More than 100 university professors from all over Europe and beyond are asking the European institutions to include a requirement for a fundamental rights impact assessment (FRIA) in the upcoming EU Artificial Intelligence Regulation (AI Act). The European Parliament’s proposal already goes in this direction but risks coming out weakened at the trialogue, the time the three institutions meet to approve the final text. The requirement for a FRIA, in the Parliament’s proposal, would be limited only to AIs considered high-risk, both in public and private sector. Responding to an appeal launched by Gianclaudio Malgieri (Leiden University), Alessandro Mantelero (Politecnico di Torino) and Vincenzo Tiani (Brussels Privacy Hub), the over 100 signatories, considered to be points of reference on the issues of AI, data protection and fundamental rights, many of them already called upon as experts by national, European and international institutions, call for maintaining the parliament’s version and in particular for ensuring:
1) clear parameters about the assessment of the impact of AI on fundamental rights;
2) transparency about the results of the impact assessment through public meaningful summaries,
3) participation of affected end-users, especially if in a position of vulnerability;
4) involvement of independent public authorities in the impact assessment process and/or auditing mechanisms.
The letter
Urgent appeal to approve a solid Fundamental Rights Impact Assessment in the EU Artificial Intelligence Act
To
the Council of the European Union,
the European Commission,
the European Parliament,
Dear participants in the trialogue for the AI Act,
We, the undersigned group of university professors, senior members of the academic community and in collaboration with concerned citizens, social bodies, and institutions, would like to express our deepest concern regarding the proposed revisions to the EU Artificial Intelligence Act. Specifically, we urge you to adopt and strengthen the provision in the European Parliament version of the AI Act about a mandatory Fundamental Rights Impact Assessment (FRIA) for both public and private institutions deploying artificial intelligence (AI) technologies.
A solid and sound Fundamental Right Impact Assessment should be based on the following four pillars: 1) clear parameters about the assessment of the impact of AI on fundamental rights; 2) transparency about the results of the impact assessment through public meaningful summaries, 3) participation of affected end-users, especially if in a position of vulnerability; 4) involvement of independent public authorities in the impact assessment process and/or auditing mechanisms.
In addition, we believe that the FRIA should be coordinated with the other existing impact assessment mechanisms already present in the draft of the AI Act and other existing pieces of EU legislation. The National independent supervisory authorities might implement the FRIA principles through consistent and accessible frameworks, enhancing the predictability of the process adequacy and enforcement. This would even reduce the burden for AI deployers.
As experts in various disciplines, we have witnessed the profound risks that AI systems can bring to fundamental rights and the need for comprehensive and meaningful ex-ante actions to mitigate those impacts. Including a robust FRIA mechanism within the EU Artificial Intelligence Act is a critical safeguard against potential adverse impacts on the fundamental rights of end-users, especially those in vulnerable positions. This comprehensive assessment allows for a systematic evaluation of AI systems’ impact on fundamental rights, ensuring accountability, transparency, and the ethical use of AI technologies.
We believe that the FRIA should cover not only public institutions but also private entities utilising AI. By doing so, we ensure that all organisations, regardless of their nature, are held accountable for the potential risks and impact their AI systems may have on individuals and society as a whole, especially considering the huge impact that private AI developers and users can have on fundamental rights of individuals. This approach establishes a level playing field, prevents undue concentration of power, and fosters responsible AI deployment across all sectors.
Furthermore, we urge the EU institutions to ensure that the FRIA process is transparent, participatory, and multidisciplinary. Engaging diverse stakeholders, including civil society organisations, experts, academia, and marginalised communities, will enrich the assessment process and enhance the legitimacy of the AI regulatory framework.
Finally, in addressing the complexity of risks relating to fundamental rights, risk assessment should be an integrated tool with a proportionate distribution of burdens based on the actual risk introduced into society and the power of individual actors to manage such risk, as generally accepted in the legal theory of risk. AI providers should therefore perform the general assessment of an AI product/service considering all of its potential uses, but entities using that product/service in a given context and for specific purposes should integrate this initial assessment with the analysis of the contextual impact on fundamental rights.
In this regard, this obligation to carry out a FRIA would be in line with and complement other more limited and specific impact assessment duties that EU private and public entities already have under other regulations (e.g., the GDPR and the DSA) by adopting a focus on the variety of potential impacts on fundamental rights that high-risk AI systems may have. In this view, the European Parliament version of the Fundamental Rights Impact Assessment in the AI Act has a solid consistency provision if an entity needs to perform both a DPIA and a FRIA.
