AI governance and regulation (EU AI Act): Visual walkthrough

6.4.13 · D2 · AI-ML › AI Safety & Alignment › AI governance and regulation (EU AI Act)

Yahan sab kuch parent topic par build karta hai. Hum yahan slower chalenge aur zyada draw karenge.

Step 1 — Uss ek cheez se shuru karo jo matter karti hai: possible harm

KYA. Rules ko ek pal ke liye bhool jao. Koi bhi AI system lo aur ek sawaal poochho: agar yeh cheez galat ho jaaye, toh koi insaan kitna hurt ho sakta hai? Hum isse ek single line par rakhte hain — ek number line of harm, left par "nobody cares" se right par "kisi ki zindagi barbad" tak.

YEH kyon aur koi aur cheez kyon nahin? Hum AI ko kaise kaam karta hai (neural net vs. decision tree), ya kisne banaya, ya kitna costly hai ke hisaab se sort kar sakte the. Lekin law ka kaam logon ko protect karna hai, engineering ko grade karna nahin. Toh sorting axis woh cheez honi chahiye jo log actually feel karte hain: harm. Baad ke har decision isi ek choice se nikalta hai.

PICTURE. Amber arrow dekho. Yeh sirf ek direction mein jaata hai — increasing harm. Ek spam filter left ke paas hota hai (worst case: ek real email junk mein chali jaati hai). Ek tool jo decide karta hai kaun jail jaayega woh far right ke paas hota hai.

Figure — AI governance and regulation (EU AI Act)

Yahan $H$ koi formula nahin hai jo tum compute karo — yeh woh axis hai jis par baki sab kuch tika hua hai. Isse pakad ke rakho.

Step 2 — Rules ki cost hoti hai, toh hum inhe har jagah apply nahin kar sakte

KYA. Ab ek doosri, opposing quantity introduce karo: compliance burden $B$ — paperwork, testing, audits, aur woh paisa jo ek rule builder ko cost karta hai. Har rule ki ek price hoti hai.

KYO? Agar rules free hote toh hum sabse strict rules har cheez par lagaa dete aur kaam khatam. Woh free nahin hain. Ek harmless spam filter par cancer detector jaisi audits thopna useful, safe AI ko bina kisi fayde ke khatam kar deta. Toh ab humare paas ek tension hai:

$logon ko danger H vs. builders ko cost B$

$H$ — koi insaan kitna hurt ho sakta hai (Step 1 se).
$B$ — AI banane wale par rulebook kitni heavy hai.

YEH do hi kyon, zyada nahin? Kyunki achhi regulation exactly in dono ko balance karne ka kaam hai. Jahan $H$ high ho wahan $B$ kam hona → log hurt honge. Jahan $H$ low ho wahan $B$ zyada hona → innovation mar jaayegi. Poora law in dono ke beech sahi match dhundhne ki koshish hai.

PICTURE. Ek hi system par opposite directions mein kheenchte do arrows. Act ki genius yeh hai ki $B$ ko $H$ follow karaaya jaaye.

Step 3 — Core rule: burden ko harm ke saath track karao

KYA. Central principle ko ek line mein state karo. Rule-load ko harm ke saath badhna chahiye:

$B \propto H$

Symbol $\propto$ ko "saath saath badhta hai" padhho. Iska matlab hai: jaise harm $H$ bada hota hai, burden $B$ bhi bada hota jaata hai. Jahan $H$ tiny ho, $B$ tiny hona chahiye. Jahan $H$ huge ho, $B$ huge hona chahiye.

KYO proportional, equal ya flat kyon nahin?

Flat ( $B$ = constant, sab ke liye same rules) — chess bot ko bail-decision engine ki tarah treat karta hai. Bilkul bakwaas.
Equal ( $B = H$ , exact match) — hum dono ko itne precisely measure nahin kar sakte. Hum sirf harm ke rough bands jaante hain.
Proportional in bands — systems ko kuch harm-brackets mein group karo, har bracket ko apna rule-weight do. Yahi risk-based approach hai jo parent note mein mentioned hai.

PICTURE. Ek smooth ramp nahin, ek staircase — kyunki hum brackets mein sort karte hain, exact numbers mein nahin. Harm mein har ek step up, burden mein ek step up hai.

