1 00:00:00,000 --> 00:00:05,200 the AI Act, even though we've got somewhat of a changed timeline on that now, we'll discuss how 2 00:00:06,000 --> 00:00:10,480 we can prepare for the AI Act and I think more importantly as I mentioned, I think the bigger 3 00:00:10,480 --> 00:00:14,880 picture behind the AI Act being as technology evolves and as the rules change, how can you 4 00:00:14,880 --> 00:00:20,160 prepare for a regulation that is ever evolving as well. So with that I'll let the panel introduce 5 00:00:20,160 --> 00:00:26,320 themselves, starting with Suzanne at the very end. So good afternoon everyone, I'm Suzanne, 6 00:00:26,320 --> 00:00:34,640 I'm an associate professor of technology law, so I teach all related technology law topics including 7 00:00:35,280 --> 00:00:43,200 law and policy of digital services, data protection law and I do a lot of research focusing on the 8 00:00:43,200 --> 00:00:54,480 EU policy including how to properly enforce DSA rules, GDPR rules and so on. 9 00:00:55,840 --> 00:00:56,160 Hello, 10 00:00:56,320 --> 00:01:00,720 everyone, good afternoon, so I'm Bertrand Payès, I'm the head of technology of innovation at 11 00:01:00,720 --> 00:01:06,560 BACNIL which is the French Data Protection Authority and I oversee the activities of the newly created 12 00:01:06,560 --> 00:01:15,120 AI pattern that we created to work on, especially on how GDPR and other legislation apply to AI 13 00:01:15,120 --> 00:01:21,520 systems which are new systems for us as well, even if we have stopped using them for quite a time now. 14 00:01:21,520 --> 00:01:25,200 Thanks, so just a reminder that this is sort of a workshop for us as well, 15 00:01:25,840 --> 00:01:26,240 so there'll be a lot of people who will be joining us, so if you want to come in and talk a little bit more, 16 00:01:26,240 --> 00:01:26,280 we'll be happy to do that. So if you want to come in and talk a little bit more, we'll be happy to do that. 17 00:01:26,280 --> 00:01:32,520 be time at the end for a Q&A and for you guys to ask questions about specific things that you 18 00:01:32,520 --> 00:01:37,720 want to find out from our panelists, specific tips that you'd like to get from them. But I'll get 19 00:01:37,720 --> 00:01:45,400 started right now with my first question that I'll preamble, I think, so when we think about 20 00:01:45,400 --> 00:01:50,440 the things that developers and business leaders and decision makers in this field should be 21 00:01:50,440 --> 00:01:56,200 thinking about now rather than the future legislation, a helpful way to break this down is to think about 22 00:01:56,200 --> 00:02:03,080 what are the laws that affect all sectors and then what are the laws that might affect various 23 00:02:03,080 --> 00:02:08,600 verticals specifically. So if we start about the more general state of things across our models, 24 00:02:09,240 --> 00:02:12,920 what would you think, what would you say are the key blocks, the key themes 25 00:02:14,280 --> 00:02:18,920 that business makers in this space should be thinking about when they are building an AI model? 26 00:02:21,720 --> 00:02:26,120 So yeah, AI is pretty much like any other tool, so basically you 27 00:02:26,120 --> 00:02:33,640 need to look at what you're doing and think about what you're doing and what are the impacts of that 28 00:02:33,640 --> 00:02:39,000 to actually know which are the laws that are applying to you. And so basically there are 29 00:02:39,000 --> 00:02:47,320 already a lot of existing laws that are applying to a lot of different tools. We've been reading a 30 00:02:47,320 --> 00:02:55,480 lot on intellectual property laws applying to AI or how do they apply, but there are also data protection laws, 31 00:02:56,120 --> 00:03:02,760 in Europe there is the famous GDPR, there is also consumer protection laws, competition laws, 32 00:03:02,760 --> 00:03:10,120 and so all of these you know transversal omnibus topics can also apply to your business. 33 00:03:10,120 --> 00:03:13,880 So I think these are like the most various topics. 34 00:03:15,880 --> 00:03:21,240 We were discussing earlier, you can add anti-discrimination laws, which is also 35 00:03:22,600 --> 00:03:25,880 those that are very legal at the same time, not with 36 00:03:26,120 --> 00:03:31,240 big technical approach, but will certainly apply also to many cases where you can have 37 00:03:31,240 --> 00:03:37,480 discriminations and the AI system will be used in that context. So HR, hiring people, 38 00:03:39,160 --> 00:03:44,040 credit scoring, that kind of thing. Great, thanks. And we'll come to the 39 00:03:44,040 --> 00:03:51,880 blocks I suppose one by one. We have experts, specifically experts in data protection here 40 00:03:51,880 --> 00:03:56,120 as well, so I think we might spend a bit more time on this, but before we get to data protection, 41 00:03:56,760 --> 00:04:00,840 could you give us a quick date of things on IP, which is the first block that you mentioned, and 42 00:04:00,840 --> 00:04:03,400 what are the kind of key things to think about in IP? 43 00:04:04,840 --> 00:04:12,120 So maybe I'll start. I think IP is a sector where you have a lot of lobbying influence, 44 00:04:12,120 --> 00:04:18,600 and so that being said, we usually talk about the big tech lobbying, but we don't realize 45 00:04:18,600 --> 00:04:25,800 how much lobbying the IP sector has been doing for the past hundred years, when you look at the 46 00:04:26,120 --> 00:04:35,640 extension of the copyright limit in the seventies, you really can understand their influence. 47 00:04:35,640 --> 00:04:41,720 And so I think there is right now a lot of litigation pending in various jurisdictions, 48 00:04:41,720 --> 00:04:51,800 especially in the US. Last week, I think, a California judge dismissed lawsuits by artists and 49 00:04:51,800 --> 00:04:53,800 representations of artists on, again, notably, IP. 50 00:04:53,800 --> 00:04:54,200 Okay. 51 00:04:54,200 --> 00:04:54,760 Okay. 52 00:04:54,760 --> 00:04:55,240 Thank you. 53 00:04:55,240 --> 00:04:55,720 Excellent. 54 00:04:55,720 --> 00:04:56,040 Thank you. 55 00:04:56,040 --> 00:04:56,120 Thank you. 56 00:04:56,120 --> 00:05:02,420 mid-journey, where they said that there was no copyright infringement, so they had no 57 00:05:02,420 --> 00:05:07,660 claim, so there's this decision, but it's only one judge in California, but there is 58 00:05:07,660 --> 00:05:14,480 also a lot of other decision pending, and I think we will see a lot of litigation in 59 00:05:14,480 --> 00:05:23,360 the US, maybe a bit less in Europe, but we know there is also a big lobbying by institutions 60 00:05:23,360 --> 00:05:29,600 protecting authors in France, for instance, where you have a bill actually offering to 61 00:05:29,600 --> 00:05:35,440 better protect artists with AI, so there's a lot of uncertainty. 62 00:05:35,920 --> 00:05:40,160 My main takeaway would be this, there is a lot of uncertainty on this field. 63 00:05:41,300 --> 00:05:46,700 So basically, keep an eye out, there is a concrete set of laws already that you can 64 00:05:46,700 --> 00:05:48,520 refer to if you're building in that space. 65 00:05:49,320 --> 00:05:53,160 Unlike data protection, as you mentioned, so we do have the GDPR. 66 00:05:53,360 --> 00:06:00,580 That is a very specific law that you can refer to, and that is there to inform people 67 00:06:00,580 --> 00:06:02,920 in this space. 68 00:06:02,920 --> 00:06:08,220 Would you say that it is basically the key law that you should refer to, and Bertrand, 69 00:06:08,220 --> 00:06:11,900 I know that Gnil has sort of published guidelines around this, so maybe it would be useful if 70 00:06:11,900 --> 00:06:17,660 you run us through basically the key things to keep in mind to navigate the GDPR today 71 00:06:17,660 --> 00:06:19,660 from an AI perspective. 72 00:06:19,660 --> 00:06:20,920 Yes, thank you. 73 00:06:20,920 --> 00:06:22,540 Just to build on what Susan said. 74 00:06:22,540 --> 00:06:22,960 Yes. 75 00:06:22,960 --> 00:06:29,720 For many AI, and when we talk about AI right now, we often think about generative AI. 76 00:06:29,720 --> 00:06:35,580 I think there is typically a difference between copyright material and data protection. 77 00:06:35,580 --> 00:06:43,420 For generative AI, it's obvious that having copyright material allows you to better perform. 78 00:06:43,420 --> 00:06:52,140 It's also true for data protection, but it's not as key as it is to access copyright data. 79 00:06:52,140 --> 00:07:00,600 It's not as easy as it is to access books or actual code from GitHub or something else. 80 00:07:00,600 --> 00:07:08,380 And we saw, I think what we saw in the data GPT investigation from our intelligence counterparts 81 00:07:08,380 --> 00:07:16,140 in the beginning of the year, I was myself surprised to see that data protection issue 82 00:07:16,140 --> 00:07:19,140 rising so quickly, and even more quickly than copyright. 83 00:07:19,140 --> 00:07:20,140 And I think that's a very important thing. 84 00:07:20,140 --> 00:07:21,140 And I think that's a very important thing. 85 00:07:21,140 --> 00:07:22,140 Thank you. 86 00:07:22,140 --> 00:07:23,140 Thank you. 87 00:07:23,140 --> 00:07:24,140 And I think that's a very important thing. 88 00:07:24,140 --> 00:07:25,140 And I think that's a very important thing. 