The rise of Artificial Intelligence has put data and data quality at the core of digitalisation. At the same time there seems to be a need to better understand what is meant by data quality and how to ensure it is at hand. Our first attempt to start the discussion was made at the Data Space Symposium in Darmstadt in March 2024. In terms of contribution this report is an increment to the slideshow by giving further examples of how data quality is defined and put into use at the same time as highlighting the contextual properties of data quality and the need for human judgement. We do this from a policy perspective, i.e. grounding our analysis in regulations and standards. Our analysis starts with the legal reasonings on data quality found in the AI Act and the European Health Data Space regulation. Our ambition is not to be exhaustive, there are more EU regulations and directives to consider in relation to data quality than the ones we cover here – such as the directive on Copyright in the Digital Single Market that introduces the concept of text and data mining; the Data and Data Governance Acts that enable standardised formats for making data interoperable across services; and the Digital Service and Market Acts that define responsibilities in terms of making data and information available. Among others. The same goes for standards on data quality which span across specific domains and disciplines. Coming back to our ambition, we believe it is important to raise the question to what extent data quality can be automatically assessed, as this is an ambition floated at various events and foras within the data community. While we think this can be achieved for specific and narrow contexts, we argue that data quality is a topic that still requires judgement and the competence to make assessments on a case-by-case basis.

Our ambition is to give an overview of the mandatory involvement of notified bodies according to the AI Act and the Machinery Regulation. Specifically, we are interested in the cases when both acts are applicable for the same product.

That said, our analysis is not to be taken as legal advice but as policy research and we recommend the reader to cross-examine our conclusions by assessing the acts in relation to the products at hand. It is also worth remembering that the focus of the analysis is when a notified body is mandatory for CE-marking a product – we do not describe what is needed to meet requirements on technology and organisation, and it is always possible to opt to include a notified body in the conformity assessment even if it is not mandatory.

Another limitation is that we do not explore the full interaction between the AI Act and the Machinery Regulation, or how they interact with other policies relevant for CE-marking products intended for EU’s internal market.

Our main conclusions of the analysis are that:

• We should not focus on how the definition of Artificial Intelligence in the AI Act relates to the concept of ”fully or partially self-evolving behaviour using machine learning approaches” as introduced by the Machinery Regulation; but instead

• We should focus on when the Machinery Regulation mandates the involvement of a notified body and how that relates to the AI Act.

We also foresee an up-coming bottleneck in the availability of notified bodies capable of performing the duties in relation to both the AI Act and the Machinery Regulation, something that can have an effect on access to the internal market.

In 2018 the Swedish Government released its strategy on AI, the national approach for artificial intelligence. The strategy focuses on three main areas – education, research and innovation – with the ambition that Sweden would be the best country in the world regarding applying AI. Two key areas were mentioned – the competitiveness of Swedish enterprises on a global market and the strengthening of the public sector.

Since then, the domestic discourse has changed, as Social-democratic lead governments have been replaced by a Conservative-Liberal government, the launch of ChatGPT, as well as the introduction of EUs Digital Decade with new targets for digitalisation and a proposed regulation of AI. We have therefore conducted a first evaluation of the strategy and the state of AI in Sweden. Based on official reports and interviews we recommend that the Swedish strategy on AI should …

… acknowledge the EU and accommodate for the upcoming regulations and resources within the Digital Decade,

… embrace the pluralism of Swedish governance and facilitate collaboration among authorities and different levels of administration,

... ensure the competence and the mandate of the public sector accordingly,

... be adaptable to changes in both the domestic and international discourse,

… investigate long-term funding solutions of strategic AI initiatives, and finally,

… define sustainable and ethical AI in order to facilitate responsible usage and development of AI as well as facilitate procurement.

This will require prioritisation of targets and initiatives as well as a way of assessing progress which is suitable for the Swedish context.

Elsparkcyklar har potential att kunna bidra till positiva effekter i samhället. Men med friflytande elsparkcyklar följer också nya utmaningar. En del av dessa är relaterade till regelverk och policy.

The eSPARK project examines the sustainability profile of the popular shared e-scooters through policy analysis, usage data analysis, surveys, and life cycle assessment. Policies and attempts to regulate e-scooters in Swedish and European cities are studied and discussed with stakeholders. The LCA-results suggest that factors such as how e-scooters are collected and distributed, and the total ridden kilometers have significant impact on their environmental impact. The project also suggests different methods that can support cities to predict the geographical area of the e-scooters and offers insights about how e-scooters are used in the cities. Usage data and the surveys show that they are used by active people in areas with a lot of activities, especially restaurants and clubs. Users are likely to have a driving license, to frequently use a car but also to have a monthly pass for public transport. Thus, escooters have a potential to mitigate congestion on roads and public transport but may lead to more traffic on bike infrastructure instead.

The ambition of the European Union is to lead the way in digitalization. A cornerstone in fulfilling the ambition is the proposed AI Act. Our ambition with this contribution is to create awareness of how regulating Artificial Intelligence (AI) will affect mobility within the EU. The chosen definition of AI is broad enough to cover most software and the regulated topics will affect areas such as road traffic and public transport, safety components in machines but not vehicles. Such systems deemed to pose a high risk will need to be certified and CE-marked. It will also have an impact on the relationship between provider and user of AI systems, with a clear ambition to open the black box of business to enable compliancy with GDPR and handling of anomalies. At the same time, the AI Act opens up for using personal data for other purposes than originally stated during collection.

