IEEE Technology and Society Magazine - December 2021 - 64

Soft Law Governance of Artificial Intelligence
boards that enjoyed the power of states " hard " laws
and regulations behind them.
Scope and risk assessment for AI review
If an AI review board mechanism were to be
established against the odds stacked against it by
the challenges posed by authority, what would be
its remit? What would be its method of review? The
question of scope is being adjudicated in governmental
spaces presently. The drafting process for
the EU AI Regulations or proposed legislation in the
US states is revealing the scope issue to be critical to
achieving hard law success.
Sections of laws and regulations attempting to
define AI posit that AI includes specific disciplines
(e.g., statistics), vague methods (e.g., machine
learning), and malleable architectures (e.g., neural
networks). These are either explicitly paired with
use cases of concern, such as machine learning in
healthcare or with specific technologies, such as
computer vision in automated vehicles. What these
definitions and the many footnotes to them suggest
is that there is no clear scope for AI. What these regulatory
discussions also reveal is that resolution to
the scope problem is likely to come through authoritative
allocation of a definition by an existing state
body. Presuming a state authority could stipulate
what AI is, it could also stipulate what AI should
be reviewed. In the case of the EU's draft Artificial
Intelligence Act, these forms of AI that must undergo
third-party conformity assessment (and must comply
with technical documentation and quality management
system guidelines) are already proposed as the
types of AI needing review.
Even if the European Union (EU) resolves the
scope of AI review question through the force of
state authority, it does not imply that the proposed
mechanism of review-third-party conformity
assessment-is the only one that must take shape.
(Of course, there is nothing to imply that, in its final
version third-party conformity assessment will be any
of the forms of review required by the EU for highrisk
or any other forms of AI.) If conformity assessment
does not win the day and consumer-safety risk
assessments do not become the de facto structure for
risk assessment, then there is space for a research
risk model to take hold.
Elsewhere, I have argued that the most defensible
risk assessment structure would lean on organizational
design cues and risk assessment tiering
64
strategies borrowed from the review boards that govern
recombinant DNA research [62], [63]. The choice
of the Institutional Biosafety Committee (IBC) is significant
here due to the institutional history of the IBC's
formation-started by the scientists themselves-and
due to the uncertain and multidisciplinary nature of
the research. Although the field has become more
concrete overtime, the methods of using recombinant
DNA were not local to only human biology and
the implications of the research were not localized
to one area if an incident occurred. As with AI, rDNA
research emerged as a public and scientific concern
and neither the lay public nor the scientific community
could stand as the single, satisfactory, governor
of the method in research or production settings.
As a consequence, the review board structure that
emerged was one that started with scientists working
at a local level (local university IBCs) then grew
in levels of concern up to officials appointed by the
U.S. president [the (then) RAC under the control of
the head of the National Institutes of Health (NIH)].
As the science evolved and the risk assessments
of rDNA grew more refined, the review structures
changed as did the public's level of concern. There
are lessons to be learned here for creating methods
and risk assessment tools appropriate for AI
review [62].
revIew boards are organs of social engineering
that operate in the context of the projects they govern
and the institutions they protect. This includes
the myriad of national and international bodies that
determine and enforce the norms governing professionals
engaged in projects using machine learning
or other forms of AI. The presence of multiple
types of organizations that could create an AI review
board should not obscure the fact that few organizations
have done so in a publicly accessible or
transparent manner. While an ever growing proliferation
of organizations is issuing principal statements
that advocate for a review process to be established,
there is no clear signal that these bodies are speaking
sincerely about throwing their money or reputation
into AI review boards as a way to turn those
principles into practice.
Within this context, it is difficult to see from
where an AI review board structure could emerge
if it is governed exclusively by soft law mechanisms
[62]. Chiefly, it is unclear who would assume the
initial risks of establishing themselves in this space
IEEE Technology and Society Magazine
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