89 00:07:25,140 --> 00:07:26,140 Yes. 90 00:07:26,140 --> 00:07:27,140 And I think that's a very important thing. 91 00:07:27,140 --> 00:07:28,140 Yes. 92 00:07:28,140 --> 00:07:29,140 And I think that's a very important thing. 93 00:07:29,140 --> 00:07:30,140 But I also was convinced, and I think it's probably something I would say, that the 94 00:07:30,140 --> 00:07:37,140 risks at this stage are not that important for generating generative AI because it's not 95 00:07:37,140 --> 00:07:46,140 the goal of, in the case of OpenAI, it's not the goal of OpenAI to target people. 96 00:07:46,140 --> 00:07:46,900 They have some data in their training dataset, but they do not want to release it. 97 00:07:46,900 --> 00:07:47,360 Yes. 98 00:07:47,360 --> 00:07:47,860 Yes. 99 00:07:47,860 --> 00:07:48,360 Yes. 100 00:07:48,360 --> 00:07:48,860 That's a very important thing. 101 00:07:48,860 --> 00:07:50,360 That's what I'm trying to advocate. 102 00:07:50,360 --> 00:07:50,800 Yes. 103 00:07:50,800 --> 00:07:51,300 Yes. 104 00:07:51,300 --> 00:07:51,900 Yes. 105 00:07:51,900 --> 00:07:52,000 Yes. 106 00:07:52,000 --> 00:07:52,140 Yes. 107 00:07:52,140 --> 00:07:55,540 exploit the data directly 108 00:07:55,540 --> 00:07:56,740 for the general purpose 109 00:07:56,740 --> 00:07:58,860 and there can be use case of use 110 00:07:58,860 --> 00:08:00,500 of that general purpose 111 00:08:00,500 --> 00:08:04,080 that is aiming at targeting people 112 00:08:04,080 --> 00:08:07,860 but still it's not like personalized advertising 113 00:08:07,860 --> 00:08:10,400 or social networks 114 00:08:10,400 --> 00:08:14,200 where the key business model of the company 115 00:08:14,200 --> 00:08:17,780 is to target data to actual person. 116 00:08:19,140 --> 00:08:21,300 So that means that it's important 117 00:08:21,300 --> 00:08:26,640 but normally you can manage that in many cases 118 00:08:26,640 --> 00:08:29,900 and that's what we tried to tell in our first guidance 119 00:08:29,900 --> 00:08:32,100 that we published a month ago 120 00:08:32,100 --> 00:08:39,060 where we tried to lift some of the risks 121 00:08:39,060 --> 00:08:43,020 that one may see in GDPR when training AI 122 00:08:43,020 --> 00:08:45,620 so we focused our guidance right now 123 00:08:45,620 --> 00:08:49,080 on the processing of training AI 124 00:08:49,080 --> 00:08:50,520 not deploying it 125 00:08:50,520 --> 00:08:51,280 but just training it 126 00:08:51,280 --> 00:08:51,300 and that's what we did. 127 00:08:51,300 --> 00:08:53,920 And we said a different thing. 128 00:08:53,920 --> 00:08:55,560 We said for general purpose AI 129 00:08:55,560 --> 00:08:57,460 such as NLM for instance 130 00:08:57,460 --> 00:09:01,960 we said that it's not problematic 131 00:09:01,960 --> 00:09:06,520 regarding the purpose limitation principle of GDPR 132 00:09:06,520 --> 00:09:07,460 which is not of use 133 00:09:07,460 --> 00:09:10,200 because the main idea of purpose limitation in GDPR 134 00:09:10,200 --> 00:09:11,260 is to limit the purpose 135 00:09:11,260 --> 00:09:13,920 and it's typically the opposite 136 00:09:13,920 --> 00:09:16,160 of doing a general purpose AI 137 00:09:16,160 --> 00:09:20,860 but we tried to say that the purpose 138 00:09:20,860 --> 00:09:26,860 is a very broad notion in applying GDPR 139 00:09:26,860 --> 00:09:29,580 and what I would say is that 140 00:09:29,580 --> 00:09:32,980 you cannot be compliant with GDPR 141 00:09:32,980 --> 00:09:34,880 if you have your own purpose. 142 00:09:34,880 --> 00:09:36,640 If your purpose is to say 143 00:09:36,640 --> 00:09:39,980 I want to do an AI because I want to do an AI. 144 00:09:39,980 --> 00:09:43,400 This is not the purpose in terms of GDPR 145 00:09:43,400 --> 00:09:44,800 but obviously you can say 146 00:09:44,800 --> 00:09:48,780 I want to do an AI that is aiming at discussing 147 00:09:48,780 --> 00:09:50,520 casually with people about everything. 148 00:09:50,520 --> 00:09:53,760 Which is basically a large language model. 149 00:09:53,760 --> 00:09:56,080 You do not need to be very precise 150 00:09:56,080 --> 00:09:59,280 but you need to have a goal, a purpose 151 00:09:59,280 --> 00:10:02,480 and this is really one key principle of GDPR 152 00:10:02,480 --> 00:10:04,360 that you need to process certain data 153 00:10:04,360 --> 00:10:06,960 only if you have a goal that you are able to 154 00:10:06,960 --> 00:10:10,120 legitimate and determine. 155 00:10:10,120 --> 00:10:11,400 Perhaps the second aspect that 156 00:10:11,400 --> 00:10:13,520 I would cover two other aspects in our guidance 157 00:10:13,520 --> 00:10:18,520 but there have been seven fish, seven papers, guides 158 00:10:18,520 --> 00:10:23,080 in English as well, so you can read that. 159 00:10:23,080 --> 00:10:26,960 And we will extend the contribution period for one month 160 00:10:26,960 --> 00:10:29,280 because it was ending yesterday 161 00:10:29,280 --> 00:10:32,720 but actually you can enter later. 162 00:10:32,720 --> 00:10:35,560 The other aspect is how you cover 163 00:10:35,560 --> 00:10:37,600 data minimization principle 164 00:10:37,600 --> 00:10:40,120 which is also in GDPR 165 00:10:40,120 --> 00:10:42,720 and may also seem contradictory with the fact 166 00:10:42,720 --> 00:10:45,960 that you would need large scale databases to train AI. 167 00:10:46,880 --> 00:10:48,520 What we said and what we see 168 00:10:48,520 --> 00:10:52,200 in the profession as a good practice 169 00:10:52,200 --> 00:10:53,920 also in the profession is that 170 00:10:53,920 --> 00:10:56,600 even for large scale AI 171 00:10:56,600 --> 00:11:02,000 people select and want to have a good quality databases 172 00:11:02,000 --> 00:11:02,920 to train their AI. 173 00:11:02,920 --> 00:11:05,920 And actually this job of selection 174 00:11:05,920 --> 00:11:08,040 this job typically for language model 175 00:11:08,040 --> 00:11:10,800 the job to deduplicate the data 176 00:11:10,800 --> 00:11:12,160 deduplicate the tracing data 177 00:11:12,160 --> 00:11:14,880 to avoid overfitting 178 00:11:14,880 --> 00:11:18,480 to avoid overtraining 179 00:11:18,520 --> 00:11:22,920 of the data set, of the model 180 00:11:22,920 --> 00:11:25,920 all the action that you do to select data 181 00:11:25,920 --> 00:11:28,040 in order to have good performance 182 00:11:28,040 --> 00:11:31,080 is actually related to data minimization 183 00:11:31,080 --> 00:11:33,400 in the sense that you propose it to have 184 00:11:33,400 --> 00:11:35,280 to develop large language models 185 00:11:35,280 --> 00:11:37,760 so you need to have a large scale data 186 00:11:37,760 --> 00:11:39,880 but you will also need to select that 187 00:11:39,880 --> 00:11:42,160 and maybe if I have a catchphrase for that 188 00:11:42,160 --> 00:11:43,760 is to say that data minimization 189 00:11:43,760 --> 00:11:46,040 is not to have little data 190 00:11:46,040 --> 00:11:47,200 but to have clean data 191 00:11:47,200 --> 00:11:48,120 to be able to know 192 00:11:48,520 --> 00:11:49,520 what is your data 193 00:11:49,520 --> 00:11:51,520 what is your data about 194 00:11:51,520 --> 00:11:53,520 are there personal data in there 195 00:11:53,520 --> 00:11:54,920 if there are not personal data 196 00:11:54,920 --> 00:11:56,920 you are not concerned by GDPR 197 00:11:56,920 --> 00:12:01,520 but it's something that also comes of importance for IP 198 00:12:01,520 --> 00:12:03,720 obviously to know where the data comes from 199 00:12:03,720 --> 00:12:07,120 and I think if I take the example of the LLM 200 00:12:07,120 --> 00:12:10,120 the fact that everybody is using as a basis common goal 201 00:12:10,120 --> 00:12:12,720 is perhaps not completely good enough 202 00:12:12,720 --> 00:12:16,320 in terms of knowing exactly what is the data 203 00:12:16,320 --> 00:12:18,320 that I've been using to 204 00:12:18,320 --> 00:12:20,320 to train my algorithm 205 00:12:20,320 --> 00:12:24,320 and in the other range 206 00:12:24,320 --> 00:12:26,320 at the opposite of the range 207 00:12:26,320 --> 00:12:28,320 the work that Bloom has done 208 00:12:28,320 --> 00:12:30,320 BigScience has done on the Bloom 209 00:12:30,320 --> 00:12:32,320 where they're trying to really label 210 00:12:32,320 --> 00:12:34,320 all the data that has been done 211 00:12:34,320 --> 00:12:36,320 is something more close to what is expected 212 00:12:36,320 --> 00:12:38,320 also for GDPR 213 00:12:38,320 --> 00:12:40,320 and the last point that I'll try to be shorter 214 00:12:40,320 --> 00:12:42,320 is how we can reuse data 215 00:12:42,320 --> 00:12:45,320 and reuse data that is available online 216 00:12:45,320 --> 00:12:47,320 and it's something for which it was a bit difficult 217 00:12:48,320 --> 00:12:50,320 internally because 218 00:12:50,320 --> 00:12:52,320 some of the people thought that 219 00:12:52,320 --> 00:12:55,320 if the data has been illegally collected 220 00:12:55,320 --> 00:12:57,320 we use it, it's like 221 00:12:57,320 --> 00:12:59,320 I don't know in English 222 00:12:59,320 --> 00:13:01,320 so like 223 00:13:01,320 --> 00:13:03,320 it's forbidden 224 00:13:03,320 --> 00:13:05,320 it's also a criminal offense to reuse 225 00:13:05,320 --> 00:13:07,320 something that is illegal 226 00:13:07,320 --> 00:13:09,320 and we came out with the idea that 227 