In conclusion, we believe that including a comprehensive and robust Fundamental Rights Impact Assessment within the AI Act regulation and its harmonisation within the broader risk-based approach proposed is pivotal in upholding the European Union’s commitment to human rights and its values. In the next few days, we will circulate a more detailed report explaining our view on the best practices to regulate fundamental rights impact assessments.
Thank you for your attention to this critical matter.
Brussels, 12 September 2023
The signatories:
Gianclaudio Malgieri, Associate Professor of Law at Leiden University and Co-director of the Brussels Privacy Hub, The Netherlands
Alessandro Mantelero, Associate Professor of Law at Politecnico di Torino, Italy
Mireille Hildebrandt, Full Professor of Law at Vrije Universiteit Brussel, Belgium
Christopher Kuner, Affiliate Professor of Law at the University of Copenhagen, Denmark
Paul De Hert, Full Professor at Vrije Universiteit Brussel, Belgium, and Tilburg University, The Netherlands
Bart Schermer, Full Professor of Law at Leiden University, The Netherlands
Oreste Pollicino, Full Professor of Law at Bocconi University, Italy
Eduard Fosch-Villaronga, Associate Professor at Leiden University,T he Netherlands
Eleni Kosta, Full Professor of Law at Tilburg University, The Netherlands
Giorgio Resta, Full Professor of Law at Roma Tre University, Italy
Bart Custers, Full Professor of Law and Data Science, Leiden University, The Netherlands
Alain Strowel, Full Professor of IP and IT Law, UCLouvain and U Saint-Louis, Belgium
Vanessa Mak, Full Professor of Civil Law at Leiden University, The Netherlands
Margot E. Kaminski, Full Professor of Law, University of Colorado Law School, Boulder, CO, USA and Director, Privacy Initiative at the Silicon Flatirons Center
Vincenzo Tiani, Brussels Privacy Hub, Vrije Universiteit Brussel, Belgium
Frederik Zuiderveen Borgesius, Full Professor of ICT and Law at iHub, Radboud University, Nijmegen, The Netherlands
Simone van der Hof, Full Professor of Law and Digital Technologies, Leiden University, The Netherlands
Lee A. Bygrave, Full Professor of Law, Director of the Norwegian Research Center for Computers and Law, University of Oslo, Norway; Honorary Professor, College of Law, Australian National University
Andrew Selbst, Assistant Professor of Law at the University of California Los Angeles, USA
Dag Wiese Schartum, Full Professor of Law, Norwegian Research Center for Computers and Law, University of Oslo, Norway
Tobias Mahler, Full Professor of Law, Norwegian Research Center for Computers and Law, University of Oslo, Norway
Sebastian Felix Schwemer, Associate Professor, Centre for Information and Innovation Law (CIIR), University of Copenhagen, Denmark
Björn Fasterling, Professor of Law, EDHEC Business School, Augmented Law Institute, France
Christophe Roquilly, Full Professor of Law, Director of the EDHEC Augmented Law Institute, Honorary Dean of Faculty, EDHEC Business School, France
Alina Wernick, Principal Investigator, Faculty of Law, affiliated researcher, The Legal Tech Lab, the University of Helsinki, Finland
Giovanni De Gregorio, PLMJ Chair in Law and Technology, Universidade Catolica Portuguesa, Lisbon, Portugal
Julián Valero Torrijos, Full Professor of Administrative Law, Director of the Chair in Digital Identity & Rights, University of Murcia, Spain
Miquel Peguera, Full Professor of Law, at Universitat Oberta de Catalunya, Spain
Massimo Durante, Full Professor of Philosophy of Law and Legal Informatics, Department of Law, University of Turin, Italy
Mauro Grondona, Full Professor of Private Law, University of Genoa, Italy
Nora Ni Loideain, Director of Information Law & Policy Centre, Assistant Professor in Law, Institute of Advanced Legal Studies, University of London, UK
Lilian Mitrou, Full Professor – University of the Aegean-Greece – President of I Institute for Privacy Law, Data Protection and Technology (IPL -European Public Law Organisation), Greece
Bethany Shiner, Senior Lecturer in Law, Middlesex University London, UK
Sophie Stalla-Bourdillon, Professor in Law, Co-director of the Brussels Privacy Hub, VUB, Belgium
Martin Husovec, Associate Professor of Law, London School of Economics and Political Science (LSE), UK
