Ethical Issues and Novel Applications of AI

Contents

• Stakes (Extrapolating)
• Place in the 2-year path
• Industry and research links
• Regulation primer
• How to approach it
• Readings

Stakes (Extrapolating)

Extrapolated notes. This M2 seminar (6 ECTS) has two faces: ethical issues (bias, surveillance, accountability, governance) and novel AI applications — including where Graph×LLM changes the impact surface (agents, multimodal, sensitive relational data).

Empirically, after a technical year, ethics risks becoming a final slide. Here it is a work object: cases, readings, argumentation — in dialogue with humanities and M2 safety / privacy / explainability modules.

This page gives the seminar a working kit: a short regulation primer, eight cases tied to the chapters where their technical facts are taught, and one deliverable, a case memo on your own transverse project.

Place in the 2-year path

• Upstream: M1/M2 humanities (the 2026–27 options include Sociology of AI) and the research internship.
• Technical base, guaranteed by the mandatory path: ML 4.8 (subgroup evaluation and group fairness, Year 1 P1) and LLMs ch. 9 (evaluation and safety of LLMs, Year 2 P1).
• Technical base, if taken: Emerging ML ch. 6 (collaboration, personalization, fairness), Optimal Transport ch. 6 (fairness through transport), Privacy & UQ (Year 2 P1), Security & Robustness and Explainability, Security, Privacy of LLMs (ESP; both Year 2 P2, alongside the seminar).
• Outside the LLGA lists: Optimization and Responsible AI has moved to Year 1 P1 as CSC_51076_EP. Its footprint chapters (ch. 6–7) remain reference reading for questions of environmental cost.
• Parallel: M2 LLMs, GNN, geometric DL, privacy/security.
• Downstream: transverse project and final internship, where ethical trade-offs become operational again.

Industry and research links

Industry: AI governance, risk & compliance, product red-teaming (ESP 10.1), usage policies. Research: fairness, privacy attacks, socio-technical studies — and fast-moving novel applications (agents, generative + graphs).

Regulation primer

Most cases of the seminar end on a legal question: is the system allowed, and what must its makers document? This primer gives the texts you will cite and a procedure to classify a system. ESP 10.2 covers the AI Act from the LLM side.

It is a study aid, not legal advice. Cite articles from the consolidated texts on EUR-Lex, because dates and official guidance keep moving.

The AI Act in four tiers

Regulation (EU) 2024/1689, the AI Act, classifies AI systems by their intended purpose, not by their technique. The same GNN is minimal-risk in a music recommender and high-risk in a hiring tool.

Roles. The provider develops a system, or has it developed, and places it on the market under its own name. The deployer uses it under its authority.

Research and development before a system is placed on the market or put into service is outside the Act (art. 2(8)). If a transverse-project system were put into service, its team would usually be the provider, building on someone else’s general-purpose model. The memo therefore classifies the system as if it were deployed.

Annex III lists eight high-risk areas:

1. biometrics (remote identification, categorisation, emotion recognition, where not prohibited);
2. critical infrastructure (safety components of digital infrastructure, road traffic, water, gas, heating, electricity);
3. education and vocational training (admission, grading, proctoring);
4. employment and workers management (recruitment, targeted job ads, CV filtering, promotion, termination, task allocation, monitoring);
5. essential private and public services (public benefits; creditworthiness of natural persons, fraud detection excluded; life and health insurance pricing; emergency-call triage);
6. law enforcement;
7. migration, asylum and border control;
8. administration of justice and democratic processes, including influence on elections.

The art. 6(3) filter. An Annex III system escapes the high-risk class when it poses no significant risk of harm: it performs a narrow procedural task, improves the result of a completed human activity, detects deviations from earlier decision patterns without replacing the human assessment, or performs a preparatory task for an assessment. The filter never applies when the system profiles natural persons, and the provider must document its reasoning.

High-risk duties (arts. 9–15). A risk-management system; data governance, including an examination for bias; technical documentation (Annex IV); automatic logging; instructions for the deployer; human oversight; accuracy, robustness and cybersecurity. Public bodies, providers of public services, and deployers that score credit or price life and health insurance add a fundamental-rights impact assessment (art. 27).