00:13:09,320 --> 00:13:11,320 it may be a big stop 228 00:13:11,320 --> 00:13:13,320 to any kind of AI training 229 00:13:13,320 --> 00:13:15,320 to say that 230 00:13:15,320 --> 00:13:17,320 and we ask now 231 00:13:17,320 --> 00:13:18,320 controllers to 232 00:13:18,320 --> 00:13:21,320 to try to 233 00:13:21,320 --> 00:13:23,320 determine if it is 234 00:13:23,320 --> 00:13:25,320 if it is manifestly illegal 235 00:13:25,320 --> 00:13:27,320 and manifestly illegal means that 236 00:13:27,320 --> 00:13:29,320 it's typically data containing 237 00:13:29,320 --> 00:13:31,320 sensitive data in the sense of GDPR 238 00:13:31,320 --> 00:13:33,320 health data, biometric data 239 00:13:33,320 --> 00:13:35,320 and you're not sure that 240 00:13:35,320 --> 00:13:38,320 there have been explicit content from the data subjects 241 00:13:38,320 --> 00:13:40,320 and that is 242 00:13:40,320 --> 00:13:42,320 it should ring something 243 00:13:42,320 --> 00:13:45,320 maybe I shouldn't use that data at all 244 00:13:45,320 --> 00:13:47,320 if I have health data coming from 245 00:13:47,320 --> 00:13:48,320 I don't know where 246 00:13:48,320 --> 00:13:50,320 it's also a problem 247 00:13:50,320 --> 00:13:51,320 if I reuse 248 00:13:51,320 --> 00:13:52,320 copyright data that I know 249 00:13:52,320 --> 00:13:54,320 I reuse all the Marvel movies 250 00:13:54,320 --> 00:13:55,320 to train an AI 251 00:13:55,320 --> 00:13:57,320 probably you should know that 252 00:13:57,320 --> 00:13:59,320 it's probably not completely deleted 253 00:13:59,320 --> 00:14:01,320 if you haven't talked to Marvel 254 00:14:01,320 --> 00:14:03,320 and the same for for instance 255 00:14:03,320 --> 00:14:05,320 if you reuse data from data breaches 256 00:14:05,320 --> 00:14:07,320 data that has been leaked 257 00:14:07,320 --> 00:14:09,320 probably it's also illegal data 258 00:14:09,320 --> 00:14:10,320 in the first place 259 00:14:10,320 --> 00:14:11,320 it's manifest 260 00:14:11,320 --> 00:14:12,320 that it's illegal data 261 00:14:12,320 --> 00:14:14,320 and you cannot train an AI from that 262 00:14:14,320 --> 00:14:16,320 No worries, no worries 263 00:14:16,320 --> 00:14:18,320 and with the GDPR being such a key piece of legislation 264 00:14:18,320 --> 00:14:20,320 it's important to get these things right 265 00:14:20,320 --> 00:14:22,320 and one last quick question on GDPR 266 00:14:22,320 --> 00:14:23,320 before we move on 267 00:14:23,320 --> 00:14:25,320 because we're running out of time already 268 00:14:25,320 --> 00:14:27,320 no, no, don't worry 269 00:14:27,320 --> 00:14:29,320 do you get a sort of 270 00:14:29,320 --> 00:14:31,320 get out of jail card with these rules 271 00:14:31,320 --> 00:14:33,320 so the idea that you know 272 00:14:33,320 --> 00:14:34,320 you didn't know 273 00:14:34,320 --> 00:14:35,320 you weren't aware 274 00:14:35,320 --> 00:14:36,320 particularly if you're not 275 00:14:36,320 --> 00:14:37,320 you mentioned the first case 276 00:14:37,320 --> 00:14:38,320 of working with personal data 277 00:14:38,320 --> 00:14:39,320 but not 278 00:14:39,320 --> 00:14:40,320 you know 279 00:14:40,320 --> 00:14:41,320 not necessarily having the aim 280 00:14:41,320 --> 00:14:43,320 of processing personal data 281 00:14:43,320 --> 00:14:44,320 do you get 282 00:14:44,320 --> 00:14:45,320 especially as a startup 283 00:14:45,320 --> 00:14:46,320 do you get 284 00:14:46,320 --> 00:14:47,320 that kind of 285 00:14:47,320 --> 00:14:49,320 leeway? 286 00:14:49,320 --> 00:14:50,320 I don't know 287 00:14:50,320 --> 00:14:52,320 technically no 288 00:14:52,320 --> 00:14:54,320 we're issuing guidance 289 00:14:54,320 --> 00:14:55,320 to guide 290 00:14:55,320 --> 00:14:56,320 but also 291 00:14:56,320 --> 00:14:58,320 in order to enforce 292 00:14:58,320 --> 00:15:00,320 we try to not enforce rules 293 00:15:00,320 --> 00:15:02,320 that we haven't made clear 294 00:15:02,320 --> 00:15:03,320 at first 295 00:15:03,320 --> 00:15:04,320 because obviously 296 00:15:04,320 --> 00:15:05,320 it may be difficult 297 00:15:05,320 --> 00:15:06,320 to say okay 298 00:15:06,320 --> 00:15:07,320 you never told anyone 299 00:15:07,320 --> 00:15:08,320 that that was forbidden 300 00:15:08,320 --> 00:15:10,320 why do you strike me 301 00:15:10,320 --> 00:15:11,320 so that's why we 302 00:15:11,320 --> 00:15:13,320 now we're publishing guidance 303 00:15:13,320 --> 00:15:14,320 I think for the next 304 00:15:14,320 --> 00:15:15,320 month 305 00:15:15,320 --> 00:15:16,320 and perhaps 306 00:15:16,320 --> 00:15:17,320 one or two years 307 00:15:17,320 --> 00:15:18,320 we'll keep doing that 308 00:15:18,320 --> 00:15:19,320 and we'll enforce 309 00:15:19,320 --> 00:15:20,320 and we'll then ask 310 00:15:20,320 --> 00:15:21,320 you've seen our guidance 311 00:15:21,320 --> 00:15:22,320 you should know 312 00:15:22,320 --> 00:15:23,320 and you should implement 313 00:15:23,320 --> 00:15:24,320 but one key point 314 00:15:24,320 --> 00:15:25,320 is the fact that 315 00:15:25,320 --> 00:15:26,320 be careful 316 00:15:26,320 --> 00:15:27,320 when you 317 00:15:27,320 --> 00:15:28,320 when you 318 00:15:28,320 --> 00:15:29,320 when you 319 00:15:29,320 --> 00:15:30,320 work with sensitive data 320 00:15:30,320 --> 00:15:31,320 health data 321 00:15:31,320 --> 00:15:32,320 minor data 322 00:15:32,320 --> 00:15:33,320 biometrics 323 00:15:33,320 --> 00:15:34,320 law enforcement data 324 00:15:34,320 --> 00:15:35,320 this is something 325 00:15:35,320 --> 00:15:36,320 where you want 326 00:15:36,320 --> 00:15:37,320 extra lawyers 327 00:15:37,320 --> 00:15:38,320 to look at 328 00:15:38,320 --> 00:15:39,320 what you're doing 329 00:15:39,320 --> 00:15:40,320 because 330 00:15:40,320 --> 00:15:41,320 if you don't 331 00:15:41,320 --> 00:15:42,320 you don't 332 00:15:42,320 --> 00:15:43,320 you don't 333 00:15:43,320 --> 00:15:44,320 you don't 334 00:15:44,320 --> 00:15:45,320 you don't 335 00:15:45,320 --> 00:15:46,320 look at 336 00:15:46,320 --> 00:15:47,320 what you're doing 337 00:15:47,320 --> 00:15:48,320 because 338 00:15:48,320 --> 00:15:49,320 because 339 00:15:49,320 --> 00:15:50,320 and if you do 340 00:15:50,320 --> 00:15:51,320 a general purpose AI 341 00:15:51,320 --> 00:15:52,320 try to implement 342 00:15:52,320 --> 00:15:53,320 intersection 343 00:15:53,320 --> 00:15:54,320 process 344 00:15:54,320 --> 00:15:55,320 of your data 345 00:15:55,320 --> 00:15:56,320 training data 346 00:15:56,320 --> 00:15:57,320 try to also 347 00:15:57,320 --> 00:15:58,320 have 348 00:15:58,320 --> 00:15:59,320 I don't know 349 00:15:59,320 --> 00:16:00,320 make sure 350 00:16:00,320 --> 00:16:01,320 you don't have 351 00:16:01,320 --> 00:16:02,320 credit card number 352 00:16:02,320 --> 00:16:03,320 in your 353 00:16:03,320 --> 00:16:04,320 in your 354 00:16:04,320 --> 00:16:05,320 in your 355 00:16:05,320 --> 00:16:06,320 in your training data sets 356 00:16:06,320 --> 00:16:07,320 do 357 00:16:07,320 --> 00:16:08,320 do a bit of work 358 00:16:08,320 --> 00:16:09,320 in order to avoid 359 00:16:09,320 --> 00:16:10,320 being exposed to that 360 00:16:10,320 --> 00:16:11,320 because we will 361 00:16:11,320 --> 00:16:12,320 probably 362 00:16:12,320 --> 00:16:13,320 be enforcing 363 00:16:13,320 --> 00:16:14,320 on those issues 364 00:16:14,320 --> 00:16:15,320 first 365 00:16:15,320 --> 00:16:16,320 the last one you mentioned 366 00:16:16,320 --> 00:16:17,320 was anti-discrimination laws 367 00:16:17,320 --> 00:16:18,320 and I think this kind of 368 00:16:18,320 --> 00:16:19,320 brings us nicely 369 00:16:19,320 --> 00:16:20,320 into the sectorial 370 00:16:20,320 --> 00:16:22,320 sectorial aspect as well 371 00:16:22,320 --> 00:16:23,320 so the idea that 372 00:16:23,320 --> 00:16:24,320 if you are 373 00:16:24,320 --> 00:16:25,320 developing an AI 374 00:16:25,320 --> 00:16:26,320 that's in a particular sector 375 00:16:26,320 --> 00:16:27,320 you might be 376 00:16:27,320 --> 00:16:28,320 facing laws 377 00:16:28,320 --> 00:16:29,320 that are specific 378 00:16:29,320 --> 00:16:30,320 to this sector 379 00:16:30,320 --> 00:16:31,320 that you may have not 380 00:16:31,320 --> 00:16:32,320 thought about 381 00:16:32,320 --> 00:16:33,320 that aren't even 382 00:16:33,320 --> 00:16:34,320 technical laws sometimes 383 00:16:34,320 --> 00:16:35,320 again maybe 384 00:16:35,320 --> 00:16:36,320 could you run us through 385 00:16:36,320 --> 00:16:37,320 what is the big 386 00:16:37,320 --> 00:16:38,320 state of thing 387 00:16:38,320 --> 00:16:39,320 around that 388 00:16:39,320 --> 00:16:40,320 what are the 389 00:16:40,320 --> 00:16:41,320 what are the key sectors 390 00:16:41,320 --> 00:16:42,320 would you say 391 00:16:42,320 --> 00:16:43,320 that are particularly regulated 392 00:16:43,320 --> 00:16:44,320 that people 393 00:16:44,320 --> 00:16:45,320 would say 394 00:16:45,320 --> 00:16:46,320 well 395 00:16:46,320 --> 00:16:47,320 so I guess 396 00:16:47,320 --> 00:16:48,320 here again 397 00:16:48,320 --> 00:16:49,320 it always depends 398 00:16:49,320 --> 00:16:50,320 on what you're building 399 00:16:50,320 --> 00:16:51,320 what's your product 400 00:16:51,320 --> 00:16:52,320 what's your 401 00:16:52,320 --> 00:16:53,320 model 402 00:16:53,320 --> 00:16:54,320 of course 403 00:16:54,320 --> 00:16:55,320 if you are 404 