Giovanni Sartor, Full Professor in legal theory and legal informatics, Department of Law, University of Bologna, European University Institute of Florence, Italy
Giusella Finocchiaro, Full Professor of Private Law and Internet Law, University of Bologna, Italy
Marcello Ienca, Professor of Ethics of Artificial Intelligence and Neuroscience; Deputy Director of the Institute for Ethics and History
of Medicine; Technical University of Munich, Germany. Senior Scientist at College of Humanities, Swiss Federal Institute of Technology in Lausanne, EPFL, Switzerland
Maria Helen Murphy, Associate Professor, Maynooth University School of Law and Criminology
Patrick O’Callaghan, Senior Lecturer in Law (Associate Professor), University College Cork, Ireland
Perry Keller, Reader (associate professor) in Media and Information law, King’s College London; UK
Thorsten Strufe, Full professor of Privacy and IT security, Karlsruhe Institute of Technology and CeTI/TU Dresden, Germany
Stefanos Gritzalis, Full Professor of Information and Communication Systems Security, Director MSc Programme in Law and ICT, Department of Digital Systems, University of Piraeus, Greece
Luca Longo, Assistant Professor, Technological University Dublin, Dublin, Ireland
Charles Raab, Professor Emeritus, University of Edinburgh, UK
Claude Castelluccia, Research Director, Inria, France
Martin Scheinin, British Academy Global Professor, Bonavero Institute of Human Rights, University of Oxford, UK
Franziska Boehm, Full Professor of Law, Karlsruhe Institute of Technology, Germany
Darius Whelan, Senior Lecturer, School of Law, University College Cork, Ireland
Sarah Spiekermann, Full Professor at Vienna University of Economics & Business, Austria
Marc Langheinrich, Full Professor for Computer Science, Università della Svizzera italiana, Switzerland
Edoardo Celeste, Assistant Professor in Law, Technology and Innovation and Chair of the Erasmus Mundus Master in Law, Data and AI, Dublin City University, Ireland
Sokratis Katsikas, Professor of Information and Cyber Security, Department of Information Security and Communication Technology, Norwegian University of Science and Technology, Norway & Director, Norwegian Centre for Cybersecurity of Critical Sectors, Norway & Professor Emeritus, University of Piraeus, Greece
Bart Preneel, Full Professor in Cybersecurity and Privacy, Department Electrical Engineering-ESAT, KU Leuven, Belgium
Henning Lahmnann, Assistant Professor of Law, eLaw Center for Law and Digital Technologies, Leiden, The Netherlands
Spyros Kokolakis, Professor, Department of Information & Communication Systems Engineering, University of the Aegean, Greece
Costas Lambrinoudakis, Professor, Department of Digital Systems, University of Piraeus, Greece
Maria Belén Andreu Martínez, Full Professor of Civil Law, University of Murcia, Spain
Franco Pizzetti, Professor Emeritus of Constitutional Law University of Turin, Italy
Miguel Poiares Maduro, VdA Chair in Digital Governance, Universidade Católica Portuguesa, Portugal
Philippe Jougleux, Associate Professor, School of Law, European University Cyprus, Cyprus
Ugo Pagallo, Full Professor of Law, University of Turin, Italy
Carissa Véliz, Associate Professor at the Institute for Ethics in AI, University of Oxford, UK
Lorenzo Cotino, Professor of Constitutional Law, University of Valencia, Spain
Orla Lynskey, Associate Professor LSE Law School and Visiting Professor College of Europe (Bruges), UK
Pere Simón Castellano, Full Professor of Constitutional Law, Universidad Internacional de la Rioja (UNIR – La Universidad en Internet), Spain
Jorge Castellanos Claramunt, Professor of Constitutional Law, University of Valencia, Spain
Adrián Palma Ortigosa, Assistant Professor of Administrative Law, University of Valencia, Spain
Professor Chris Marsden, Professor of Artificial Intelligence, Technology and the Law, Monash University, Australia
Maria Bottis, Professor of Information Law, Ionian University, Greece
Silvia De Conca, Assistant Professor of Law, Vrije Universiteit Amsterdam, The Netherlands
Jonathan Cave, Associate Professor of Economics, University of Warwick and Fellow, Alan Turing Institute, UK
Els J. Kindt, Founder of Biometric Law Lab, CiTiP, KU Leuven, Belgium, Associate professor, Universiteit Leiden, The Netherlands
Eoin O’Dell, Fellow and Associate Professor of Law, Trinity College Dublin, Ireland
