Statement | JRF's Feedback on the National Science and Technology Council's Draft "Artificial Intelligence Basic Act"

English Version

The Judicial Reform Foundation (JRF) has long advocated for democracy and the rule of law, with a particular focus in recent years on how the rapid digitization of public and private sectors alters power structures, including citizens' rights and the boundaries of public authority. As a legal professional civil society organization, the JRF is dedicated to advancing the legal codification of digital rights. We emphasize that only when citizens' rights are fully recognized and protected by law—and operationally accountable mechanisms are established—can we systematically and comprehensively safeguard personal freedom and a collective democratic society in the digital age. Regarding the "Artificial Intelligence Basic Act" draft (hereinafter the "Draft AI Basic Act" or "this Draft") announced for public comment by the National Science and Technology Council on July 15 of this year, our feedback is as follows:

I. The engineering of digital governance must be expanded to the overall digital environment, recognizing citizens' rights and establishing legal, actionable accountability mechanisms

(I) Support for the general direction of legal codification

The cornerstone of a democratic society is the Rule of Law. In the face of significant shifts in social power structures, establishing rights and responsibilities through legal norms passed with a legitimate democratic mandate—rather than relying solely on rapidly shifting, piecemeal administrative policies—is undoubtedly the correct governance direction. Grounded in the core values of "people-centric" and "rights-based," the JRF deeply affirms the government's choice to pursue this direction of legal codification and hopes to collaborate and exchange efforts with the civic community in this endeavor.

(II) Legal codification efforts should extend broadly to the entire digital environment, not just AI

However, technological development, especially information technology, advances extremely rapidly. The attention of industries, governments, and even the stock market easily shifts. Even government policies or legal norms proposed may lack a comprehensive, fundamental, and systematic framework that consolidates and upholds core values throughout the societal digitization process.

What we need is not merely an AI Basic Act; our government's vision should not be limited to the currently trending AI. Instead, the scope of concern should be expanded to encompass the entire digital environment. The consolidation of social consensus and values should also take "the process of societal digitization as a whole" as its unit of consideration to design a democratic and free digital society.

(III) Rejection of onesided legislation that lacks citizens' rights and blindly encourages development; legal effects and timelines must be concrete and timely

Although currently named a "Basic Act," the Draft AI Basic Act consists mostly of policy declarations proclaiming that the government should actively promote the development of artificial intelligence by the public and private sectors. ^[1] Compared to waving the high banner of promoting development, the Draft downplays and fails to propose concrete mechanisms for mitigating the negative impacts and risks that large-scale AI deployment might bring in a short period. It even lacks clear provisions regarding liability attribution and competent authorities.

Such a one-sided legislative draft—which blindly encourages development and benefits applications without establishing any legally binding regulatory and accountability mechanisms, nor recognizing citizens' rights to assert claims and the government's duty to protect citizens—is tantamount to a train with an accelerator but no brakes. It fundamentally fails to achieve the legislative purpose set forth in Article 1 of the Draft, namely, "to safeguard the lives, bodies, health, safety, and rights of citizens."

Since this Draft is named a "Basic Act," it should, like other basic acts in our country, establish citizens' "rights" and the corresponding "obligations" of the state. Regrettably, however, the current draft remains completely silent on citizens' rights, serving as an empty shell of a basic act that amounts to little more than vague policy declarations.

If passed, the Draft AI Basic Act will, to a certain extent, define future legal developments as well as civic rights and governmental responsibilities in a digital free society. It must not only be treated with utmost caution but cannot simply be deferred with a "we'll deal with it later" attitude.

II. The Draft severely lacks the functions and elements a basic act should possess

If "basic acts" are chosen as the legislative model for this legal codification, the legislation naturally should fulfill the functions proper to basic acts. Below, the JRF outlines the essential elements severely lacking in the current Draft:

(I) A basic act should recognize rights that citizens can legally assert

First, one of the important functions of a basic act is to proclaim the list of rights that deserve protection in that respective field. For example, the Education Basic Act stipulates the recognition of "the people's right to request academic equivalency assessment" (Article 14), "the freedom of the people to establish schools for educational purposes" (Article 7), and "students' rights to learning, education, bodily autonomy, and personality development" (Article 8). Similarly, the Indigenous Peoples Basic Act explicitly protects "indigenous peoples' rights to communication and media access" (Article 12) and "indigenous peoples' rights to land and natural resources" (Article 20). Furthermore, the Education Basic Act explicitly mandates that when teachers and students face improper or illegal infringements upon their rights, the government has the responsibility to provide effective and fair remedies (Article 15).