00:16:55,320 --> 00:16:56,320 in the 405 00:16:56,320 --> 00:16:58,320 aero industry 406 00:16:58,320 --> 00:16:59,320 you're gonna 407 00:16:59,320 --> 00:17:00,320 get like used to 408 00:17:00,320 --> 00:17:01,320 being regulated 409 00:17:01,320 --> 00:17:02,320 and you're 410 00:17:02,320 --> 00:17:03,320 you have 411 00:17:03,320 --> 00:17:04,320 a lot of 412 00:17:04,320 --> 00:17:05,320 before even 413 00:17:05,320 --> 00:17:06,320 being able 414 00:17:06,320 --> 00:17:07,320 to be a partner 415 00:17:07,320 --> 00:17:08,320 to 416 00:17:08,320 --> 00:17:09,320 yeah 417 00:17:09,320 --> 00:17:10,320 you're gonna have 418 00:17:10,320 --> 00:17:11,320 a lot of regulation 419 00:17:11,320 --> 00:17:12,320 on that side 420 00:17:12,320 --> 00:17:13,320 but 421 00:17:13,320 --> 00:17:14,320 medical products 422 00:17:14,320 --> 00:17:15,320 if you're building 423 00:17:15,320 --> 00:17:16,320 robots 424 00:17:16,320 --> 00:17:17,320 that are here 425 00:17:17,320 --> 00:17:18,320 to help 426 00:17:18,320 --> 00:17:19,320 surgeons 427 00:17:19,320 --> 00:17:20,320 of course 428 00:17:20,320 --> 00:17:21,320 you're gonna 429 00:17:21,320 --> 00:17:22,320 like we're gonna 430 00:17:22,320 --> 00:17:24,320 have a particular 431 00:17:24,320 --> 00:17:25,320 regulation 432 00:17:25,320 --> 00:17:26,320 on this 433 00:17:26,320 --> 00:17:27,320 because of course 434 00:17:27,320 --> 00:17:28,320 it's like 435 00:17:28,320 --> 00:17:29,320 not just 436 00:17:29,320 --> 00:17:30,320 product safety 437 00:17:30,320 --> 00:17:31,320 it's like 438 00:17:31,320 --> 00:17:32,320 product safety 439 00:17:32,320 --> 00:17:33,320 for like 440 00:17:33,320 --> 00:17:34,320 touching humans 441 00:17:34,320 --> 00:17:35,320 so I think 442 00:17:35,320 --> 00:17:36,320 medical products 443 00:17:36,320 --> 00:17:37,320 cars 444 00:17:37,320 --> 00:17:38,320 are also 445 00:17:38,320 --> 00:17:39,320 an industry 446 00:17:39,320 --> 00:17:40,320 that is already 447 00:17:40,320 --> 00:17:41,320 highly regulated 448 00:17:41,320 --> 00:17:42,320 and where your 449 00:17:42,320 --> 00:17:43,320 like autonomous 450 00:17:43,320 --> 00:17:44,320 autonomous car 451 00:17:44,320 --> 00:17:45,320 there's a lot of 452 00:17:45,320 --> 00:17:46,320 discussion 453 00:17:46,320 --> 00:17:47,320 on regulation 454 00:17:47,320 --> 00:17:48,320 as well 455 00:17:48,320 --> 00:17:49,320 and 456 00:17:49,320 --> 00:17:50,320 that also goes 457 00:17:50,320 --> 00:17:51,320 back to 458 00:17:51,320 --> 00:17:52,320 personal data 459 00:17:52,320 --> 00:17:53,320 because 460 00:17:53,320 --> 00:17:54,320 a lot of 461 00:17:54,320 --> 00:17:55,320 the 462 00:17:55,320 --> 00:17:56,320 autonomous cars 463 00:17:56,320 --> 00:17:57,320 are actually 464 00:17:57,320 --> 00:17:58,320 like 465 00:17:58,320 --> 00:17:59,320 collecting 466 00:17:59,320 --> 00:18:00,320 a lot of 467 00:18:00,320 --> 00:18:01,320 personal data 468 00:18:01,320 --> 00:18:02,320 which is also 469 00:18:02,320 --> 00:18:03,320 like something 470 00:18:03,320 --> 00:18:04,320 that goes back 471 00:18:04,320 --> 00:18:05,320 to GDPR 472 00:18:05,320 --> 00:18:06,320 the finance sector 473 00:18:06,320 --> 00:18:07,320 as well 474 00:18:07,320 --> 00:18:08,320 is very 475 00:18:08,320 --> 00:18:09,320 highly regulated 476 00:18:09,320 --> 00:18:10,320 and 477 00:18:10,320 --> 00:18:11,320 I think 478 00:18:11,320 --> 00:18:12,320 I also wanted 479 00:18:12,320 --> 00:18:13,320 to mention 480 00:18:13,320 --> 00:18:14,320 that 481 00:18:14,320 --> 00:18:15,320 in the digital 482 00:18:15,320 --> 00:18:16,320 services act 483 00:18:16,320 --> 00:18:17,320 that is actually 484 00:18:17,320 --> 00:18:18,320 not 485 00:18:18,320 --> 00:18:19,320 it's related 486 00:18:19,320 --> 00:18:20,320 to the protection 487 00:18:20,320 --> 00:18:21,320 of personal data 488 00:18:21,320 --> 00:18:22,320 but it's not 489 00:18:22,320 --> 00:18:23,320 in the GDPR 490 00:18:23,320 --> 00:18:24,320 because it's 491 00:18:24,320 --> 00:18:25,320 in the DSA 492 00:18:25,320 --> 00:18:26,320 it's a 493 00:18:26,320 --> 00:18:27,320 regulation 494 00:18:27,320 --> 00:18:28,320 on 495 00:18:28,320 --> 00:18:29,320 recommend systems 496 00:18:29,320 --> 00:18:30,320 so 497 00:18:30,320 --> 00:18:31,320 basically 498 00:18:31,320 --> 00:18:32,320 if you're 499 00:18:32,320 --> 00:18:33,320 training 500 00:18:33,320 --> 00:18:34,320 a model 501 00:18:34,320 --> 00:18:35,320 if you're 502 00:18:35,320 --> 00:18:36,320 doing machine learning 503 00:18:36,320 --> 00:18:37,320 and you're 504 00:18:37,320 --> 00:18:38,320 trying to know 505 00:18:38,320 --> 00:18:39,320 which are 506 00:18:39,320 --> 00:18:40,320 the advertising 507 00:18:40,320 --> 00:18:41,320 that are 508 00:18:41,320 --> 00:18:42,320 gonna be 509 00:18:42,320 --> 00:18:43,320 the most impactful 510 00:18:43,320 --> 00:18:44,320 to the person 511 00:18:44,320 --> 00:18:45,320 you have a provision 512 00:18:45,320 --> 00:18:46,320 you have a few provisions 513 00:18:46,320 --> 00:18:48,320 actually in the DSA 514 00:18:48,320 --> 00:18:49,320 that are regulating 515 00:18:49,320 --> 00:18:50,320 recommended systems 516 00:18:50,320 --> 00:18:51,320 so 517 00:18:51,320 --> 00:18:52,320 my point would be 518 00:18:52,320 --> 00:18:53,320 very like 519 00:18:53,320 --> 00:18:54,320 it really depends 520 00:18:54,320 --> 00:18:55,320 on the sector 521 00:18:55,320 --> 00:18:56,320 and the product 522 00:18:56,320 --> 00:18:57,320 you're building 523 00:18:57,320 --> 00:18:58,320 and actually then 524 00:18:58,320 --> 00:18:59,320 to try to 525 00:18:59,320 --> 00:19:00,320 ask yourself 526 00:19:00,320 --> 00:19:01,320 okay what I'm 527 00:19:01,320 --> 00:19:02,320 what kind of data 528 00:19:02,320 --> 00:19:03,320 I have 529 00:19:03,320 --> 00:19:04,320 what kind of regulation 530 00:19:04,320 --> 00:19:05,320 that may already exist 531 00:19:05,320 --> 00:19:06,320 and apply to my business 532 00:19:06,320 --> 00:19:07,320 and then 533 00:19:07,320 --> 00:19:08,320 pretty much 534 00:19:08,320 --> 00:19:09,320 yeah 535 00:19:09,320 --> 00:19:10,320 try to 536 00:19:10,320 --> 00:19:11,320 to 537 00:19:11,320 --> 00:19:12,320 to be as 538 00:19:12,320 --> 00:19:13,320 you know 539 00:19:13,320 --> 00:19:14,320 as careful 540 00:19:14,320 --> 00:19:15,320 as possible 541 00:19:15,320 --> 00:19:16,320 could you talk 542 00:19:16,320 --> 00:19:17,320 a bit more 543 00:19:17,320 --> 00:19:18,320 as well 544 00:19:18,320 --> 00:19:19,320 on the 545 00:19:19,320 --> 00:19:20,320 to again 546 00:19:20,320 --> 00:19:21,320 the anti-discrimination laws 547 00:19:21,320 --> 00:19:22,320 that you 548 00:19:22,320 --> 00:19:23,320 or regulations 549 00:19:23,320 --> 00:19:24,320 that you mentioned initially 550 00:19:24,320 --> 00:19:25,320 so 551 00:19:25,320 --> 00:19:26,320 when I said 552 00:19:26,320 --> 00:19:27,320 that this might apply 553 00:19:27,320 --> 00:19:28,320 to sector focused things 554 00:19:28,320 --> 00:19:29,320 it's because 555 00:19:29,320 --> 00:19:30,320 I imagine 556 00:19:30,320 --> 00:19:31,320 it might be particularly relevant 557 00:19:31,320 --> 00:19:32,320 in sectors 558 00:19:32,320 --> 00:19:33,320 of HR 559 00:19:33,320 --> 00:19:34,320 of finance 560 00:19:34,320 --> 00:19:35,320 for example 561 00:19:35,320 --> 00:19:36,320 yeah 562 00:19:36,320 --> 00:19:37,320 what is 563 00:19:37,320 --> 00:19:38,320 the state of things 564 00:19:38,320 --> 00:19:39,320 here as well 565 00:19:39,320 --> 00:19:40,320 and 566 00:19:40,320 --> 00:19:41,320 am I right 567 00:19:41,320 --> 00:19:42,320 in saying 568 00:19:42,320 --> 00:19:43,320 that it's sector focused 569 00:19:43,320 --> 00:19:44,320 for example 570 00:19:44,320 --> 00:19:45,320 so 571 00:19:45,320 --> 00:19:46,320 this whole 572 00:19:46,320 --> 00:19:46,500 but 573 00:19:46,500 --> 00:19:47,320 the 574 00:19:47,320 --> 00:19:48,320 state 575 00:19:48,320 --> 00:19:49,320 based 576 00:19:49,320 --> 00:19:52,320 which 577 00:19:52,320 --> 00:19:53,320 is 578 00:19:53,320 --> 00:19:54,320 a 579 00:19:54,320 --> 00:19:55,320 the 580 00:19:55,320 --> 00:19:56,320 sort of 581 00:19:56,320 --> 00:19:57,320 babies 582 00:19:57,320 --> 00:19:58,320 the 583 00:19:58,320 --> 00:19:59,320 workers 584 00:19:59,320 --> 00:20:01,320 there 585 00:20:01,320 --> 00:20:02,320 you 586 00:20:02,320 --> 00:20:03,320 are 587 00:20:03,320 --> 00:20:04,320 basically 588 00:20:04,320 --> 00:20:05,320 we 589 00:20:05,320 --> 00:20:06,320 don't 590 00:20:06,320 --> 00:20:07,320 that 591 00:20:07,320 --> 00:20:08,320 that 592 00:20:08,320 --> 00:20:09,320 we 593 00:20:09,320 --> 00:20:10,320 we 594 00:20:10,320 --> 00:20:11,040 actually 595 00:20:11,040 --> 00:20:12,080 you're 596 00:20:12,080 --> 00:20:13,060 you're 597 00:20:13,060 --> 00:20:13,200 even 598 00:20:13,200 --> 00:20:13,320 can 599 00:20:13,320 --> 00:20:20,320 Perhaps it's a good example, HR, perhaps to move also to AI access. 600 00:20:20,320 --> 00:20:25,320 HR software are not regulated right now, not really. 601 00:20:25,320 --> 00:20:29,320 You have anti-discrimination law to your HR processes, 602 00:20:29,320 --> 00:20:33,320 so you should not discriminate people when you're hiring people 603 00:20:33,320 --> 00:20:37,320 or when you're evaluating someone in your company. 