Video games are often cited as a case in which the use of artificial intelligence would present a ‘minimal’ risk to individuals. As such, video games would escape the obligations arising from the Act on artificial intelligence. The situation is, however, more complex than it appears.
The entry into force of the Artificial Intelligence Ac
- The Artificial Intelligence Act came into force in August 2024 (the ‘AIA’)
- The AIA aims to ensure that AI systems used by European companies or intended for EU residents are safe, transparent and respectful of fundamental rights.
A risk-based approach
- The AIA adopts a risk-based approach. At the bottom of the pyramid are AI systems entailing minimal risk, above which are systems with limited, then high risk, and at the top of the pyramid are those presenting an unacceptable risk to users' rights and freedoms.
- The higher the level of risk, the stricter the obligations applicable to it. Thus, practices presenting minimal risk are exempt from the new regulations, those with limited risk are subject to transparency obligations (art. 52), those with high risk are subject to a detailed compliance regime (arts. 6 to 51) and those presenting an unacceptable risk are prohibited (art. 5)..
- AI systems used in video games are often presented as presenting minimal risk, but this is an oversimplification. For instance, chatbots taking the form of non-player characters (‘NPCs’) could be considered as a limited-risk AI system, or even a high-risk system depending on its role and the content of its dialogues. Studios would then have to disclose the fact that these NPCs were generated by AI and implement actions to prevent their generation of illegal content. In addition, a game feature that could manipulate player behaviour in a harmful way, for example by encouraging overspending or by exploiting addictive behaviour, would most likely be considered an unacceptable AI system - all the more so if it could target underage players.
An approach that complements that of the GDPR
- Many of the obligations arising from the AIA echo those of the GDPR. This is the case, for instance, with transparency and information obligations, the obligation to define the end objective (the purpose) and the legal basis of the data processing linked to the AI system, the importance of carrying out an impact assessment where necessary, etc.
- In addition, the French National Data Protection Commission (CNIL) will ensure that the AIA is properly applied in France and will be involved in coordinating the regulatory bodies at European level.
Our support towards AIA compliance
- Analysing the level of risk and identifying the applicable regulatory regime
- Defining obligations: setting up an AI governance system, drafting documentation and implementing processes to ensure traceability of the phases in the lifecycle of AI systems, training and raising awareness among employees, etc.
- Drawing up an action plan
- Assessing the impact on data protection
