Industry committee  I heard the debates, yes.

Industry committee  Sure. Actually, the reason I included my personal note was that I heard your line of questioning. It is concerning. It is not something that I typically speak to, but it was quite surprising, having the experience of working in this space for almost a decade—which is scary—to really think about the evolution of different types of technologies and therefore the societal impacts they have.

Industry committee  I think it would be not only nice to see. One challenge, though, with all of these systems is that they're trained on data. I know you've talked about this lots in this committee, so I won't regurgitate it too much, but what's important to note is that often the supply chain is not transparent.

Industry committee  You're welcome.

Industry committee  Different types of mitigation, as you're mentioning, depend on the use of the system. Both the technology and the context within which it's being used will change. The harms will change, from an individual to a group to the organization itself. Therefore, first of all, it's understanding what the harms are.

Industry committee  I'm a huge fan of the fact that this bill has.... I know that some people have said it's a bolt-on, as was announced today, but I think it's an important bolt-on. If AIDA does not continue, there are privacy implications and consumer protection implications in relation to the use of AI.

Industry committee  When consumers are looking to make a challenge, again, not only do they need the notification in order to understand that an AI system is even being used, but they should also have appropriate recourse for that. Again, these are different types of mitigation measures that will be context-specific and that should be included based on what the type of system is—again, following subsequent rules that should be made.

Industry committee  I believe this type of notification is required. One thing that we did with the directive on automated decision systems was recognize that there are multiple different types of contexts in which these systems are being used and that those have different types of categories of harms.

Industry committee  The key issue that we were trying to address is not to over-regulate or create more oversight than is required. We want there to be this balance of innovation in using these systems and also protection of the people who are using them. By breaking it down and recognizing that different types of issues and harms occur with the different types of systems, we wanted to address the effort that is required to ensure that appropriate mitigation measures are put in place.

Industry committee  I would love to see that. I think we see that in the amendments, with the different types of classes. We have the seven classes of potential impacts. I think there's recognition in that. There are different levels of harm that can exist within that. I would definitely recommend adding something almost like a matrix—to say that you have these different types of impacts that could occur in hiring or health, and these are the different types of harms that could exist, so therefore these are the mitigations needed.

Industry committee  I would note that I did that in my former capacity as the executive director of the Responsible AI Institute. I still continue to serve on the board of the Responsible AI Institute, so I'll share this in that capacity, given the policy neutrality of my current position. That said, yes, I definitely do believe that.

Industry committee  Thank you for inviting me here to participate in this important study, specifically to discuss AIDA, a component of the digital charter implementation act. I am here today in my capacity as the managing director of IAPP's AI governance centre. IAPP is a global, non-profit, policy-neutral organization dedicated to the professionalization of the privacy and AI governance workforces.