604 00:20:37,320 --> 00:20:40,320 And there would be some AI systems, 605 00:20:40,320 --> 00:20:45,320 there is already AI systems that help HR services to filter the images they receive, 606 00:20:45,320 --> 00:20:51,320 for instance, or to pass tests when you have different applicants, 607 00:20:51,320 --> 00:20:56,320 and you have an automated analysis of the test. 608 00:20:56,320 --> 00:21:01,320 And this is where existing law exists, anti-discrimination. 609 00:21:01,320 --> 00:21:06,320 If you're able to prove that you've been discriminated by a company, you can act. 610 00:21:06,320 --> 00:21:09,320 But it's very difficult to prove. 611 00:21:09,320 --> 00:21:10,320 If you... 612 00:21:10,320 --> 00:21:12,320 You can challenge it on the GDPR way, saying, 613 00:21:12,320 --> 00:21:17,320 OK, you are processing my personal data to do that, I do not agree. 614 00:21:17,320 --> 00:21:22,320 So you have the question, OK, can we rely on consent when you're an applicant? 615 00:21:22,320 --> 00:21:25,320 Well, obviously, you would consent to anything the company would propose you 616 00:21:25,320 --> 00:21:27,320 because you want to apply to that company. 617 00:21:27,320 --> 00:21:30,320 It's very rare that you say, no, I want to oppose that, 618 00:21:30,320 --> 00:21:34,320 and the company would say, OK, but you don't come in. 619 00:21:34,320 --> 00:21:39,320 And the AI act will provide some kind of 620 00:21:39,320 --> 00:21:44,320 legal protection in some way, and tools also for the regulator, 621 00:21:44,320 --> 00:21:51,320 because AI systems that are used for HR will need to comply with a few rules from the AI act, 622 00:21:51,320 --> 00:21:56,320 and in that sense, it will really complement and perhaps operationalize for us, 623 00:21:56,320 --> 00:22:01,320 operationalize what we expect from this software in that context, 624 00:22:01,320 --> 00:22:08,320 and try and maybe make it more straightforward than deducing from GDPR all the rules that may apply 625 00:22:08,320 --> 00:22:11,320 to an HR software. 626 00:22:11,320 --> 00:22:14,320 That's a very smooth transition into the AI act, thank you, 627 00:22:14,320 --> 00:22:19,320 which we will talk about because it is an important topic at the moment. 628 00:22:19,320 --> 00:22:22,320 So speaking of the AI act, my first question would be, 629 00:22:22,320 --> 00:22:24,320 who needs to worry about the AI act? 630 00:22:24,320 --> 00:22:26,320 Is it all AI companies? 631 00:22:26,320 --> 00:22:29,320 Is it only companies working on things that are very risky? 632 00:22:29,320 --> 00:22:36,320 To what degree should you worry if you're building an AI today? 633 00:22:36,320 --> 00:22:38,320 So first of all, I think, 634 00:22:38,320 --> 00:22:43,320 we need to take a step back and just say that the AI act is a regulation 635 00:22:43,320 --> 00:22:47,320 that is currently being negotiated at the EU level. 636 00:22:47,320 --> 00:22:51,320 We are at the final phase of the negotiations. 637 00:22:51,320 --> 00:22:55,320 We have, so it's called the dialogue, 638 00:22:55,320 --> 00:23:03,320 so the institutions at the EU level are actually making sure that they all agree on everything. 639 00:23:03,320 --> 00:23:06,320 And so it's still in progress. 640 00:23:06,320 --> 00:23:08,320 There are three things where there are still, 641 00:23:08,320 --> 00:23:11,320 a lot of discussions, 642 00:23:11,320 --> 00:23:19,320 but what you need to know is that the AI adopts a risk-based approach. 643 00:23:19,320 --> 00:23:22,320 You have risks that are unacceptable, 644 00:23:22,320 --> 00:23:30,320 and there you have three main topics where you have behavioral manipulation, 645 00:23:30,320 --> 00:23:32,320 you have social scoring, 646 00:23:32,320 --> 00:23:36,320 and you have real-time and remote biometric identification systems. 647 00:23:36,320 --> 00:23:38,320 And all three are considered 648 00:23:38,320 --> 00:23:40,320 in acceptable risk, 649 00:23:40,320 --> 00:23:41,320 and they're all forbidden. 650 00:23:41,320 --> 00:23:47,320 And then you have the high-risk systems with eight categories. 651 00:23:47,320 --> 00:23:49,320 I'm not going to go through all of them. 652 00:23:49,320 --> 00:23:51,320 But basically for these risks, 653 00:23:51,320 --> 00:23:53,320 we consider that you can still do them, 654 00:23:53,320 --> 00:23:55,320 but if you do them, 655 00:23:55,320 --> 00:23:58,320 you need to put in place compliance, 656 00:23:58,320 --> 00:24:00,320 compliance provisions, 657 00:24:00,320 --> 00:24:03,320 compliance strategies inside your company. 658 00:24:03,320 --> 00:24:05,320 And then we have the third category, 659 00:24:05,320 --> 00:24:07,320 which is the lower level of risk. 660 00:24:07,320 --> 00:24:09,320 The lower level of risk, 661 00:24:09,320 --> 00:24:11,320 where you pretty much can do whatever you want 662 00:24:11,320 --> 00:24:14,320 without having loads of obligations. 663 00:24:14,320 --> 00:24:17,320 So I think this is very important to keep in mind, 664 00:24:17,320 --> 00:24:18,320 because here, 665 00:24:18,320 --> 00:24:23,320 basically if you're not doing one of the three things I just mentioned, 666 00:24:23,320 --> 00:24:31,320 social scoring or real-time biometric identification systems 667 00:24:31,320 --> 00:24:33,320 or manipulation of people, 668 00:24:33,320 --> 00:24:36,320 basically you might fall into the high-risk system. 669 00:24:36,320 --> 00:24:39,320 And then you have specific obligations. 670 00:24:39,320 --> 00:24:41,320 But to answer your question, 671 00:24:41,320 --> 00:24:46,320 basically you really here then need to look at the provisions in the law 672 00:24:46,320 --> 00:24:49,320 and see if you fall into them. 673 00:24:49,320 --> 00:24:51,320 It really depends on what you're building 674 00:24:51,320 --> 00:24:52,320 and what you're developing. 675 00:24:52,320 --> 00:24:57,320 And then if you don't fall into these categories, 676 00:24:57,320 --> 00:25:00,320 you're probably going to be in the acceptable risk section 677 00:25:00,320 --> 00:25:03,320 where you can pretty much do not have obligations. 678 00:25:03,320 --> 00:25:05,320 Would you agree with Antoine 679 00:25:05,320 --> 00:25:09,320 just so that there's some kind of... 680 00:25:09,320 --> 00:25:10,320 Yeah, exactly. 681 00:25:10,320 --> 00:25:14,320 So we wait for the final list of annex 3 of the AI Act. 682 00:25:14,320 --> 00:25:16,320 We list the high-risk system. 683 00:25:16,320 --> 00:25:18,320 We mentioned some of those. 684 00:25:18,320 --> 00:25:21,320 I don't know, AI for the justice administration, 685 00:25:21,320 --> 00:25:23,320 AI for HR, 686 00:25:25,320 --> 00:25:29,320 some other biometric system. 687 00:25:29,320 --> 00:25:34,320 So you have a list that I think the co-legislator 688 00:25:34,320 --> 00:25:37,320 wanted to make it as specific as possible 689 00:25:37,320 --> 00:25:39,320 in order to make it clear for companies 690 00:25:39,320 --> 00:25:41,320 about who is concerned and not. 691 00:25:41,320 --> 00:25:45,320 But the list of the parliament is longer than the list of the council, 692 00:25:45,320 --> 00:25:48,320 so we will wait for the final list. 693 00:25:48,320 --> 00:25:50,320 Maybe what I could mention is, 694 00:25:50,320 --> 00:25:54,320 for instance, one of the things in the list is 695 00:25:54,320 --> 00:25:58,320 an AI system that is used for exams for students. 696 00:25:58,320 --> 00:26:01,320 It can be high-risk if it's something that decides 697 00:26:01,320 --> 00:26:03,320 if you have your job or not. 698 00:26:03,320 --> 00:26:04,320 OK, it's high-risk. 699 00:26:04,320 --> 00:26:06,320 It could be high-risk. 700 00:26:06,320 --> 00:26:08,320 What I would say is, 701 00:26:08,320 --> 00:26:11,320 we at the CNIL, we issued guidance in September 702 00:26:11,320 --> 00:26:14,320 about the very same type of system 703 00:26:14,320 --> 00:26:16,320 and how you can comply with GDPR. 704 00:26:16,320 --> 00:26:19,320 So it doesn't mean that if you're not high-risk, 705 00:26:19,320 --> 00:26:22,320 you do not have additional provision from the AI Act. 706 00:26:22,320 --> 00:26:25,320 It doesn't mean that you can do whatever you want 707 00:26:25,320 --> 00:26:26,320 regarding the AI Act. 708 00:26:26,320 --> 00:26:28,320 But if you process personal data 709 00:26:28,320 --> 00:26:32,320 and if it's set for it with a large effect 710 00:26:32,320 --> 00:26:33,320 on the AI Act, 711 00:26:33,320 --> 00:26:35,320 then some people of you need to comply, 712 00:26:35,320 --> 00:26:36,320 which is what happens. 713 00:26:36,320 --> 00:26:37,320 Thanks. 714 00:26:37,320 --> 00:26:38,320 And this will be my last question 715 00:26:38,320 --> 00:26:40,320 before we open to the room. 716 00:26:40,320 --> 00:26:42,320 My question is this. 717 00:26:42,320 --> 00:26:45,320 So I think the wider discussion around the AI Act 718 00:26:45,320 --> 00:26:47,320 for start-ups in this space is obviously 719 00:26:47,320 --> 00:26:49,320 that it's hard to prove some things 720 00:26:49,320 --> 00:26:50,320 that we don't know. 721 00:26:50,320 --> 00:26:51,320 It's not a common law. 722 00:26:51,320 --> 00:26:54,320 It's not forward thinking. 