POLITICO’s weekly transatlantic tech newsletter for global technology elites and political influencers.

By MARK SCOTT

Send tips here | Subscribe for free | View in your browser

THERE ARE TWO MORE DIGITAL BRIDGE NEWSLETTERS before I down tools for a couple of weeks of vacation. I’m Mark Scott, POLITICO’s chief technology correspondent, and as my mind inevitably turns to my upcoming break, I bring you actual footage of my response when editors ask me why my copy is filed increasingly late. True story.

OK. Enough with the jokes. Let’s get down to business.

— Everyone now wants rules to govern artificial intelligence. But, so far, much of this over-hyped tech is falling short.

— Why the so-called Brussels Effect only really works when you view Europe’s relationship as tied to the United States.

— A bunch of U.S. state privacy laws come into force on July 1. What does that tell us about a potential federal data protection regime?

AI SCORES AN ‘F’ ON REGULATION

REGULAR READERS OF THIS NEWSLETTER will know I’m pretty skeptical of the über-hype surrounding artificial intelligence. But even I must admit the likes of OpenAI’s ChatGPT and Google’s Bard have given the public a greater appreciation of what AI can do than anything that has preceded them. So with that in mind, how do so-called foundation models, or the vast tracts of data used to power the likes of generative AI, do when it comes to following the European Union’s Artificial Intelligence Act? This is the only comprehensive rulebook for the technology that exists, currently, anywhere in the West, so it’s the only game in town to grade these models’ performance. It’s not a perfect analogy. But researchers at Stanford University crunched the numbers, so let’s break it down. Warning: No one did very well.

First, a couple of caveats. The academics based their analysis on the European Parliament’s version of the proposals, mostly because these lawmakers inserted several provisions specifically related to foundation models and generative AI, in particular — something that had not existed in earlier drafts. Saying that, they did have to make a series of assumptions around accountability, transparency and other areas of the legislation. So it’s best to see the results as a guide, more than a definitive explainer. Still, when they looked at 10 of the leading models — everything from OpenAI’s GPT-4 to Aleph Alpha’s Luminous — no one met the requirements laid down in Brussels’ upcoming rulebook.

“Because there’s so much up in the air, and because some of the requirements are under-specified. we had to fill on some of the gaps,” Kevin Klyman, one of the authors of the analysis, told me. That includes newly created requirements from EU lawmakers around baking in risk-mitigation procedures — and showing how they did that — within foundation models; providing detailed overviews of how these models are developed for outside auditors; and even upholding the 27-country bloc’s sustainability standards around energy consumption (AI, after all, needs a load of computing power to work well).

So, how did companies do? The academics broke the AI Act’s requirements down into 12 buckets (from explainability of where the data came from to safeguards around using copyrighted material), then used a ranking scale from 1 to 4 to determine how closely each firm’s foundation model met those legal asks. They then added them all up and gave each company a score out of 48. Yes, this sounds complicated, but check out the handy chart here; it’s pretty straightforward. Overall, Meta received 21/48; OpenAI scored 25/48; Google earned 27/48. The worst-performing was Aleph Alpha at 5/48, while BigScience, an open-source alternative, came first with 36/48.

Those figures masked massive differences between how companies performed depending on specific requirements under the EU’s AI Act. On outlining ways to mitigate potential risks, Klyman said, OpenAI did a pretty good job, earning itself 4/4 for its compliance with the upcoming rules. Contrast that to Aleph Alpha, a German rival, whose lack of detailed documentation on how it was warding off potential harmful uses of its technology saw the AI startup scoring a mere 1/4 for its risk-mitigation policies. “The way providers that are doing a good job at handling risks and mitigations is they have a section of their work related to the model where they say, ‘Here are all of the potential dangers from this model,'” Klyman added.

I’m not sure I would give such disclosures a passing grade. Having a transparency section on a website about potential downsides and how a company will handle such risks doesn’t mean such safeguards will be enforced. For that, you need greater disclosures on how these models operate — something, unfortunately, that almost all the firms did badly on. When it came to publishing which data sources (including copyrighted data) were baked into these AI systems, only BigScience and, to a lesser degree, Meta ranked highly, based on Stanford’s scorecard. And Klyman warned that all companies were becoming more secretive around their foundation models as competitive pressures were leading many to bring up the drawbridge on how their systems operate.