General-purpose AI models (arts. 51–55). Every GPAI provider writes technical documentation for the AI Office and for downstream providers, adopts a copyright policy that respects text-and-data-mining opt-outs, and publishes a summary of the training content. Open-source models are exempt from the two documentation duties, unless they carry systemic risk.

A model is presumed to carry systemic risk when its cumulative training compute exceeds 10^{25} FLOP. Its provider must also evaluate it, adversarial testing included, assess and mitigate systemic risks, report serious incidents and secure the model.

Dates. The Act has been in force since 1 August 2024. Prohibitions and AI literacy apply from 2 February 2025, GPAI duties from 2 August 2025, most other rules (Annex III included) from 2 August 2026, and Annex I products from 2 August 2027. These are the dates of the Act as adopted in 2024.

Amended dates. The “Digital Omnibus on AI”, Regulation (EU) 2026/1744 of 8 July 2026 (Official Journal of 24 July 2026, in force on 27 July 2026), moved the high-risk requirements (Chapter III, Sections 1–3, except art. 6(5)) to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems.

Providers of systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 have until 2 December 2026 to mark the outputs (art. 50(2), new art. 111(4)). The same act adds prohibitions, from 2 December 2026, on AI systems that generate or manipulate non-consensual intimate material or child sexual abuse material (art. 5(1), points (ba) and (bb)). Check the consolidated text on EUR-Lex before you cite a date: guidelines and further amendments may follow.

Fines reach €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and €15 million or 3% for most other breaches (art. 99).

Classifying a system in six questions

1. Is it an AI system at all (art. 3(1): a machine-based system that infers from its inputs how to generate outputs), and are you its provider or its deployer?
2. Does its purpose match a prohibited practice of art. 5? If so, stop: the options left are redesign and abstention.
3. Is it an Annex I product, or a safety component of one, that needs a third-party conformity assessment, or does its intended purpose fall in an Annex III area? If Annex III, does the art. 6(3) filter apply, and does the system profile people?
4. Does art. 50 apply: does it talk to people, generate synthetic content, produce deepfakes or recognise emotions?
5. Does it build on a general-purpose model, and is that model above 10^{25} FLOP? Name the documentation you need from its provider.
6. Does it process personal data? If so, on which GDPR basis, is a decision covered by art. 22, and is a data-protection impact assessment (art. 35) required?

The answer is one tier, the articles that apply, and the list of duties they create.

GDPR article 22: automated decisions

Art. 22 of the GDPR (Regulation (EU) 2016/679) gives a person “the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”

Such a decision is allowed only if it is necessary for a contract, authorised by law, or based on explicit consent. In the first and last cases, the person keeps at least the right to obtain human intervention, to express a point of view and to contest the decision. Sensitive data (art. 9) also need explicit consent or a substantial public interest.

Three points matter for engineers:

• A rubber-stamp review is not human intervention: the reviewer needs the authority and the information to change the outcome (Article 29 Working Party guidelines, 2018).
• In SCHUFA (C-634/21, December 2023), the Court of Justice held that a credit score can itself be the decision when a lender relies on it heavily.
• Arts. 13–15 add a right to “meaningful information about the logic involved”. This is where explanations, such as TreeSHAP in ML 6.4 or attributions in ESP ch. 4, meet the law.

Model cards and datasheets

Two short documents turn the results of an evaluation into something a regulator, a deployer or a user can read. The technical documentation of the AI Act (Annex IV, and Annexes XI–XII for GPAI) asks for much of the same content.

• A model card (Mitchell et al., 2019) gives the model details; intended and out-of-scope uses; the factors that matter (groups, environments, instruments); metrics; evaluation and training data; results broken down by factor, such as the per-group tables of ML 4.8; ethical considerations; caveats and recommendations.
• A datasheet (Gebru et al., 2021) answers questions on a dataset’s motivation, composition, collection process, preprocessing and labelling, recommended uses, distribution and maintenance.

