The development and regulation of multi-purpose, large "foundation models" of AI seems to have reached a critical stage, with major investments and new applications announced every other day. Some experts are calling for a moratorium on the training of AI systems more powerful than GPT-4. Legislators globally compete to set the blueprint for a new regulatory regime. This paper analyses the most advanced legal proposal, the European Union's AI Act currently in the stage of final "trilogue" negotiations between the EU institutions. This legislation will likely have extra-territorial implications, sometimes called "the Brussels effect". It also constitutes a radical departure from conventional information and communications technology policy by regulating AI ex-ante through a risk-based approach that seeks to prevent certain harmful outcomes based on product safety principles. We offer a review and critique, specifically discussing the AI Act's problematic obligations regarding data quality and human oversight. Our proposal is to take liability seriously as the key regulatory mechanism. This signals to industry that if a breach of law occurs, firms are required to know in particular what their inputs were and how to retrain the system to remedy the breach. Moreover, we suggest differentiating between endogenous and exogenous sources of potential harm, which can be mitigated by carefully allocating liability between developers and deployers of AI technology.

Earlier this year, the EU Commission tabled a Proposal of the European Parliament and Council on the Artificial Intelligence Act ("Proposal" or the "Act") a brief summary of which can be accessed through our website. The Proposal was recently scrutinised by the European Data Protection Board ("EDPB") and the European Data Protection Supervisor ("EDPS") in a joint opinion issued on the 18th of June 2021 ("Joint Opinion"). In this Joint Opinion the EDPB and EDPS, whilst acknowledging the Commission's initiative to extend the use of Artificial Intelligence Systems ("AI Systems") throughout the Member States, rejected a few of the tabled proposals. Of particular interest, in the Joint Opinion the EDPB and EDPS delves into the interaction between the EU Data Protection Law and the provisions of the Proposal. The EDPB and EDPS highlight the importance that the two frameworks to be complementary to each other and advised that any inconsistency or conflict should be eradicated as the lack of harmonisation could lead to directly or indirectly put the fundamental right to the protection of personal data at risk.

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)