723 00:26:54,320 --> 00:26:55,320 At the start of the day, 724 00:26:55,320 --> 00:26:57,320 how can you make specific books 725 00:26:57,320 --> 00:27:00,320 that you can secure that you are future-proof 726 00:27:00,320 --> 00:27:02,320 in terms of regulation? 727 00:27:02,320 --> 00:27:03,320 Are you thinking of things 728 00:27:03,320 --> 00:27:05,320 like making sure you're transparent on XYZ 729 00:27:05,320 --> 00:27:08,320 or, I don't know, having a certain, you know, 730 00:27:08,320 --> 00:27:11,320 having some kind of or logs 731 00:27:11,320 --> 00:27:12,320 or things like that? 732 00:27:12,320 --> 00:27:14,320 Are there very specific processes 733 00:27:14,320 --> 00:27:15,320 that you can put in place 734 00:27:15,320 --> 00:27:17,320 to make sure that you're taking those boxes 735 00:27:17,320 --> 00:27:19,320 that are likely to be the ones that fall 736 00:27:19,320 --> 00:27:24,320 in upcoming legislation? 737 00:27:24,320 --> 00:27:29,320 I think the personal is beginning to document. 738 00:27:29,320 --> 00:27:31,320 Normally, it's a good professional practice 739 00:27:31,320 --> 00:27:32,320 to do that. 740 00:27:32,320 --> 00:27:34,320 But really document the data. 741 00:27:34,320 --> 00:27:35,320 Document the source of data, 742 00:27:35,320 --> 00:27:36,320 what has been done, 743 00:27:36,320 --> 00:27:40,320 and be prepared to answer those questions 744 00:27:40,320 --> 00:27:42,320 and to answer the questions such as, 745 00:27:42,320 --> 00:27:45,320 do you have personal data in the test? 746 00:27:45,320 --> 00:27:49,320 Do you have the right data in the test? 747 00:27:49,320 --> 00:27:53,320 Also, be able to have enough documentation. 748 00:27:53,320 --> 00:27:56,320 Because just also when you use, 749 00:27:56,320 --> 00:28:01,320 a lot of AI systems are using existing data 750 00:28:01,320 --> 00:28:02,320 or API. 751 00:28:02,320 --> 00:28:04,320 So if you use ChatPT API, 752 00:28:04,320 --> 00:28:06,320 if you use YOLO for computer vision, 753 00:28:06,320 --> 00:28:08,320 be aware of the limitation 754 00:28:08,320 --> 00:28:12,320 of that kind of either generic data sets 755 00:28:12,320 --> 00:28:13,320 or generic model. 756 00:28:13,320 --> 00:28:19,320 And be critical if you want to use those 757 00:28:19,320 --> 00:28:21,320 for sensitive use. 758 00:28:21,320 --> 00:28:24,320 If you want to use YOLO 759 00:28:24,320 --> 00:28:26,320 to implement that on cameras, 760 00:28:26,320 --> 00:28:27,320 for law enforcement, 761 00:28:27,320 --> 00:28:29,320 to arrest people, 762 00:28:29,320 --> 00:28:30,320 you need to be aware 763 00:28:30,320 --> 00:28:31,320 of the limitations 764 00:28:31,320 --> 00:28:33,320 of being able to explain 765 00:28:33,320 --> 00:28:35,320 all the bugs that you've been using. 766 00:28:35,320 --> 00:28:37,320 If you don't have enough information 767 00:28:37,320 --> 00:28:39,320 on YOLO to do that, 768 00:28:39,320 --> 00:28:41,320 perhaps use a different data set 769 00:28:41,320 --> 00:28:42,320 or a different model 770 00:28:42,320 --> 00:28:44,320 or even perhaps try to collect 771 00:28:44,320 --> 00:28:49,320 your own data for your model. 772 00:28:49,320 --> 00:28:51,320 Maybe, here again, 773 00:28:51,320 --> 00:28:53,320 try to take it back. 774 00:28:53,320 --> 00:28:54,320 I'm going to say something 775 00:28:54,320 --> 00:28:56,320 that is not echoing 776 00:28:56,320 --> 00:28:57,320 what we heard this morning 777 00:28:57,320 --> 00:29:00,320 from Eric Schmidt. 778 00:29:00,320 --> 00:29:01,320 So I think, 779 00:29:01,320 --> 00:29:02,320 you know, 780 00:29:02,320 --> 00:29:04,320 having looked at regulation 781 00:29:04,320 --> 00:29:05,320 on technology law 782 00:29:05,320 --> 00:29:08,320 for quite a long time now, 783 00:29:08,320 --> 00:29:10,320 I can safely say 784 00:29:10,320 --> 00:29:12,320 if we regulate it in Europe, 785 00:29:12,320 --> 00:29:14,320 it's much more efficient, 786 00:29:14,320 --> 00:29:17,320 it's much more valuable, 787 00:29:17,320 --> 00:29:20,320 and it's much more easy to apply. 788 00:29:20,320 --> 00:29:22,320 Before in the 90s, 789 00:29:22,320 --> 00:29:24,320 we had directives 790 00:29:24,320 --> 00:29:26,320 where many states could pretty much then 791 00:29:26,320 --> 00:29:29,320 apply the laws in national 792 00:29:29,320 --> 00:29:30,320 with their own interpretation. 793 00:29:30,320 --> 00:29:33,320 And we didn't have, like, 794 00:29:33,320 --> 00:29:35,320 a strong framework for people 795 00:29:35,320 --> 00:29:37,320 to actually just, you know, 796 00:29:37,320 --> 00:29:39,320 apply across all EU member states 797 00:29:39,320 --> 00:29:40,320 the same law. 798 00:29:40,320 --> 00:29:42,320 And we should be thankful 799 00:29:42,320 --> 00:29:44,320 that we have laws 800 00:29:44,320 --> 00:29:45,320 at the EU member states. 801 00:29:45,320 --> 00:29:47,320 Otherwise, you would have to deal 802 00:29:47,320 --> 00:29:52,320 with 27 different national laws. 803 00:29:52,320 --> 00:29:54,320 And I also think 804 00:29:54,320 --> 00:29:56,320 it's another, like, point. 805 00:29:56,320 --> 00:29:58,320 We're stronger together. 806 00:29:58,320 --> 00:29:59,320 We saw that 807 00:29:59,320 --> 00:30:00,320 with the GDPR. 808 00:30:00,320 --> 00:30:01,320 When we adopted in Europe 809 00:30:01,320 --> 00:30:02,320 the GDPR, 810 00:30:02,320 --> 00:30:04,320 we had an impact globally 811 00:30:04,320 --> 00:30:05,320 on that regulation. 812 00:30:05,320 --> 00:30:08,320 And what was the success story 813 00:30:08,320 --> 00:30:09,320 of the GDPR 814 00:30:09,320 --> 00:30:10,320 is that now pretty much 815 00:30:10,320 --> 00:30:12,320 all principles in the GDPR 816 00:30:12,320 --> 00:30:14,320 are applied all over the world. 817 00:30:14,320 --> 00:30:15,320 So basically, 818 00:30:15,320 --> 00:30:17,320 the law we created in Europe 819 00:30:17,320 --> 00:30:19,320 is basically the standard 820 00:30:19,320 --> 00:30:22,320 that every company around the world 821 00:30:22,320 --> 00:30:24,320 is pretty much applying. 822 00:30:24,320 --> 00:30:25,320 So I think here 823 00:30:25,320 --> 00:30:27,320 it's a good success story. 824 00:30:27,320 --> 00:30:29,320 I think the AI activity 825 00:30:29,320 --> 00:30:32,320 is not as overreaching 826 00:30:32,320 --> 00:30:33,320 as the GDPR. 827 00:30:33,320 --> 00:30:35,320 So its impact would be different. 828 00:30:35,320 --> 00:30:38,320 But yeah, I'm a fan of Europe. 829 00:30:38,320 --> 00:30:40,320 And I think EU regulation 830 00:30:40,320 --> 00:30:43,320 is actually a strong thing 831 00:30:43,320 --> 00:30:45,320 and much more effective 832 00:30:45,320 --> 00:30:46,320 for businesses. 833 00:30:46,320 --> 00:30:47,320 Thanks. 834 00:30:47,320 --> 00:30:48,320 Thanks, both. 835 00:30:48,320 --> 00:30:50,320 Are there any questions? 836 00:30:50,320 --> 00:30:53,320 Yes, please. 837 00:30:53,320 --> 00:30:54,320 Hi, everyone. 838 00:30:54,320 --> 00:30:55,320 Hi, Daphne. 839 00:30:55,320 --> 00:30:56,320 Nice to see you here. 840 00:30:56,320 --> 00:30:57,320 Well, thanks a lot 841 00:30:57,320 --> 00:30:58,320 for what you just said. 842 00:30:58,320 --> 00:30:59,320 I think we should defend 843 00:30:59,320 --> 00:31:00,320 our institutions 844 00:31:00,320 --> 00:31:01,320 and avoid spitting 845 00:31:01,320 --> 00:31:02,320 on these institutions 846 00:31:02,320 --> 00:31:04,320 to provide the very much rule of law 847 00:31:04,320 --> 00:31:06,320 that the democracy is built upon. 848 00:31:06,320 --> 00:31:07,320 But probably why 849 00:31:07,320 --> 00:31:09,320 some of the external, 850 00:31:09,320 --> 00:31:12,320 the outside stakeholders 851 00:31:12,320 --> 00:31:13,320 like startups 852 00:31:13,320 --> 00:31:14,320 are afraid 853 00:31:14,320 --> 00:31:15,320 of the incoming regulation 854 00:31:15,320 --> 00:31:17,320 that they label as bureaucracy 855 00:31:17,320 --> 00:31:18,320 is because they perceive 856 00:31:18,320 --> 00:31:19,320 that the way in which 857 00:31:19,320 --> 00:31:20,320 the rules are going to be enforced 858 00:31:20,320 --> 00:31:21,320 and manipulating 859 00:31:21,320 --> 00:31:22,320 for example, 860 00:31:22,320 --> 00:31:24,320 to an other regime 861 00:31:24,320 --> 00:31:25,320 could be seen 862 00:31:25,320 --> 00:31:27,320 as bureaucratic intensive, 863 00:31:27,320 --> 00:31:28,320 comprehensive compliance. 864 00:31:28,320 --> 00:31:29,320 And my question to you, 865 00:31:29,320 --> 00:31:30,320 Bertrand, 866 00:31:30,320 --> 00:31:31,320 and in general, 867 00:31:31,320 --> 00:31:32,320 and we have Guillaume Bavarin here, 868 00:31:32,320 --> 00:31:33,320 Lachaillet coordinators, 869 00:31:33,320 --> 00:31:34,320 what could we do 870 00:31:34,320 --> 00:31:35,320 to advance in practice 871 00:31:35,320 --> 00:31:36,320 a single point of contact 872 00:31:36,320 --> 00:31:37,320 for startups 873 00:31:37,320 --> 00:31:38,320 that deals with data, 874 00:31:38,320 --> 00:31:39,320 that deals with algorithms, 875 00:31:39,320 --> 00:31:40,320 that potentially 876 00:31:40,320 --> 00:31:41,320 deals with copyright? 