A clear option for regulating AI is to develop legislation for this purpose, either through bespoke AI-specific legislation or the amendment of existing legislation. Compliance with the obligations set out by a legislative framework would be mandatory and could set out penalties and available remedies for non-compliance with the framework. This provides organisations seeking to develop or implement AI systems certainty as to their obligations and consequences of non-compliance, which in turn supports public trust and confidence in AI through an unambiguous regulatory framework.

It is notable however that a legislated framework is not as flexible and responsive as some of the other measures canvassed in the Discussion Paper. This could lead to increased regulatory burden and may stifle innovation or prevent Australia from accessing advances in AI technologies developed internationally.

Self-regulatory schemes are developed and implemented by industry through codes of conduct or other voluntary schemes (such as standardised self-testing tools similar to AI Verify which is being implemented in Singapore). These self-regulatory schemes are often faster to develop and implement than a legislative response, and can be changed easily, providing greater flexibility.

Industry self-regulation can be combined with legislation in a 'co-regulatory' fashion, allowing the code to be developed by industry as part of a legislative framework, which enables the code to have legislated remedies and penalties, rather than being complied with on a solely voluntary basis.

Regulatory principles can be created by Government to guide regulators as to when and how AI should be regulated when it is used in the context of the regulator's specific sector / industry. This promotes greater regulatory coherence between regulators when addressing the use of AI within existing regulatory frameworks.

Regulatory principles are often outcomes based and can be applied with a great deal of flexibility to a wide range of contexts. This can make regulatory principles more challenging for organisations from a compliance perspective (depending on an organisation's resources and capacity to interpret and comply with the principles) but more supportive of innovation than other less flexible alternatives.

Greater collaboration between regulators would help ensure that when AI is being regulated across multiple sectors / industries that regulators are minimising the compliance burden created by having multiple regulators responsible for the regulation of AI in different contexts. This is likely to be necessary for any regulation of AI to be effective, considering the broad range of applications for AI systems (and could be facilitated through, among other things, the use of regulatory principles). A number of regulators in Australia are already collaborating to develop guidance and share information in relation to the use of AI in particular contexts.

This would involve the introduction of AI-specific bodies to support the implementation of governance requirements and provide advice to both AI providers and consumers. An example of this is the National AI Centre's Responsible AI Network, which is being run by the CSIRO to focus on responsible AI solutions in Australian industry.

Enabling regulatory levers designed to enable and facilitate, rather than hinder, innovation. This would involve clear frameworks and guidance to experimentation with AI technologies. This can be achieved for example through the creation of 'regulatory sandboxes' which are controlled environments within particular industries, for experimentation and innovation.

Technical standards designed through consensus by technical experts within industry-led organisations, with a view to developing universal standards, which are adopted to improve the interoperability of systems. This can improve consumer outcomes and facilitate international trade. These standards can be either voluntary, or made mandatory through legislation.

Theses are measures which are implemented to test and verify AI systems, to ensure that they meet standards or quality requirements. For example, these measures could relate to assessing the quality of data on which an AI system is developed, or requiring that AI systems achieve a certain level of transparency, to ensure that consumers and other stakeholders understand the algorithms and decision making underpinning the system. These measures largely go to transparency in AI solutions and would be useful in building public trust and confidence in AI.

These assurance processes can be voluntary, or mandated by legislation, developed by industry or Government (or in collaboration between the two) and can be administered internally by organisations, or administered by third parties (either private, or public sector).

The purpose of publishing and making available policies, principles or statements is to increase awareness of the Government's policy position, and expectations, in relation to the use of AI. The intent of this is to increase transparency and public trust and confidence in how the Government uses AI solutions and can also seek to influence the private sector by modelling best practice in Government.

These measures are designed to increase transparency through the use of initiatives such as the preparation and publication of AI impact assessments, and notifying individuals when AI applications are in use.

This is the process of banning certain AI applications, either generally or in specific contexts. For example, a number of jurisdictions are moving to ban the use of ChatGPT in education settings. The EU is also proposing to ban the use of 'social scoring' and 'real-time biometric identification' in specific circumstances.

This refers to 'non-regulatory' options (i.e. not legislation, codes or guidance designed to influence the behaviour of corporations) that encourage certain behaviours by increasing availability of information and awareness.

These are measures which are intended to be implemented in the design of AI systems, to ensure that from the outset AI systems are of a high quality, transparent and safe. This approach to design can be either voluntary, or required by legislation.

A risk management approach could be used to guide the implementation of any number of the measures outlined above (either in isolation, or multiple measures in conjunction). As we have discussed, a risk-based approach to AI is being implemented in a number of international jurisdictions and it seems likely at this stage that Australia will follow this trend. The Discussion Paper includes a draft risk management approach for AI, which the Government is seeking feedback and comment on.

The draft risk management approach involves a three-tier classification system, utilising the following three categories:

1. Low risk: minor impacts that are limited, reversible or brief. For example, algorithm-based spam filters, general chatbots and AI-enabled business processes.
2. Medium risk: high impacts that are ongoing and difficult to reverse. For example, AI-enabled loan worthiness evaluations, emergency service chatbots, AI-enabled applications in hiring and evaluating employees.
3. High risk: very high impacts that are systemic, irreversible or perpetual. For example, AI-enabled robots for medical procedures and use of AI in safety-related car components or in self-driving cars for the purpose of making real-time decisions.

Under the draft risk management approach, an organisation will consider the risk level of the proposed AI application, and determine the requirements which will apply to that AI application, dependent on the risk level identified.

Requirements placed on AI systems under an eventual framework could be a combination of any of the measures discussed above, however examples of the measures identified in the draft framework are:

• the conducting of AI impact assessments;
• providing notices to users that an AI solution is being implemented and used;
• the use of 'human in the loop' models, which require the AI solution to interact with a human who can intervene if required;
• publicly available explanations of how the AI solution works;
• specific requirements regarding user training; and
• internal and external monitoring and documentation of how the AI solution is working.