IEEE Technology and Society Magazine - December 2021 - 31

in the initiative. Often, that takes the form of credible
power to deliver value or to impose " soft " sanctions
available without the authority of hard law. This may
include power in the market (such as procurement
preferences) or supply chain structure. For example,
where a small number of middle-tier purchasers
hold oligopsony power and can readily push
requirements to fragmented suppliers upstream, as
is often the case with consumer ecolabels [42], [43].
It may include consumer power manifested through
demand for specific practices (such as the market
for dolphin-safe tuna or fair trade coffee) or firm and
sector-level concern about reputation (e.g., child
labor or conflict minerals) [42]. Increasingly, credible
power to drive adoption comes from regulatory
authorities, from the " raised eyebrow " that contains
a threat of regulation to a direct government role as
policy entrepreneur and convener [44], [45] and
even specific legislative reference to use of soft law
in the form of standards and codes.
Planning for output credibility should also include
the assurance fundamentals necessary to make a
soft law initiative credible. Without state oversight,
what confirms that someone implementing soft law
does so honestly and effectively? Assurance systems
contribute to accountability, transparency, and
enforcement of intended requirements. Existence
of an effective assurance regime can aid both credibility
and adoption of a given soft law regime. The
models for this vary, including accreditation, audit,
and certification or other review [46]-[49].
Adoption (or implementation) of a soft law initiative
is fundamental to whether it gains sufficient
credibility to play a role in the regulatory ecosystem.
But how does that adoption happen? Many developers
believe their role is complete when they publish
their output, seeming to assume that some " invisible
hand " will guide the adoption process. But cases
of spontaneous regulation by soft law seem highly
unlikely. Stamm [50] recently studied how organizations
promote standards, with a specific case study
on ISO 26000, a corporate social responsibility reporting
standard. The author found that the process of
adoption required active steps by proponents across
several roles: consultants, academics, government,
business associations, and national standards bodies.
Building on Rogers' studies of diffusion of innovation,
Stamm [50] identifies " diffusion work " as the actions
that " promote and disseminate an organizational
standard at the field level and support its adoption
December 2021
within organizations. " ISO 26000 does not have a
direct certification regime, so audit, certification, and
other assurance participants were not analyzed in the
study, but others have noted their role as well [48],
[49]. Even initiatives that have strong consumer preference,
such as ecolabels, are often backed by both
brand promotion and active efforts to gain industry
adoption [42], [48]. Soft law initiatives for AI might
also learn from technical standards. For example,
Bluetooth and Wifi have well-funded active " interest
groups " that engage directly across industry and consumers
to promote adoption [51], [52].
Establishing an engagement process to develop
credibility and drive adoption requires strategic
communications and a clear understanding of the
value the initiative is meant to have for different
stakeholders. For example, the value to someone in
the assurance field (does this support consulting or
audit opportunities?) will typically be different than
the value to a person working at a regulatory authority
(does this contribute to regulatory objectives?).
The value to a developer and civil society are likely
to be different still. Proponents seeking to build credibility
need to address the different value types that
stakeholders will expect from an initiative.
Future of AI soft law
We already see stakeholder and governance
communities seeking to play a role in AI. Europe's
General Data Protection Regulation and the recent
amendments to the California Consumer Privacy Act,
for example, anticipate AI with specific provisions to
govern data, algorithms, and inferences [53], [54].
GNI's role in protecting human rights in personal
data held by platforms seems no less important as
AI advances. ISO [55], IEC [56], and IEEE [57], [58]
all have initiatives under way to standardize decision-making
about AI development, often building
on long-standing risk and management models. A
position paper signed by ministers of 14 EU nations
calls for regulatory solutions based on existing law
and soft law tools for AI to balance innovation and
trustworthiness [59]. Indeed, the European Commission
has published a draft Artificial Intelligence Act
as a " proposal for a regulation laying down harmonized
rules on artificial intelligence, " based on the
full complement of hard and soft law tools to regulate
AI [60]. The hard and soft regulation of AI seems
likely to have many of the same characteristics as
those familiar to the tech ecosystem.
31
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