877 00:31:41,320 --> 00:31:42,320 So, through guidance, 878 00:31:42,320 --> 00:31:43,320 for example, 879 00:31:43,320 --> 00:31:44,320 could you start 880 00:31:44,320 --> 00:31:45,320 a working group 881 00:31:45,320 --> 00:31:46,320 bringing together 882 00:31:46,320 --> 00:31:47,320 who does measurement, 883 00:31:47,320 --> 00:31:48,320 and others 884 00:31:48,320 --> 00:31:49,320 to discuss 885 00:31:49,320 --> 00:31:50,320 and to engage 886 00:31:50,320 --> 00:31:51,320 in a comprehensive 887 00:31:51,320 --> 00:31:52,320 and comprehensive 888 00:31:52,320 --> 00:31:53,320 compliance 889 00:31:53,320 --> 00:31:54,320 to ensure 890 00:31:54,320 --> 00:31:55,320 that we are 891 00:31:55,320 --> 00:31:56,320 able to 892 00:31:56,320 --> 00:31:57,320 discuss 893 00:31:57,320 --> 00:31:58,320 and to engage 894 00:31:58,320 --> 00:31:59,320 with the ecotestories 895 00:31:59,320 --> 00:32:00,320 gathered here 896 00:32:00,320 --> 00:32:01,320 in a way that can 897 00:32:01,320 --> 00:32:02,320 reassure them 898 00:32:02,320 --> 00:32:03,320 in terms of 899 00:32:03,320 --> 00:32:04,320 that these regulations 900 00:32:04,320 --> 00:32:05,320 that are coming 901 00:32:05,320 --> 00:32:06,320 will create 902 00:32:06,320 --> 00:32:07,320 a level playing field 903 00:32:07,320 --> 00:32:08,320 to be eventually 904 00:32:08,320 --> 00:32:09,320 a sort of competitive advantage. 905 00:32:09,320 --> 00:32:10,320 Is this something 906 00:32:10,320 --> 00:32:11,320 that we could hope 907 00:32:11,320 --> 00:32:12,320 is already there? 908 00:32:12,320 --> 00:32:13,320 And what should we do 909 00:32:13,320 --> 00:32:14,320 to anticipate 910 00:32:14,320 --> 00:32:15,320 as smart as possible 911 00:32:15,320 --> 00:32:16,320 and it's already very smart? 912 00:32:16,320 --> 00:32:17,320 And I said that 913 00:32:17,320 --> 00:32:18,320 because before 914 00:32:18,320 --> 00:32:19,320 your position 915 00:32:19,320 --> 00:32:20,320 you were 916 00:32:20,320 --> 00:32:21,320 the actual 917 00:32:21,320 --> 00:32:22,320 AI coordinator. 918 00:32:22,320 --> 00:32:23,320 Yeah. 919 00:32:23,320 --> 00:32:24,320 So, 920 00:32:24,320 --> 00:32:25,320 I think 921 00:32:25,320 --> 00:32:26,320 it's 922 00:32:26,320 --> 00:32:27,320 there is 923 00:32:27,320 --> 00:32:28,320 perhaps two 924 00:32:28,320 --> 00:32:29,320 two elements. 925 00:32:29,320 --> 00:32:30,320 One is 926 00:32:30,320 --> 00:32:31,320 once we have 927 00:32:31,320 --> 00:32:32,320 the AI act, 928 00:32:32,320 --> 00:32:33,320 one of the effects 929 00:32:33,320 --> 00:32:34,320 of the act 930 00:32:34,320 --> 00:32:35,320 on the regulatory 931 00:32:35,320 --> 00:32:36,320 point of view 932 00:32:36,320 --> 00:32:37,320 will be to 933 00:32:37,320 --> 00:32:38,320 how we coordinate 934 00:32:38,320 --> 00:32:39,320 our efforts. 935 00:32:39,320 --> 00:32:40,320 Because the use 936 00:32:40,320 --> 00:32:41,320 of AI in the financial 937 00:32:41,320 --> 00:32:42,320 sector will be 938 00:32:42,320 --> 00:32:43,320 obviously 939 00:32:43,320 --> 00:32:44,320 by the financial 940 00:32:44,320 --> 00:32:45,320 regulator, 941 00:32:45,320 --> 00:32:46,320 the use of AI 942 00:32:46,320 --> 00:32:47,320 in the health sector 943 00:32:47,320 --> 00:32:48,320 will be 944 00:32:48,320 --> 00:32:49,320 obviously 945 00:32:49,320 --> 00:32:50,320 by the health 946 00:32:50,320 --> 00:32:51,320 regulator 947 00:32:51,320 --> 00:32:52,320 that already 948 00:32:52,320 --> 00:32:53,320 authorizes 949 00:32:53,320 --> 00:32:54,320 medical device. 950 00:32:54,320 --> 00:32:55,320 Maybe other 951 00:32:55,320 --> 00:32:56,320 the HR system 952 00:32:56,320 --> 00:32:57,320 will be 953 00:32:57,320 --> 00:32:58,320 actually 954 00:32:58,320 --> 00:32:59,320 in the 955 00:32:59,320 --> 00:33:00,320 equation 956 00:33:00,320 --> 00:33:01,320 of how we coordinate 957 00:33:01,320 --> 00:33:02,320 the efforts 958 00:33:02,320 --> 00:33:03,320 of the regulator. 959 00:33:03,320 --> 00:33:04,320 Now, 960 00:33:04,320 --> 00:33:05,320 we make sure 961 00:33:05,320 --> 00:33:06,320 to companies 962 00:33:06,320 --> 00:33:07,320 that they will not 963 00:33:07,320 --> 00:33:08,320 have three different regulators 964 00:33:08,320 --> 00:33:09,320 asking for 965 00:33:09,320 --> 00:33:10,320 different rules, 966 00:33:10,320 --> 00:33:11,320 different regulations. 967 00:33:11,320 --> 00:33:12,320 I think 968 00:33:12,320 --> 00:33:13,320 we all agree 969 00:33:13,320 --> 00:33:14,320 that it's necessary 970 00:33:14,320 --> 00:33:15,320 and 971 00:33:15,320 --> 00:33:16,320 it will 972 00:33:16,320 --> 00:33:17,320 to be launched 973 00:33:17,320 --> 00:33:18,320 in 2024 974 00:33:18,320 --> 00:33:19,320 when we know 975 00:33:19,320 --> 00:33:20,320 which are 976 00:33:20,320 --> 00:33:21,320 the high risk. 977 00:33:21,320 --> 00:33:22,320 So, 978 00:33:22,320 --> 00:33:23,320 which are 979 00:33:23,320 --> 00:33:24,320 our 980 00:33:24,320 --> 00:33:25,320 Dutch 981 00:33:25,320 --> 00:33:26,320 equivalent 982 00:33:26,320 --> 00:33:27,320 of the 983 00:33:27,320 --> 00:33:28,320 risk 984 00:33:28,320 --> 00:33:29,320 and 985 00:33:29,320 --> 00:33:30,320 the 986 00:33:30,320 --> 00:33:31,320 role of 987 00:33:31,320 --> 00:33:32,320 coordination. 988 00:33:32,320 --> 00:33:33,320 So, 989 00:33:33,320 --> 00:33:34,320 they are 990 00:33:34,320 --> 00:33:35,320 doing that 991 00:33:35,320 --> 00:33:36,320 and 992 00:33:36,320 --> 00:33:37,320 there will 993 00:33:37,320 --> 00:33:38,320 be 994 00:33:38,320 --> 00:33:39,320 the 995 00:33:39,320 --> 00:33:40,320 single point 996 00:33:40,320 --> 00:33:41,320 of contact 997 00:33:41,320 --> 00:33:42,320 or at 998 00:33:42,320 --> 00:33:43,320 least 999 00:33:43,320 --> 00:33:44,320 they will 1000 00:33:44,320 --> 00:33:45,320 be able 1001 00:33:45,320 --> 00:33:46,320 to 1002 00:33:46,320 --> 00:33:47,320 orient 1003 00:33:47,320 --> 00:33:48,320 the company 1004 00:33:48,320 --> 00:33:49,320 to 1005 00:33:49,320 --> 00:33:50,320 . 1006 00:33:50,320 --> 00:33:51,320 What I also 1007 00:33:51,320 --> 00:33:52,320 see is 1008 00:33:52,320 --> 00:33:53,320 that 1009 00:33:53,320 --> 00:33:54,320 you have 1010 00:33:54,320 --> 00:33:55,320 startups 1011 00:33:55,320 --> 00:33:56,320 that want 1012 00:33:56,320 --> 00:33:57,320 to sell 1013 00:33:57,320 --> 00:33:58,320 AI 1014 00:33:58,320 --> 00:33:59,320 to law enforcement. 1015 00:33:59,320 --> 00:34:00,320 Okay, 1016 00:34:00,320 --> 00:34:01,320 you have some 1017 00:34:01,320 --> 00:34:02,320 that say, 1018 00:34:02,320 --> 00:34:03,320 okay, 1019 00:34:03,320 --> 00:34:04,320 I don't want regulation 1020 00:34:04,320 --> 00:34:05,320 but most of them 1021 00:34:05,320 --> 00:34:06,320 they know 1022 00:34:06,320 --> 00:34:07,320 that it's sensitive. 1023 00:34:07,320 --> 00:34:08,320 They know 1024 00:34:08,320 --> 00:34:09,320 that they need 1025 00:34:09,320 --> 00:34:10,320 to understand 1026 00:34:10,320 --> 00:34:11,320 the law 1027 00:34:11,320 --> 00:34:12,320 and they know 1028 00:34:12,320 --> 00:34:13,320 that there is 1029 00:34:13,320 --> 00:34:14,320 a specific 1030 00:34:14,320 --> 00:34:15,320 legal framework 1031 00:34:15,320 --> 00:34:16,320 and they invest 1032 00:34:16,320 --> 00:34:17,320 in that. 1033 00:34:17,320 --> 00:34:18,320 The same for health. 1034 00:34:18,320 --> 00:34:19,320 So, 1035 00:34:19,320 --> 00:34:20,320 we 1036 00:34:20,320 --> 00:34:21,320 I do not 1037 00:34:21,320 --> 00:34:22,320 believe 1038 00:34:22,320 --> 00:34:23,320 in a system 1039 00:34:23,320 --> 00:34:24,320 where, 1040 00:34:24,320 --> 00:34:25,320 I feel, 1041 00:34:25,320 --> 00:34:26,320 that it will be 1042 00:34:26,320 --> 00:34:27,320 for the best 1043 00:34:27,320 --> 00:34:28,320 obviously 1044 00:34:28,320 --> 00:34:29,320 some of these 1045 00:34:29,320 --> 00:34:30,320 regulations 1046 00:34:30,320 --> 00:34:31,320 are there 1047 00:34:31,320 --> 00:34:32,320 for good reasons 1048 00:34:32,320 --> 00:34:33,320 and 1049 00:34:33,320 --> 00:34:34,320 you need 1050 00:34:34,320 --> 00:34:35,320 to 1051 00:34:35,320 --> 00:34:36,320 obviously 1052 00:34:36,320 --> 00:34:37,320 if you want 1053 00:34:37,320 --> 00:34:38,320 to go to 1054 00:34:38,320 --> 00:34:39,320 a risky 1055 00:34:39,320 --> 00:34:40,320 business 1056 00:34:40,320 --> 00:34:41,320 that's high risk 1057 00:34:41,320 --> 00:34:42,320 you need 1058 00:34:42,320 --> 00:34:43,320 to 1059 00:34:43,320 --> 00:34:44,320 know 1060 00:34:44,320 --> 00:34:45,320 what kind 1061 00:34:45,320 --> 00:34:46,320 of legal 1062 00:34:46,320 --> 00:34:47,320 landscape 1063 00:34:47,320 --> 00:34:48,320 applies 1064 00:34:48,320 --> 00:34:49,320 and 1065 00:34:49,320 --> 00:34:50,320 apart 1066 00:34:50,320 --> 00:34:51,320 from AI 1067 00:34:51,320 --> 00:34:52,320 actually 1068 00:34:52,320 --> 00:34:53,320 that will 1069 00:34:53,320 --> 00:34:54,320 give you 1070 00:34:54,320 --> 00:34:55,320 a better 1071 00:34:55,320 --> 00:34:56,320 solution 1072 00:34:56,320 --> 00:34:57,320 for your 1073 00:34:57,320 --> 00:34:58,320 health. 