So what does this mean for policymakers, both within the EU and elsewhere, who are working on AI rules, particularly related to these foundation models? Klyman said EU lawmakers needed to get more granular on how they wanted companies to comply with the AI Act. That involved giving quantifiable metrics on what compliance looked like in terms of risk mitigation, data governance and other wonky regulatory provisions. For U.S. policymakers, the Stanford academic urged Washington to create a national AI research center so that researchers could better kick the tires of how these foundation models were developed. “Transparency,” he added, “is extremely important.”

THE BRUSSELS EFFECT’S DIRTY LITTLE SECRET

YOU DON’T HAVE TO GO FAR IN BRUSSELS to hear officials (and think-tankers) drone on about the so-called Brussels Effect. Coined by Ana Bradford, a Finnish academic now based at Columbia Law School, the term refers to how the bloc’s expansive policymaking (and not just on digital) has a global effect — because the EU’s rules quickly take on a life of their own and become the de facto global standard. Within tech, the clearest example of this is the General Data Protection Regulation, or the EU’s wide-ranging data protection standards that are now followed by pretty much every country worldwide. More on that here.

Yet researchers at the European Centre for International Political Economy (ECIPE), a Brussels-based think tank, have driven a tank-shaped hole through that theory — at least when it comes to data. They analyzed the digital trade implications of the bloc’s so-called adequacy data protection decisions, complex legal instruments that basically tell trading partners, “If you follow Europe’s privacy standards, to the letter, we will allow unfettered flows of EU personal data to your country.” It’s a massive trade opportunity, giving countries from New Zealand to South Korea unlimited access to the personal information of Europe’s well-heeled consumers. It’s a major bargaining chip Brussels uses during its free trade agreement negotiations.

But what the think-tankers discovered was this wholesale data access — the epitome of the Brussels Effect — only really made a difference to the more than 10 countries with adequacy if you factored in Europe also having a data-transfer deal with the U.S. What they found was up to a 14 percent jump in digital trade between these countries, or the equivalent to about $4 billion of additional exports. But that was down almost exclusively to the likes of Argentina and Israel trading more with the U.S. — via the legal certainty provided by Europe’s adequacy regime. It was not because these countries were shipping goods and services more to the 27-country bloc.

“Digital trade is moving upwards compared to all other trades, but it’s highly dependent or contingent on the U.S.,” Erik van der Marel, ECIPE’s chief economist and one of the report’s co-authors, told me. “As soon as the U.S. got adequacy, you see that U.S companies outsource a lot of stuff, in terms of services outsourcing, that can be done on the basis of European citizens data to other adequacy granted countries.” Call it the halo effect of Brussels’ privacy regime. American firms quickly strike up relationships with partners in other adequacy countries — mostly to reduce costs — and immediately increase trade between the U.S. and those nations, and not with Europe.

It gets even clearer as the researchers also calculated a 9 percent reduction in so-called trade costs, which are charges associated with doing business internationally, for countries with adequacy status. But, again, when they ran the numbers, those savings were predicated almost exclusively on Europe having a data deal in place with the U.S. There’s one caveat to the report: It didn’t include Brussels’ recently agreed adequacy deals with South Korea, Japan and the United Kingdom. But if you included those agreements, van der Marel added, the increase in digital trade (mostly between these countries and the U.S.) would reach about $11 billion.

To fans of the Brussels Effect, I can already hear the criticism. These bumps in digital trade only happened because of Europe’s rules, so what are you complaining about? It’s also true that because most adequate countries are tiny (it’s not like Guernsey and the Faroe Islands are hot-beds of the global trading order), it’s only natural that Brussels’ relationship with Washington will dominate these wider relationships. But it’s also clear that if the EU wants to continue setting global regulatory standards, we should all acknowledge how important its relationship with the U.S. remains when it comes to boosting ties with other parts of the world.