Alberto De Franceschi, Full Professor of Private Law, Ferrara University, Italy
Camilla Crea, Associate Professor of Private Law, Sannio University, Italy
Róisín Á Costello, Assistant Professor of Law, Trinity College Dublin, Ireland
Ronald Leenes, Full Professor of Regulation by Technology, Tilburg Institute for Law, Technology, and Society, Tilburg University, the Netherlands
Linnet Taylor, Full Professor of International Data Governance, Tilburg Institute for Law, Technology, and Society, Tilburg University, the Netherlands
Mirko Tobias Schäfer, Associate Professor, Department of Information & Computing Sciences, Science Lead at Data School, Utrecht University, the Netherlands
Phoebe Li, Reader (Senior Associate Professor) in Law and Technology, School of Law, Politics, and Sociology, University of Sussex, UK
Vasiliki Diamantopoulou, Assistant Professor, University of the Aegean, Substitute Member of the Board, Hellenic Authority for Communication Security and Privacy, Greece
Nadya Purtova, Full Professor of Law, Innovation, and Technology, Utrecht University, the Netherlands
Albert Meijer, Full professor of Public Innovation, School of Governance, Utrecht University, Netherlands
Cristiana Santos, Assistant Professor of Law and Technology, School of Law, Utrecht University, The Netherlands
Albert Ali Salah, Full Professor of Social and Affective Computing, Utrecht University, The Netherlands
Jiahong Chen, Lecturer (Assistant Professor) in Law, University of Sheffield, UK
Aline Franzke, International Centre for Ethics in Science and Humanities (IZEW) University of Tübingen, Germany
Carlos Castillo, ICREA Research Professor at Universitat Pompeu Fabra, Barcelona, Spain
Salvatore Ruggieri, Full Professor of Computer Science, University of Pisa, Italy
Karin van Es, Associate Professor Media and Culture Studies, Humanities Lead at Data School, Utrecht University, the Netherlands
Domenico Rosani, Assistant Professor of Law, University of Utrecht, The Netherlands
George Christou, Professor of European Politics and Security, University of Warwick, UK
Anu Masso, Associate professor in big data in social sciences, Ragnar Nurkse Department of Innovation and Governance, Tallinn University of Technology, Estonia
Raphaële Xenidis, Assistant Professor in European Law, Sciences Po, France
Hannah Ruschemeier, Juniorprofessor (tenure W3) for Public Law, Data Protection Law & Law of Digitalisation, University of Hagen, Germany
Stephan Grimmelikhuijsen, Associate Professor in Public Management, Utrecht University School of Governance, Utrecht University, The Netherlands
Shoshana Zuboff, Charles Edward Wilson Professor Emeritus, Harvard Business School, author The Age of Surveillance Capitalism, US
Francien Dechesne, Associate Professor of Ethics and Digital Technologies, eLaw Center for Law and Digital Technologies, Leiden University, The Netherlands
Marc Rotenberg, Adjunct Professor Georgetown University, Executive Director, Center for AI and Digital Policy, United States
Merve Hickock, Lecturer in Information Law, Miching University, US
Janneke Gerards, Full Professor of Fundamental Rights Law, Utrecht University, The Netherlands
Giovanni Comandè, Full Professor of Comparative Law, Scuola Superiore Sant’Anna, Pisa, Italy
José Luis Piñar Mañas, Full Professor of Administrative Law, CEU San Pablo University, Madrid
Edoardo Raffiotta, Associate Professor of Constitutional Law, University of Milan Bicocca, Milan, Italy
Henrique Sousa Antunes, Associate Professor of Private Law, Universidade Católica Portuguesa, Lisbon, Portugal
Maria Karyda, Professor, Information Systems Security Management, University of the Aegean, Greece
Mark D. Cole, Professor of Media and Telecommunication Law, University of Luxembourg, Luxembourg
Prof. Dr. Indra Spiecker genannt Döhmann, LL.M., Chair in Constitutional and Administrative Law, Information Law, Environmental Law and Legal Theory, Director Data Protection Research Institute, Goethe University Frankfurt/Main, Germany
Konrad Lachmayer, Professor of Public law, European Law and Foundations of Law, Sigmund Freud University, Vienna, Austria
Judith Simon, Full Professor for Ethics in and Information Technologies, University of Hamburg, Germany
Petra Bárd, Professor of Sustainable Rule of Law, Radboud University, The Netherlands
…
