Rights and Privacy Act, which gave parents more access to manage their dependents’ educational records.

One of the first “modern” privacy acts is the Video Privacy Protection Act of 1988, which protects video rental history (no joke). Then came the Health Insurance Portability and Accountability Act in 1996, effective 2003, which set the national standard for electronic health records. In 1998, the Children’s Online Privacy Protection Act was passed, effective 2000 and amended in 2013. Today 15 states have different consumer data privacy laws in place with varying degrees of governance.

As more businesses go online, cross-border sales have skyrocketed. Now, companies need to know privacy regulations in other parts of the world. As of 2018, companies that do business in the European Union (as many online businesses do) also must comply with the specificities of GDPR, which requires certain technical and back-end changes. There were implications to data storage and processing, and marketing teams had to shift practices around data management and opt-in.

These protections are good for the consumer, but, I have to say, in the 20 years of dealing with revision after revision policies, documentation and practices to remain in compliance with the ever-increasing spiderweb of consumer privacy regulatory landscape, it’s really the lawyers winning in the end. With every new law, with every revision, the lawyers get called to audit for compliance.

Now with AI, something very similar is happening but at a much grander scale. No less than 30 states (plus the District of Columbia) have already signed into law, are in the process of voting, or are looking into their own individual state policy for AI governance. And the range of governance oversight is broad — job loss, health care, privacy, data mining, housing, transparency, the list goes on. Is there a better way of doing this that serves to effectively protect consumers but does not create decades of backlog work for lawyers and an ongoing requirement to have a standing carve out of legal fees in company OpEx budgets?

Perhaps. The European Union on March 13, passed the AI Act, set to go into law this May or June. Touted as the first to have a comprehensive framework for AI governance (it was first introduced in 2021), the European Commission states that “the AI Act aims to provide AI developers and deployers with clear requirements and obligations regarding specific uses of AI. At the same time, the regulation seeks to reduce administrative and financial burdens for business, in particular small and medium-sized enterprises.”

We are still early days in both understanding what AI can do for humanity and what needs to be regulated to protect the people from harm. But we do have a good sense of what kinds of human behaviors are considered safe, risky and dangerous. An AI framework is important enough to be enacted federally, to govern and protect everyone equally. Everyone will be affected. Let’s not piecemeal this one with each hot incident — the lawyers have enough work.

Annie Tsai is chief operating officer at Interact (tryinteract.com), early stage investor and advisor with The House Fund (thehouse.fund), and a member of the San Mateo County Housing and Community Development Committee. Find Annie on Twitter @meannie.