The latest intelligence I have is that the third iteration of a transatlantic data deal (the previous two pacts were invalidated by Europe’s top court) will now be signed off by mid-July. A legal challenge from privacy campaigners will inevitably follow. But when it comes to digital trade, the deal is vital. These EU-U.S. agreements, according to van der Marel, represent up to a 14 percent increase in transatlantic commerce. That equates to $11.9 billion in additional digital trade exports from the U.S. to the EU and a further $7.2 billion from the EU to the U.S. When the global economy is teetering on the edge, $19.1 billion in extra international trade is nothing to sneeze at.

BY THE NUMBERS

US DOES PRIVACY. REALLY.

I’VE GIVEN UP (AGAIN) ON WASHINGTON moving ahead with comprehensive data protection rules before the 2024 election cycle takes over. But on July 1, Colorado and Connecticut’s privacy regimes come into force — and the enforcement powers of California’s separate legislation, which was enacted earlier this year, also start to bite. Throw in Virginia and Kentucky (whose laws started on January 1) and Utah (its legislation gets going at the end of 2023), and you’ve now got a stable of data protection rulebooks, at the state level, to give Americans a taste of what greater privacy safeguards could look like.

Still, not all regimes are created equal. After heavy lobbying from industry, almost all don’t allow consumers to directly sue companies for potential wrongdoing — those powers are exclusively limited to state attorneys general. Some, like Utah’s law, are pretty light touch. Others, like those in Connecticut and Virginia, require companies to provide European-style transparency to people about how their data is collected and used. Only one — the California Privacy Rights Act — creates an independent regulator akin to what is readily available on the other side of the Atlantic. How all these rulebooks handle data protection questions will either galvanize Washington into doing something or shepherd other U.S. states toward the legislation that best handles the public’s complaints.

WONK OF THE WEEK

THE ORGANIZATION FOR ECONOMIC COOPERATION AND DEVELOPMENT finds itself at the center of global (read: Western) debates on how countries can freely move data between each other while upholding people’s privacy. And Clarisse Girot, head of the data governance and privacy unit at the group of mostly-rich countries, is key to that work.

The French-born lawyer knows data protection better than most. She was head of international affairs at France’s privacy regulator before moving to Singapore and Jersey (the country, not the U.S. state!) before returning to Paris last year to take up her current role at the OECD.

“Companies, like policymakers and, of course, people have a shared interest in ensuring a high level of data protection,” she wrote on LinkedIn. “Facilitating compliance with these rules is essential to ensure the effectiveness of meaningful protection in data flows, in particular by enabling the optimisation of resources devoted to the protection of personal data.”

WHAT I’M READING

— U.S. lawmakers wrote to Joe Biden about their concerns over how Europe’s digital lawmaking was unfairly harming American companies — and called on him to act. Read more here.

— The European Parliament published a comprehensive overview of the metaverse (remember when that was popular?), including the potential cybersecurity and ethical implications of the technology. Take a look here.

— One for all the podcast lovers. Emily M. Bender and Alex Hanna debunk much of the AI hysteria in a three-part series entitled “Mystery AI Hype Theater 3000.” It’s worth a listen.

— Meta explains why it’s pulling all news from people’s Facebook feeds in Canada after the country’s lawmakers backed rules that would require platforms to pay publishers when their content appeared on these networks. The blog post is here.

— The International Association of Privacy Professionals has written a glossary of key terms for AI governance as part of efforts to standardize people’s thinking about these topics.

— A global organization similar to the International Atomic Energy Agency is not the right way to frame international governance discussions around artificial intelligence, argues Ian J. Stewart for the Bulletin of the Atomic Scientists.

SUBSCRIBE to the POLITICO newsletter family: Brussels Playbook | London Playbook | London Playbook PM | Playbook Paris | POLITICO Confidential | Sunday Crunch | EU Influence | London Influence | Digital Bridge | China Watcher | Berlin Bulletin | D.C. Playbook | D.C. Influence | Global Insider | All our POLITICO Pro policy morning newsletters