However, looking at the current Draft AI Basic Act, it contains absolutely no provisions for rights protection! Even though Article 3 attempts to list some basic principles, they are rendered hollow due to a lack of concrete, operational definitions. Moreover, because the Draft completely fails to specify the legal effects or any adverse consequences for violating these principles, these beneficial basic principles are reduced to decorative ornaments devoid of any protective efficacy, merely whitewashing a draft that focuses solely on development with zero regulatory impact.

In reality, rights protection clauses in a basic act are especially crucial for emerging fields characterized by a high degree of uncertainty, such as artificial intelligence. For instance, legislation should recognize citizens' "privacy rights" (including informational self-determination, confidentiality, and anonymity), autonomy (including the right to opt out, demands for data minimization, and meaningful alternatives), and digital mental health rights, among others.

(II) A basic act should outline a framework plan for competent authorities, future legislative methods, and deadlines for regulatory review

Second, another function of a basic act is to set future institutional and policy directions for relevant government agencies. To fulfill this function, a basic act should at least propose a summary framework plan regarding competent authorities, future legislative methods, and deadlines for regulatory review.

However, looking at the current Draft AI Basic Act, it fails to clearly account for even the most basic competent authorities and deadlines for regulatory review. ^[2] The outside world can only piece together and infer a vague picture of governmental AI governance from fragmented clues, with no ability to rely on the current picture to anticipate potential future regulatory developments.

III. The Draft raises numerous concerns: delegation issues, lack of timelines, absence of definitions, and facile exemptions

Among the provisions already proposed by the NSTC, many raise concerns; therefore, the JRF primarily offers suggestions on fundamental aspects such as general direction and broad framework above. As for suggestions on specific draft provisions, we highlight several major controversies below:

(I) How can a basic act possess the authority to delegate the enactment of administrative regulations?

Article 10 of the Draft ^[3] authorizes various competent target-business authorities to enact AI risk-grading regulations relevant to their respective jurisdictions. ^[4] However, unlike functional laws, a basic act lacks the authority to delegate the enactment of administrative regulations, making the current design of the draft legally confusing.

Furthermore, even though this Draft adopts a risk-grading regulatory model, it completely fails to indicate the corresponding effects of risk grading, omitting even the most general directions or scopes, thereby falling short of the framework-guiding function a basic act should serve.

(II) Rejection of a "we'll deal with it later" approach devoid of timelines

To take a step back, even if this draft possesses some characteristics of a functional law, procedural timelines seem impossible to secure through it. Under the current draft, which lacks concrete timelines, "we'll deal with it later" means not only "we'll tell you the content later" but also that no one knows "how much later later will be," leaving no agency responsible for tracking progress.

This is equivalent to the government broadly encouraging all cars and motorcycles to hit the road (Articles 4 through 8) before formulating any traffic rules—even using taxpayers' money to subsidize, fund, and incentivize, ^[5] or providing fiscal incentives such as taxation and finance ^[6]—urging everyone to drive onto roads devoid of traffic rules. As for what the traffic rules will probably look like in the future? We'll talk about it later. What happens if you break the rules? Unspecified! When will the rules be announced? Who knows!

Such sloppy legislative drafting not only fails to protect citizens' rights, but even the industrial promotion the government wishes to achieve will be deterred by unclear regulations, making it difficult to accomplish any of the legislative purposes listed in Article 1 of the Draft.

(III) Prohibited uses or contexts should be explicitly enumerated

As a framework-style macro-statute, the AI Basic Act should, in addition to establishing citizens' rights and corresponding state obligations, clearly enumerate prohibitory regulations for specific contexts or uses. This part may reference the deliberations regarding "unacceptable-risk AI systems and models" during the legislative process of the European Union's Artificial Intelligence Act, followed by moderate adjustments integrated into our local context.

Taking the EU's eventually passed AI Act as an example, because applying AI poses potential threats to fundamental rights and democracy, the following applications are entirely prohibited: subliminal manipulation, social scoring, biometric categorization systems using sensitive characteristics, individual predictive policing, and facial recognition.

(IV) Definitions of key terms such as "artificial intelligence" must be improved

Throughout the entire Draft, only the term "artificial intelligence" is defined, while other terms lack clear delineation. This will severely undermine the practical utility of the Draft and even open backdoor loopholes for evading liability within a vast ambiguous space.

The technologies and related social issues involved in artificial intelligence are relatively novel, and terminology definitions should naturally be established legislatively so that operationalization becomes possible thereafter. Taking the EU AI Act as an example, the provisions handling definitions alone (Article 3) cover definitions for 68 terms, highlighting the severe inadequacy of this Draft's single meager definition. Since this Draft intends to adopt the EU risk-grading model, it must be specifically pointed out that in the EU AI Act, even the term "risk" has a clear legal definition to ensure subsequent related regulations are grounded upon solid, clear definitions layer by layer.

