Big Tech’s Compliance Issues with EU AI Act Highlighted by New Checker

Prominent artificial intelligence models are struggling to meet European regulatory standards regarding cybersecurity resilience and the prevention of discriminatory outputs. This concern arises as the European Union (EU) has been actively discussing new AI regulations, especially following the release of OpenAI's ChatGPT in late 2022. The surge in interest and debate surrounding AI’s potential risks has prompted lawmakers to formulate specific rules for "general-purpose" AIs (GPAI).

Recently, a testing tool developed by Swiss startup LatticeFlow AI, in collaboration with ETH Zurich and Bulgaria's INSAIT, evaluated generative AI models from major tech companies, including Meta, OpenAI, and others, in accordance with the EU's comprehensive AI Act. This framework assigns a score ranging from 0 to 1 based on various categories, including technical robustness and safety. A leaderboard from LatticeFlow revealed that models from companies like Alibaba, Anthropic, OpenAI, Meta, and Mistral achieved average scores of 0.75 or higher.

Despite these generally positive results, the LLM Checker identified significant weaknesses in certain areas, emphasizing where companies may need to allocate resources to ensure compliance with the AI Act. The implications of non-compliance are serious, with potential fines reaching up to 35 million euros (approximately $56.6 million) or 7% of a company’s global annual revenue.

Currently, the EU is still defining how to enforce the AI Act's provisions for generative AI tools like ChatGPT. A group of experts is working to create a code of practice for the technology, which is expected to be ready by spring 2025. The recent test results serve as an early warning for tech companies regarding specific compliance risks.

Discriminatory outputs, which reflect biases related to gender, race, and other factors, have consistently been a challenge in the development of generative AI models. In testing for discriminatory output, OpenAI's "GPT-3.5 Turbo" received a low score of 0.46, while Alibaba Cloud's "Qwen1.5 72B Chat" scored even lower at 0.37.

In assessing vulnerability to "prompt hijacking"—a cyberattack method where hackers disguise malicious prompts to obtain sensitive information—Meta's "Llama 2 13B Chat" scored 0.42, and Mistral's "8x7B Instruct" achieved 0.38. In contrast, the "Claude 3 Opus" model from Anthropic garnered the highest average score at 0.89.

The LLM Checker is designed in accordance with the AI Act and will evolve as new enforcement measures are introduced. LatticeFlow plans to make the LLM Checker available online for developers to assess their models' compliance, offering a practical tool for improvement. Petar Tsankov, LatticeFlow’s CEO, noted that the overall test results are promising and provide a clear pathway for companies to adjust their models to comply with the AI Act. He emphasized the importance of prioritizing compliance in order to meet regulatory expectations effectively.

Although the European Commission has not yet officially verified external evaluation tools, it has been kept apprised of the progress surrounding the LLM Checker. The Commission views this tool as a significant first step in the process of implementing the new AI regulations. A representative from the Commission expressed support for the study and the AI model evaluation platform, recognizing it as a crucial foundational element in the effort to translate the EU AI Act into specific technical requirements. This endorsement highlights the Commission's acknowledgment of the importance of establishing compliance benchmarks that can effectively guide AI developers in meeting regulatory standards. As the AI landscape continues to evolve, the Commission’s proactive engagement with tools like the LLM Checker underscores its commitment to fostering a secure and responsible AI environment in Europe.