The transverse project already requires both (deliverables); the memo below attaches them.

How to approach it

• For each case, separate technical facts, conflicting values, and action options (design, policy, abstention).
• Take the facts from the chapters named in each case. The mandatory chapters are always available; the Year 2 electives Privacy / uncertainty, Security & robustness and Explainability / security / privacy of LLMs go deeper when you have taken them.
• Classify every case with the six questions before arguing about values: the law often settles part of the question.

Eight cases

Each case states a dilemma, where its facts are taught, and its legal hook. Chapters marked “if taken” belong to electives.

1. Exposure in a recommender. A news or job recommender gives most of its exposure to popular items and majority-group creators.
   • Facts: ranking metrics and popularity bias in NLP 8.5; per-group metrics in ML 4.8; fairness of exposure (Singh and Joachims, 2018).
   • Values: relevance for the user against equity for creators and diversity for the public.
   • Law: minimal risk for news; a job recommender that targets job ads falls in Annex III point 4. Online platforms must also disclose the main parameters of their recommenders (Digital Services Act, art. 27).
2. Re-identification through a GraphRAG index. A GraphRAG assistant over internal documents merges scattered mentions into an entity graph; a few questions then single out one employee.
   • Facts: the privacy line of the GraphRAG hygiene note, Graph ML 10.3; memorization, membership inference and anonymization, ESP ch. 7–9 (if taken); structural re-identification (Narayanan and Shmatikov, 2009).
   • Values: the usefulness of aggregation against privacy and purpose limitation.
   • Law: the GDPR first (purpose limitation, data minimisation, an impact assessment). Under the AI Act the assistant is minimal or transparency risk, unless its purpose is in Annex III, as an HR investigation tool’s would be.
3. Hallucination in a clinical assistant. A biomedical question-answering assistant, as in the Y2.1 brief, gives a clinician a confident, wrong dosage.
   • Facts: hallucination taxonomy and mitigations, LLMs 9.3; conformal prediction, Privacy & UQ ch. 9, and conformal abstention for LLMs, ch. 11 (if taken).
   • Values: access to knowledge against patient safety; who answers for the error.
   • Law: software intended for diagnosis or treatment is usually a medical device, hence high risk through Annex I. A literature-exploration tool that cites and abstains is not. The intended purpose, written down, decides.
4. Voice cloning. A speech product clones a voice from a few seconds of audio; someone uses it to imitate a manager on the phone and order a payment.
   • Facts: zero-shot cloning and audio watermarking, Speech ch. 9 (if taken).
   • Values: accessibility, giving a voice back to people who lost theirs, against consent and fraud.
   • Law: art. 50 (machine-readable marking of synthetic audio, disclosure of deepfakes). The GDPR applies too, since a voice is personal data, and biometric data when used to identify someone. In France, the voice is also protected as an attribute of personality.
5. An agent acts on its own. A tool-using LLM agent with e-mail and payment permissions obeys an instruction hidden in a web page it was asked to summarise.
   • Facts: agents as partially observed decision processes, RL ch. 7; the ReAct loop, LLMs 8.1; prompt injection, LLMs 9.4; tracing, budgets and permissions, MLOps ch. 8 (if taken).
   • Values: delegation and productivity against control; who answers for an action that no human approved.
   • Law: the AI Act classifies an agent by its purpose, not by its autonomy, so human oversight (art. 14) is required only for high-risk purposes. Damage caused by defective software, AI included, falls under the revised Product Liability Directive (EU) 2024/2853, for products placed on the market after 9 December 2026.
6. Dual-use molecule generation. A generator that minimises predicted toxicity can maximise it by flipping one sign: Urbina et al. (2022) obtained 40,000 candidate toxic molecules, VX among them, in under six hours.
   • Facts: inverse design with multi-objective scores, Graph Generative Models ch. 8 (if taken); the dual-use policy of the Y2.2 brief.
   • Values: open science against misuse; who decides what is withheld, and on what evidence.
   • Law: no Annex III area applies. The systemic-risk assessment of large general-purpose models covers chemical and biological misuse (AI Act, recital 110), and chemical-weapons and dual-use export rules (Regulation (EU) 2021/821) may govern what is shared.
7. Fraud scoring. A temporal GNN flags transactions, as in the Y2.5 brief; flagged customers see their accounts frozen.
   • Facts: per-group error rates, ML 4.8; evasion attacks on graphs, Security & Robustness ch. 9 (if taken); drift, MLOps ch. 5 (if taken).
   • Values: preventing crime against false accusation; explaining a decision without teaching fraudsters how to evade it.
   • Law: Annex III point 5(b) covers creditworthiness but excludes fraud detection, so that ground does not make the scorer high-risk. GDPR art. 22 applies if accounts are frozen with no meaningful human review, and anti-money-laundering law adds its own duties.
8. Ranking job applications with an LLM. An HR team asks an LLM judge to score and rank CVs.
   • Facts: the biases of LLM judges, LLMs 9.2; BBQ-style bias scores, LLMs 9.7 (self-study); why group-fairness criteria conflict, ML Prop. 4.5.
   • Values: speed and consistency against non-discrimination and the candidate’s right to be heard.
   • Law: Annex III point 4, with no art. 6(3) escape, since ranking candidates is profiling. The employer, as deployer, must tell the candidates that a high-risk system is used (art. 26(11)) and inform workers’ representatives before using it at the workplace (art. 26(7)). GDPR art. 22 applies if no human truly reviews the ranking.