Step 4 — Harm axis ko char brackets mein kaato

KYA. Step 1 ki harm line lo aur uspar teen cut-lines lagao, usse char regions mein tod do. Left (safe) se right (dangerous) padhte hue:

Minimal — harm itna chhota ki law usse ignore kar de.
Limited — harm zyaadatar fool hone ka hai: tum sochte ho tum kisi insaan se baat kar rahe ho, asal mein nahin.
High — harm tumhare rights ya safety ko hit karta hai: tumhari job, tumhari health, tumhari freedom.
Unacceptable — harm itna gehra hai ki woh human dignity par attack karta hai.

KYO char, aur yahi cuts kyon? Cut-lines arbitrary nahin hain — har ek wahan hai jahan harm ki kisam badal jaati hai, sirf amount nahin:

Minimal → Limited: harm deception ban jaata hai (tumhe pata nahin tha yeh AI tha).
Limited → High: harm zindagi ko material damage ban jaata hai (job gayi, galat diagnosis).
High → Unacceptable: harm fundamental rights ke saath incompatible ho jaata hai — koi bhi paperwork isse theek nahin kar sakti.

PICTURE. Wohi amber harm-axis, ab char coloured bands mein kaata gaya, cut-lines kyon har cut exist karta hai usse label karke.

Step 5 — Har bracket ke liye burden padhho

KYA. Step 3 ka rule ( $B \propto H$ ) charon bands par apply karo. Higher band → heavier rulebook:

Band	Harm $H$	Burden $B$
Minimal	tiny	kuch nahin
Limited	deception	sirf transparency ("yeh AI hai")
High	rights/safety	poora compliance kit (docs, testing, human oversight, logs)
Unacceptable	dignity	banned — infinite burden = forbidden

KYO "banned" usi rule mein fit hota hai? Staircase ka top dekho. Jaise $H \to$ dignity-level hota hai, isse safe banane ke liye zaroori burden infinity ki taraf jaata hai — koi bhi paperwork nahin hai jo government social-scoring ko acceptable banaa sake. Jo burden tum kabhi satisfy nahin kar sakte woh prohibition hai. Toh ban ek special case nahin hai jo baad mein add kiya gaya — yeh staircase ka aakhri step hai jo seedha page se oopar nikal jaata hai.

PICTURE. Step 3 ka staircase, ab har step named hai aur top step ek red wall ban gayi hai.

Step 6 — Edge case: exactly ek cut-line par kya hota hai?

KYA. Ek system jo High/Unacceptable boundary par bilkul baith raha ho — jaise facial recognition. Kya yeh banned hai ya sirf heavily regulated?

YEH apna step kyon chahiye. Staircase edge ek degenerate point hai — reader ko isse kabhi unprepared nahin milna chahiye. Act isko ek sub-question poochh kar resolve karta hai: kya harm hamesha present hai, ya sirf ek narrow use mein?

Real-time public mein crowd face-scanning → dignity-level harm, hamesha → banned wall.
Post-event ek recording ka review, judge ki approval ke saath → harm bounded aur overseen hai → ek step neeche High mein aa jaata hai.

Toh same technology alag bands mein land karti hai depend karte hue kaise use ki jaati hai. Classification axis kabhi "tech" nahin thi — woh hamesha $H$ thi (Step 1), aur $H$ deployment par depend karta hai.

PICTURE. Ek camera icon do arrows mein split hota hai — ek red wall se takraata hai (real-time, public), ek High step par girata hai (post-hoc, judge-approved).

Step 7 — Degenerate case: zero-harm aur general-purpose systems

KYA. Do boundary inputs jo naive sorting ko tod dete hain:

$H = 0$ (truly harmless AI, jaise ek game ka enemy pathfinding). Yeh kahaan jaata hai?
Ek model jo kuch bhi karne ke liye use ho sake (ek general-purpose model — aaj ke large language models), toh $H$ fixed nahin hai.

