Heterogeneity of AI-Induced Societal Harms and the Failure of Omnibus AI Laws

AI-induced societal harms mirror existing problems in domains where AI replaces or complements traditional methodologies. However, trustworthy AI discourses postulate the homogeneity of AI systems, aim to derive common causes regarding the harms they generate, and demand uniform human interventions. Such “AI monism” has spurred legislation for omnibus AI laws requiring any “high-risk” AI systems to comply with a full, uniform package of rules on fairness, transparency, accountability, human oversight, accuracy, robustness, and security, as demonstrated by the EU’s draft AI Regulation, the U.S.’s draft Algorithmic Accountability Act of 2022, and Korea’s AI Bill. However, it is irrational to require “high-risk” or “critical” AIs to comply with all the safety, fairness, accountability, and privacy regulations when it is possible to separate AIs entailing safety risks (robots and other intelligent agents), biases (discriminative models), infringements (generative models), and privacy problems (computer vision and other cognitive models). Furthermore, omnibus AI laws, which are blind to trade-offs between the values trustworthy AIs pursue, can ironically impair trustworthiness. For example, a legal obligation to disclose parameters can impair classification accuracy by incentivizing applicants to game mutable features; undermine fairness by having a classifier’s prediction determined by immutable features such as race and gender; and weaken security by facilitating adversarial attacks and model stealing. However, trustworthy AI discourses have largely failed to propose a valid alternative to the omnibus approach, often resting on anecdotes, thought experiments, or becoming political or ideological. Trustworthy AI discourses and AI regulatory frameworks should stop craving generality and be robustly rebuilt from evidence and scientific methods, like the technology they discuss. However, time and effort are required to collect sufficient empirical evidence for rigorous risk assessment. Until then, legislators should gradually adapt existing regulations by categorizing AI systems according to the types of societal harms they induce. Accordingly, this paper proposes the following four initial categorizations, subject to ongoing empirical reassessments. First, regarding intelligent agents (such as self-driving cars and surgical robots), safety regulations must be adapted to address incremental accident risks arising from autonomous behavior through test tracking, safety warning, event data recording, and kill switches. Second, regarding discriminative models (such as credit-scoring or hiring AI), law must focus on the mitigation of allocative harms and the disclosure of marginal effects of immutable features such as race and gender. Third, for generative models (such as language models or AI-powered painting), law should optimize developers’ liability for data mining and content generation, balancing potential social harms arising from infringing content and the negative impact of excessive filtering; identify cases where its non-human identity should be disclosed; and encourage assessment of representational harms such as stereotyping. Lastly, for cognitive models (such as biometric identification and speech recognition), data protection law should be adapted to effectively address privacy, surveillance, and security problems and facilitate governance built on public-private partnerships.