Motivation: In a broad sense data sharing onboard public transport vehicles is governed by two different business models – interoperable and free of charge access for some data versus data that is restricted to specific uses by commercial contracts and existing legislation. Under the Digital Decade the EU has proposed new legislation with the ambition to promote a single digital market. The question then arises – how will the upcoming regulations affect existing business models for data utilisation?

Method: We have investigated two different cases where existing technology meets upcoming EU legislation. The questions have been framed through dialogue with actors in the industry, to cover topics and questions that are both concrete and current. Using the policy lab methodology, we have investigated the possibility to re-use surveillance film from public transport vehicles for passenger counting. The analysis compares GDPR and the Swedish camera surveillance act with the proposed AI Act, to see what new possibilities or obstacles arise. We have also explored the changes that the Data Act may impose on different actors’ access to data derived from the batteries installed in an electric bus.

Results: The AI Act will not change the business models within the eco-system but facilitate access to more personal data (including personal data where GDPR otherwise would be a barrier), useful for training automated passenger counting. Those responsible for placing the system on the market will still need to ensure that they are compliant with GDPR in terms of processing personal data. In terms of the Data Act the outcome is more disruptive as the owner and user of a vehicle is entitled to all data representing their usage, free of charge, and this will impair existing business models for data access. It is also possible for multiple actors to be users, for instance if the vehicle is owned by a public transport authority and leased by an operator.

Discussion: Our analysis shows that while the impact of the Data Act can resonate with the ambitions behind the regulation in terms of making more data interoperable and available free of charge, it can also have the opposite effect. The latter is specifically the case where altruistic data sharing already is in place and the Data Act imposes standard contracts for and role-based restrictions towards utilisation. Both the AI Act and the Data Act are complex and often difficult to assess. In relation to the Data Act, the recitals were helpful for interpreting the application of articles and definitions. For understanding the relationship between the AI Act and GDPR we combined the legal analysis with prototyping the impacts and relied on sharing insights with other actors. This highlights the need for multiple ways of performing the data collection and analysis as well as the suitability of policy labs as a research method

In this report, we have compiled our learnings and experiences of working with Policy Lab. Policy Labs have come about as an answer to the question "Can you work with policy and regulatory development in a better way than today?". Our answer to the question is a yes. Our hope with the report is that others will become interested and start their own Policy Lab. Abroad, there are many Policy Labs, but in Sweden there are only a few, which is why we believe there is room for more. There is not a given way to work with Policy Labs once and for all, but each Policy Lab is unique based on its context. Sweden's innovation agency Vinnova defines Policy Labs as follows: "Policy Labs can be explained as a group of actors with different competencies who want to develop a regulatory framework. In the Policy Lab, they use a set of user-centric methods and competencies to test, experiment, and learn in policy development."1 In our Policy Lab, we have worked in various research projects to: 1. analyse challenges/problems that arise between innovations, technology, market, and regulations, 2. develop one or more workable solutions and 3. interact with relevant actors to determine the next steps. What distinguishes our Policy Lab is that we never “own” the issue or solution. We must therefore always work with other actors who can take the results further. Our goal is to enable and skill people. This means that for us it is important to work concretely with real problems and needs owners and preferably test different solutions. We focus on the here and now perspective and not on what the future will look like in 10 years. It is about taking the next step forward towards the future, not creating the best rule, but instead creating the next rule. We also work consistently agile and use design as a method for problem solving. This means that the way we organize our work in the Policy Lab is circular and not linear. When it comes to using design as a method for problem solving, we use the concepts of "design thinking" and "double diamond". For us, it is also important that the members of the Policy Lab have different backgrounds and skills depending on what is needed in the individual project....

The rapid pace of digitalization and the new opportunities for value creation has raised a concern that regulation is lagging behind and becoming an obstacle. A number of tools have been proposed in order to facilitate innovation that is aligned with existing or upcoming policies.

A specific case of both facilitating and regulating innovation is the EU’s proposed regulation of AI systems. The act not only poses legal requirements on providers and users of AI systems but also includes measures for facilitating innovation – the concept of regulatory sandboxes is defined with specific purposes together with legal exempts.

At the time of releasing our paper, the trilogue has reached a political agreement. This means the proposed AI Act will be, even though we do not yet have the final wording. By mapping the negotiation mandates of the European Commission, the European Parliament and the Council of the European Union against Swedish experiences of facilitating innovation and regulatory compliance in relation to AI, we still suggest launching pilots for regulatory sandboxes without delay.

Based on our own experiences from conducting policy labs and those reported on by others from their regulatory trials, we conclude that it takes time to grow confidence in defining a research agenda with other stakeholders and then strike the balance between facilitation and surveillance of innovation. Something that will require institutional learning and capacity building.

The mandate to foster and facilitate regulatory compliance as well as innovation, given to the public sector through the AI Act’s regulatory sandboxes, is disruptive. It changes the role and responsibilities for some national authorities, requiring the acquisition of new competences and resources, as well as for the private sector. When they team up with a competent authority the mandate to act becomes larger, as does the responsibility with regards to which kinds of innovation to drive.

Conducting trials in the current window of opportunity, between now and when the AI Act is in force, will create experiences that policy makers and stakeholders can draw on when creating the detailed guidelines for organising regulatory sandboxes. Adopting an incremental and iterative process enables a transition from learning the basics of selecting a case and finding relevant partners to detailing how to process data and sharing responsibilities and rewards.