Deliverable: the case memo

Each student writes one memo, on the transverse project of their own team. The format below is a proposal of these notes; the official seminar sets the real one. The same memo can serve the “Communication and ethics memo” row of the Year 2 rubric.

Aim for about 2,000 words, with the project’s model card and datasheet as an appendix. The memo has six parts.

1. System. What the system does, who uses it, who is affected without using it, and which data it processes.
2. Classification. The six questions, answered one by one, ending in a tier, the articles that apply and the duties they create. Say whether your team is provider or deployer.
3. Facts. Measured results from the project’s own evaluation: per-group metrics with group sizes and intervals, attack success rates, abstention coverage. Keep what was measured, what was estimated and what is unknown apart.
4. Values. The stakeholders, and at least two values that the facts put in real conflict, such as accuracy against equity, utility against privacy, or openness against misuse.
5. Options. At least one design option, one policy option and the abstention option (not deploying, or refusing a class of inputs), each with its cost and who bears it.
6. Recommendation. One choice, its residual risk, and the evidence that would make you revise it.

Grading grid (proposal)

Readings

Eight readings cover the primer and the cases; case 1 adds A. Singh and T. Joachims, “Fairness of Exposure in Rankings”, KDD 2018.

1. Regulation (EU) 2024/1689 (the AI Act), Official Journal of the EU, 12 July 2024: arts. 3, 5, 6, 26, 50, 51–55 and Annex III.
2. Regulation (EU) 2016/679 (the GDPR), art. 22 and recital 71; Article 29 Working Party, Guidelines on Automated Individual Decision-Making and Profiling, WP251 rev.01, 2018.
3. M. Mitchell et al., “Model Cards for Model Reporting”, Conference on Fairness, Accountability, and Transparency (FAT*), 2019.
4. T. Gebru et al., “Datasheets for Datasets”, Communications of the ACM 64(12), 2021.
5. S. Barocas, M. Hardt and A. Narayanan, Fairness and Machine Learning: Limitations and Opportunities, MIT Press, 2023 (free at fairmlbook.org).
6. L. Weidinger et al., “Taxonomy of Risks posed by Language Models”, FAccT 2022.
7. F. Urbina, F. Lentzos, C. Invernizzi and S. Ekins, “Dual use of artificial-intelligence-powered drug discovery”, Nature Machine Intelligence 4, 189–191, 2022.
8. A. Narayanan and V. Shmatikov, “De-anonymizing Social Networks”, IEEE Symposium on Security and Privacy, 2009.

Extrapolating Framing, cases and memo format are proposals of these notes; session syllabus and grading = official seminar. The legal summaries are study aids, not legal advice.