KYO. Step 1 ne assume kiya tha ki har system ki ek definite harm value hoti hai. Yeh do cases isse tod dete hain:

$H = 0$ : Minimal mein aata hai — staircase ka ground floor, burden = 0. Rule phir bhi kaam karta hai; bas "no obligations" output karta hai.
General-purpose: $H$ undefined hai kyunki woh downstream use par depend karta hai. Act ka fix: capability ko ek alag transparency-aur-documentation layer se regulate karo, phir har deployment ko band mein re-sort karne do. Ek model isliye ek saath kai bands mein obligations create kar sakta hai.

PICTURE. Ground floor (H = 0) plus ek general-purpose model jo multiple bands mein land karte arrows ka fan dikhata hai.

Ek-picture summary

Ooper sab kuch ek single blueprint mein compress kiya gaya: harm axis (Step 1), do opposing arrows $H$ aur $B$ (Step 2), proportional rule (Step 3), charon brackets aur unke cut-reasons (Step 4), named burdens aur ban as an infinite wall (Step 5), aur do edge cases fold kiye gaye (Steps 6–7).

Recall Feynman retelling — aise bolo jaise kisi dost ko bata rahe ho

Ek lamba ruler imagine karo. Left end par baithe hain AI toys jo kisi ko seriously hurt nahin kar sakte; right end par baithe hain AI jo kisi ki zindagi barbad kar sakte hain ya kisi right ko kuchhal sakte hain. Woh ruler wahi ek cheez hai jis par hum sort karte hain — agar yeh toot jaaye toh kitna harm hoga.

Ab, rules ki cost hoti hai aur effort lagta hai. Toh hum ek simple deal karte hain: AI jitna zyada harm kar sakti hai, utne zyada rules follow karne padte hain. Kam harm, kam rules. Zyada harm, zyada rules.

Hum ruler ko chaar pieces mein kaatते hain. Tiny-harm wala piece zero rules pata hai. Agla piece woh cheez hai jo tumhe fool kar sake — chatbots, deepfakes — toh ek hi rule hai "tumhe batana zaroori hai ki yeh AI hai." Teesra piece woh hai jo tumhari job, tumhari health, tumhari freedom ko touch karta hai — usse poora kit milti hai: sabit karo ki accurate hai, logs rakho, ek insaan ko usse override karne do. Aakhri piece human dignity par attack karta hai — social scoring, mass face-scanning — aur koi bhi paperwork isse fix nahin kar sakti, toh yeh bas banned hai. Ek ban asal mein "infinite rules" hai: ek bar jo tum kabhi clear nahin kar sakte.

Do tricky parts: ek face-scanner banned ho sakta hai agar woh live crowd dekhta hai, lekin agar woh ek judge ki sign-off ke saath ek purani recording review karta hai toh sirf heavily regulated — kyunki danger is par depend karta hai kaise use karte ho, gadget par nahin. Aur ek do-everything model jaise ek bada chatbot ek slot mein nahin baithta; har tarike se tum usse point karo usse separately sort kiya jaata hai.

Yahi poora law hai: harm ka ek ruler, rules jo uske saath badhte hain, chaar steps, aur top par ek wall.

Recall

EU AI Act systems ko kis single axis par sort karta hai? ::: Harm potential $H$ — kisi insaan ko worst realistic damage agar system fail ho ya misuse ho. Ek relation mein, core principle kya hai? ::: Rule-load (burden $B$ ) harm potential $H$ ke proportional hota hai: $B \propto H$ . "Prohibited" staircase se alag idea kyon nahin hai? ::: Ban burden ka infinity tak jaana hai — ek requirement jo tum kabhi satisfy nahin kar sakte, yaani top step ek wall ban jaati hai. Same face-recognition tech, do bands — kya decide karta hai kaun sa? ::: Kaise use hoti hai: real-time public mass surveillance → banned; post-event, targeted, judge-approved → High-risk but allowed. Truly harmless ( $H = 0$ ) system kahaan land karta hai? ::: Minimal risk — ground floor, zero obligations.

Connections: AI governance and regulation (EU AI Act) (EU AI Act) · 6.4.5-AI-safety-research · 6.4.3-Interpretability-and-explainability · 6.4.4-Robustness-and-adversarial-examples · 6.4.2-Reward-hacking · 6.4.12-Long-term-existential-risks