1074 00:34:58,320 --> 00:34:59,320 Thank you so much 1075 00:34:59,320 --> 00:35:00,320 for the talk 1076 00:35:00,320 --> 00:35:01,320 Suzanne and 1077 00:35:01,320 --> 00:35:02,320 Bo-Tang. 1078 00:35:02,320 --> 00:35:03,320 Maybe 1079 00:35:03,320 --> 00:35:04,320 a question 1080 00:35:04,320 --> 00:35:05,320 for you 1081 00:35:05,320 --> 00:35:06,320 Bo-Tang 1082 00:35:06,320 --> 00:35:07,320 and 1083 00:35:07,320 --> 00:35:08,320 recognizing 1084 00:35:08,320 --> 00:35:09,320 my French 1085 00:35:09,320 --> 00:35:10,320 is limited 1086 00:35:10,320 --> 00:35:11,320 and I listened 1087 00:35:11,320 --> 00:35:12,320 to President 1088 00:35:12,320 --> 00:35:13,320 McClellan's 1089 00:35:13,320 --> 00:35:14,320 speech this morning 1090 00:35:14,320 --> 00:35:15,320 without English 1091 00:35:15,320 --> 00:35:16,320 subtitles 1092 00:35:16,320 --> 00:35:17,320 I heard 1093 00:35:17,320 --> 00:35:18,320 that he said 1094 00:35:18,320 --> 00:35:19,320 the French 1095 00:35:19,320 --> 00:35:20,320 government 1096 00:35:20,320 --> 00:35:21,320 is kind of 1097 00:35:21,320 --> 00:35:22,320 working on 1098 00:35:22,320 --> 00:35:23,320 AI legislation 1099 00:35:23,320 --> 00:35:24,320 and regulation 1100 00:35:24,320 --> 00:35:25,320 that we're seeing 1101 00:35:25,320 --> 00:35:26,320 with the 1102 00:35:26,320 --> 00:35:27,320 EU 1103 00:35:27,320 --> 00:35:28,320 Act 1104 00:35:28,320 --> 00:35:29,320 right now 1105 00:35:29,320 --> 00:35:30,320 that the 1106 00:35:30,320 --> 00:35:31,320 possibility 1107 00:35:31,320 --> 00:35:32,320 that might not 1108 00:35:32,320 --> 00:35:33,320 get finalized 1109 00:35:33,320 --> 00:35:34,320 this year 1110 00:35:34,320 --> 00:35:35,320 you know 1111 00:35:35,320 --> 00:35:36,320 there's a lot 1112 00:35:36,320 --> 00:35:37,320 of debate 1113 00:35:37,320 --> 00:35:38,320 on information 1114 00:35:38,320 --> 00:35:39,320 model rules 1115 00:35:39,320 --> 00:35:40,320 and all these 1116 00:35:40,320 --> 00:35:41,320 hurdles 1117 00:35:41,320 --> 00:35:42,320 do you think 1118 00:35:42,320 --> 00:35:43,320 that you know 1119 00:35:43,320 --> 00:35:44,320 the France 1120 00:35:44,320 --> 00:35:45,320 and other 1121 00:35:45,320 --> 00:35:46,320 countries 1122 00:35:46,320 --> 00:35:47,320 will kind 1123 00:35:47,320 --> 00:35:48,320 of start 1124 00:35:48,320 --> 00:35:49,320 crafting 1125 00:35:49,320 --> 00:35:50,320 some AI 1126 00:35:50,320 --> 00:35:51,320 legislation 1127 00:35:51,320 --> 00:35:52,320 you know 1128 00:35:52,320 --> 00:35:53,320 because 1129 00:35:53,320 --> 00:35:54,320 the Act 1130 00:35:54,320 --> 00:35:55,320 has a lot 1131 00:35:55,320 --> 00:35:56,320 of 1132 00:35:56,320 --> 00:35:57,320 initiatives 1133 00:35:57,320 --> 00:35:58,320 with OECD 1134 00:35:58,320 --> 00:35:59,320 about how 1135 00:35:59,320 --> 00:36:00,320 we can 1136 00:36:00,320 --> 00:36:01,320 regulate 1137 00:36:01,320 --> 00:36:02,320 but more 1138 00:36:02,320 --> 00:36:03,320 in a 1139 00:36:03,320 --> 00:36:04,320 co-regulation 1140 00:36:04,320 --> 00:36:05,320 approach 1141 00:36:05,320 --> 00:36:06,320 foundation 1142 00:36:06,320 --> 00:36:07,320 model 1143 00:36:07,320 --> 00:36:08,320 I think 1144 00:36:08,320 --> 00:36:09,320 this is 1145 00:36:09,320 --> 00:36:10,320 what we 1146 00:36:10,320 --> 00:36:11,320 want to 1147 00:36:11,320 --> 00:36:12,320 push 1148 00:36:12,320 --> 00:36:13,320 in early 1149 00:36:13,320 --> 00:36:14,320 in 2024 1150 00:36:14,320 --> 00:36:15,320 but that 1151 00:36:15,320 --> 00:36:16,320 doesn't 1152 00:36:16,320 --> 00:36:17,320 mean 1153 00:36:17,320 --> 00:36:18,320 maybe 1154 00:36:18,320 --> 00:36:19,320 probably 1155 00:36:19,320 --> 00:36:20,320 try to 1156 00:36:20,320 --> 00:36:21,320 replicate 1157 00:36:21,320 --> 00:36:22,320 the 1158 00:36:22,320 --> 00:36:23,320 Act 1159 00:36:23,320 --> 00:36:24,320 now 1160 00:36:24,320 --> 00:36:25,320 well 1161 00:36:25,320 --> 00:36:26,320 I think 1162 00:36:26,320 --> 00:36:27,320 the 1163 00:36:27,320 --> 00:36:28,320 only 1164 00:36:28,320 --> 00:36:29,320 way 1165 00:36:29,320 --> 00:36:30,320 we can 1166 00:36:30,320 --> 00:36:31,320 actually 1167 00:36:31,320 --> 00:36:32,320 fix 1168 00:36:32,320 --> 00:36:33,320 this 1169 00:36:33,320 --> 00:36:34,320 is 1170 00:36:34,320 --> 00:36:35,320 to 1171 00:36:35,320 --> 00:36:36,320 give 1172 00:36:36,320 --> 00:36:37,320 you 1173 00:36:37,320 --> 00:36:38,320 the 1174 00:36:38,320 --> 00:36:39,320 opportunity 1175 00:36:39,320 --> 00:36:40,320 to 1176 00:36:40,320 --> 00:36:41,320 try 1177 00:36:41,320 --> 00:36:42,320 to 1178 00:36:42,320 --> 00:36:43,320 do 1179 00:36:43,320 --> 00:36:44,320 some 1180 00:36:44,320 --> 00:36:45,320 research 1181 00:36:45,320 --> 00:36:46,320 and 1182 00:36:46,320 --> 00:36:47,320 to 1183 00:36:47,320 --> 00:36:48,320 integrate 1184 00:36:48,320 --> 00:36:49,320 with 1185 00:36:49,320 --> 00:36:50,320 the 1186 00:36:50,320 --> 00:36:51,320 EU 1187 00:36:51,320 --> 00:36:52,320 Act 1188 00:36:52,320 --> 00:36:59,080 work with companies about documenting that, the live data to meet that. 1189 00:36:59,080 --> 00:37:07,320 So you may have a few laws perhaps on health, perhaps on finance, that will be inspired by AI Act, it's probable. 1190 00:37:07,320 --> 00:37:27,320 A few days ago there was this news, it might be true or not, the French police uses a software that allows to do facial recognition. 1191 00:37:27,320 --> 00:37:34,320 We will see if they use it or not. How do you see regulation in government states? 1192 00:37:34,320 --> 00:37:37,320 Because you talked a lot about companies, private companies, 1193 00:37:37,320 --> 00:37:45,320 how do you see this kind of regulation happening within government and how do you control that? 1194 00:37:45,320 --> 00:37:54,320 So it may be different in different countries, including Europe, because there are directives and regulations about law enforcement. 1195 00:37:54,320 --> 00:38:02,320 In France, they need to control the CNIL, and in many cases they need a law. 1196 00:38:02,320 --> 00:38:06,320 The example of the Olympic Games is that they need a law, 1197 00:38:06,320 --> 00:38:07,320 and what has been reported, 1198 00:38:07,320 --> 00:38:12,320 especially in the press, is typically something that is illegal because there is no law allowing them to do that. 1199 00:38:12,320 --> 00:38:18,320 So the main checks and balances will be the parliament and CNIL in some aspects, 1200 00:38:18,320 --> 00:38:24,320 because we have investigation towards what the government is doing. 1201 00:38:24,320 --> 00:38:32,320 Maybe a follow-up question on the first question for Susan on the idea that in the AI Act there is an AI office, 1202 00:38:32,320 --> 00:38:36,320 and there has been negotiation around the role of the AI office, 1203 00:38:36,320 --> 00:38:41,320 and whether a lieutenant is going to settle two weeks ago. 1204 00:38:41,320 --> 00:38:48,320 So there is also the possibility to have enforcement and investigation at the AI level. 1205 00:38:48,320 --> 00:38:53,320 What is your take on this aspect of the law? 1206 00:38:53,320 --> 00:39:04,320 So enforcement is always a tricky question, especially when we're dealing with actually 27 member states, 1207 00:39:04,320 --> 00:39:05,320 and we're actually discussing about this. 1208 00:39:05,320 --> 00:39:14,320 I think one of the key issues is having one law is a very good thing, 1209 00:39:14,320 --> 00:39:21,320 having 27 people making sure that that law is well-applied is another thing. 1210 00:39:21,320 --> 00:39:25,320 And I think national authorities are very much important, 1211 00:39:25,320 --> 00:39:30,320 because you cannot, as a startup, go to DigiConnect and say, 1212 00:39:30,320 --> 00:39:34,320 oh, I'm sorry, I didn't quite understand this piece of article. 1213 00:39:34,320 --> 00:39:36,320 Can you please help me? 1214 00:39:36,320 --> 00:39:41,320 So pretty much what the national authorities are doing already, 1215 00:39:41,320 --> 00:39:50,320 trying to help companies and startups better understand potential applications for their businesses is very crucial, 1216 00:39:50,320 --> 00:39:57,320 and we need more money on this to avoid having enforcement problems then. 1217 00:39:57,320 --> 00:40:03,320 And then we have the enforcement issues when we're dealing with applications of the law 1218 00:40:03,320 --> 00:40:06,320 at the national level, with the EU level, 1219 00:40:06,320 --> 00:40:11,320 and I think we saw a lot of problems with GDPR enforcement, 1220 00:40:11,320 --> 00:40:19,320 with the Irish Data Protection Commission being the bottleneck of Europe's enforcement. 1221 00:40:19,320 --> 00:40:24,320 So I think the new upcoming regulations, including the TSA, the AI Act, 1222 00:40:24,320 --> 00:40:27,320 are trying to overcome these issues. 1223 00:40:27,320 --> 00:40:32,320 And I think a good national, or a few good national authorities, 1224 00:40:33,320 --> 00:40:36,320 is working and helping compliance is very crucial. 1225 00:40:36,320 --> 00:40:42,320 And then having a coordinated enforcement system at the EU level is also very important, 1226 00:40:42,320 --> 00:40:51,320 but also still having some national powers to national authorities is key balance, I would say. 1227 00:40:51,320 --> 00:40:53,320 Do we have time for a last question? 1228 00:40:53,320 --> 00:40:55,320 No? Okay. Never mind. 1229 00:40:55,320 --> 00:40:56,320 Thanks, everyone. 1230 00:40:56,320 --> 00:40:59,320 Please join me in a round of applause for our fantastic panelists. 1231 00:40:59,320 --> 00:41:01,320 Thank you. 1232 00:41:01,320 --> 00:41:02,320 Thank you. 1233 00:41:03,320 --> 00:41:06,320 Thank you all for this great panel. 1234 00:41:06,320 --> 00:41:09,320 We'll be back at 2.50 sharp for the next session. 1235 00:41:09,320 --> 00:41:12,320 Thank you so very much for your time and your insights today.