In contrast, in this Draft, even the sole term it attempts to define—"artificial intelligence"—is constructed using other terms that lack legal definitions. Citing the text of the Draft: "'Artificial intelligence' as referred to in this Act means a machine-based system that operates with autonomy, and that, for explicit or implicit objectives, infers from the inputs or sensations it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments." Among these, what are the definitions of "autonomy," "machine learning," and "algorithms"? Without clear delineations, they will inevitably become sources of legal dispute in the future.

(V) Exemption clauses must strengthen definitions, thresholds, and related complementary mechanisms

The exemption clause established in Article 12 of the Draft—"Any activities prior to the application of artificial intelligence technology development and research, except for complying with the basic principles of Article 3, shall not be subject to the application liability-related regulations of the preceding paragraph"—lacks thoroughness. First, without clearly defining what constitutes "development," "research," and "application," it is foreseeable that "development" and "research" could easily become safe havens for businesses and the government to evade liability. In other words, as long as operators claim that their AI is still in testing, trial operation, or calibration training stages—meaning they interpret their actions as far as possible not yet falling into the "application" stage—they could potentially obtain complete exemption from liability. Therefore, under such an exemption framework, clearly clarifying the line between development, research, and application is crucial and stands as the absolute key point of contention. Without regulatory definitions, this will become the largest loophole in our country's AI governance. Although structurally a framework- and guidance-oriented legislation, a basic act should at least outline and define the lifecycle of artificial intelligence—such as research, development, deployment, and product launch—and stipulate the liability regulations applicable to each respective stage.

Furthermore, whether liability should be directly waived entirely even during the purely initial development and research stages requires careful consideration. In fact, how to balance innovation and regulatory harmonization is not unique to artificial intelligence; the so-called regulatory sandbox is a feasible method. When we begin to further discuss the institutional design and accountability mechanisms of sandboxes, we can more meticulously design relevant liability-reduction conditions and complementary mechanisms, including how to make regulatory harmonization more than just reactive post-market negotiation, but rather a process of interaction and symbiotic search during the early stages of R&D.

IV. The AI Basic Act lacks vision; what the public needs is a "Digital Bill of Rights"

As a democratic and free nation amidst the massive wave of rapid technological changes and widespread applications, Taiwan needs a society that clearly formulates a concrete list of rights and legal effects (citizens' rights, state obligations, accountability mechanisms), alongside legal frameworks such as procedural timelines. The JRF hopes that after public consultation, this Draft will fully progress toward the aforementioned direction.

The Foundation also expects all sectors of society not only to see current artificial intelligence issues but also to expand their scope of concern to the overall digital environment and the profound impacts that digitization brings to individual freedom and collective democracy. The JRF is likewise inviting legal and information technology experts to jointly draft a "Digital Bill of Rights", hoping it will become the core value for promoting a future "Digital Basic Act," and hereby welcomes all sectors to review and exchange views.

--------

^[1] Policy objectives such as "actively promoting artificial intelligence research and development, applications, and infrastructure" (Article 4), "establishing or completing innovative experimental environments for existing artificial intelligence R&D and application services" (Article 6), "promoting innovative AI applications through public-private partnerships and international cooperation" (Article 7), and "enhancing the usability of data used by AI" (Article 15) lean heavily toward encouragement without pairing corresponding firewall designs to guard against potential technological abuse and rights infringements brought by AI.
^[2] Article 17 of the Draft states: "The government shall, following the enforcement of this Act and in accordance with its provisions, review and adjust its jurisdictional duties, operations, and regulations to implement the purposes of this Act. Prior to the formulation (enactment) or amendment of such regulations, where existing laws and regulations are silent, the central target-business competent authority shall, in coordination with the central science and technology competent authority, interpret and apply them in accordance with this Act." In contrast, clear deadlines for regulatory review are stipulated in the Telecommunications Management Act (Article 16, two years), the Indigenous Peoples Basic Act (Article 34, three years), and the Ocean Basic Act (Article 16, two years).
^[3] Article 10 of the Draft states: "The Ministry of Digital Affairs shall, referencing international standards or normative developments in artificial intelligence cybersecurity protection, risk grading, and management, promote an international-interfacing artificial intelligence risk-grading framework. Various target-business competent authorities may follow the risk-grading framework of the preceding paragraph to enact risk-grading regulations for their supervised businesses."
^[4] Please note that the terminology in Article 10, Paragraph 2 of the Draft is "... competent authorities 'may' follow ...". Since the wording chosen is "may" rather than "shall," competent authorities are not burdened with any obligation to enact regulations, nor are they obligated to follow the Ministry of Digital Affairs' risk-grading framework if they do enact regulations. If so, what is the practical utility of enacting this provision?
^[5] Article 4 of the Draft.
^[6] Article 4 of the Draft.