by Marília Frias, Senior Associate at Vieira de Almeida & Associados
 and Tiago Cabral, Master in EU Law, University of Minho

▪

1. As we are writing this short essay, a significant percentage of the world population is at home, in isolation, as a preventive measure to stop the spread of the COVID-19 pandemic. Of course, for isolation to be effective, people should only leave their houses, when strictly necessary, for instance, to shop essential goods and, frequently, preventive measures include orders of closure directed to all non-essential businesses.

2. Unfortunately, the European Union (hereinafter, “EU”) is one of the epicentres of the pandemic. As a result, some European citizens are turning to e-commerce to buy goods not available in the brick-and-mortar shops that are still open. Meanwhile, others opt to bring their shopping into the online realm simply to reduce the risk of contact and infection. Currently, sustaining the market as best as possible under these conditions to avoid a (stronger) economic crisis should be one of the key priorities. Furthermore, with a growing number of people working remotely, it is also vital to guarantee that the necessary supplies can arrive in time and with no health-related concerns attached.

3. Nowadays, most delivery services work based on humans who physically get the product from point A and deliver it to point B. The system is more or less the same, whether the reader orders a package from China or delivery from the pizza place 5 minutes away from the reader’s house. Obviously, more people will be involved in the delivery chain in our first example, but it is still, at its core, a string of people getting the order from point A to point B. This is a challenge for those working in the delivery and transportation businesses who have to put their health on the line to ensure swift delivery of products to the ones who are at home.

4. Using delivery drones (or unmanned aircraft systems[i] [“UAS”]) for short-distance deliveries is not a novel idea. In fact, plenty of top market players such as Amazon have plans for their implementation. Nevertheless, one person can, in principle, only pilot one drone and, thus, control one delivery at a time. With growing demand for deliveries and short supply of qualified remote pilots a question arises: can we use artificial intelligence (“AI”) to automate drones and improve the number of deliveries, while keeping costs down? In aviation, planes do not exactly pilot themselves, but automation has been growing over the decades, and the growing sophistication of automated systems contributes heavily to the current level of safety in air travel. Piloting an airplane is also far more challenging than piloting a food or package delivery drone, so there is good reason to think that AI may be able to do it, maybe even with more skill than (most) humans.

5. But is it legal? In fact, does our current legal framework even provide for such a scenario? The EU has been working to ensure that, in the near future, these operations will be fully covered by the EU’s legal framework. The Commission Implementing Regulation 2019/947/EU of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft (hereinafter, “UAS Regulation”), applicable to all Member States from 1 July 2020 onwards, lays down detailed provisions for the operation of unmanned aircraft systems as well as for personnel, including remote pilots and organisations involved in those operations. By using criteria such as the nature and risk of the operation or activity, the UAS Regulation establishes categories of operations: the “open”, “specific” and “certified” categories. The regulatory burden for drone operation is lighter in the “open” category and more substantial in the “certified”. The “specific” category is between those two.

6. In this essay, we shall focus on the “specific” category as it is where, in our opinion, most AI-equipped delivery drones will, likely, fall. Why?

Well, they shall not fall within the “open” category as it is unlikely that any deliveries could be made while meeting requirements such as the remote pilot keeping the unmanned aircraft in VLOS (Visual Line of Sight) at all times (except when flying in “follow-me” mode or when using an unmanned aircraft observer) or during flight the unmanned aircraft not dropping any material. Also, a quick analysis of article 6 of the UAS Regulation, along with Article 40 of Commission Implementing Regulation 2019/945/EU of 12 May 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems will bring us to the conclusion that the “certified” category was designed for highly complex and/or dangerous operations, where drones are, for example, very large, heavy, designed to transport people or to transport dangerous goods (which will not be your regular drone delivery operations). Finally, the “specific” category may to a certain extent be deemed as a “residual” category (where various operations will fall) since whenever one of the requirements applicable to the “open” category is not met, a UAS operator shall be required to obtain an operational authorisation (under the “specific” category) and only certain types of operations are classified as falling under the ‘certified’ category. Finally, operations under the “specific” category are carried out under either an operational authorisation or a light UAS operator certificate (‘LUC’) or an operational declaration of compliance with a standard scenario, as defined in Appendix 1 to Part B of the Annex to UAS Regulation[ii]. All three options may allow carrying out a number of operations without going through a new “approval” for every single one. This also seems to favour the investment on AI for those delivery operations.

We do not intend to imply that it will not be possible to use AI in the future under “certified” or “open” categories. However, considering the current rules, it seems more likely to have AI being used in delivery operations that fall within the “specific” category.

7.As further detailed below, according to section “UAS.SPEC.050”, in the Annex to UAS Regulation, where responsibilities of the UAS operator^[iii] for the “specific category” are laid down, the operator shall, amongst other obligations: designate a remote pilot for each operation or, in the case of autonomous operations[iv], ensure that during all phases of the operation, responsibilities and tasks especially those defined in points 2) and 3) of point UAS.SPEC.060 are properly allocated in accordance with the procedures established pursuant to UAS.SPEC.050 point 1), subpoint a).

8. Thereby, remote operations through autonomous means (which in our view could include AI) are allowed as long as the UAS operator (that may be a legal person) is in a position to ensure that the obligations mentioned above. . According to these:

“Before starting an UAS operation, the remote pilot shall comply with all of the following

(a) obtain updated information relevant to the intended operation about any geographical zones defined in accordance with Article 15 [geographical areas determined by the Members States];

(b) ensure that the operating environment is compatible with the authorised or declared limitations and conditions;

(c) ensure that the UAS is in a safe condition to complete the intended flight safely, and if applicable, check if the direct remote identification works properly;

(d) ensure that the information about the operation has been made available to the relevant air traffic service (ATS) unit, other airspace users and relevant stakeholders, as required by the operational authorisation or by the conditions published by the Member State for the geographical zone of operation in accordance with Article 15.

(3) During the flight, the remote pilot shall:

(a) comply with the authorised or declared limitations and conditions;

(b) avoid any risk of collision with any manned aircraft and discontinue a flight when continuing it may pose a risk to other aircraft, people, animals, environment or property;

(c) comply with the operational limitations in geographical zones defined in accordance with Article 15;

(d) comply with the operator’s procedures;

(e) not fly close to or inside areas where an emergency response effort is ongoing unless they have permission to do so from the responsible emergency response services.”

9. With our current technology it is not impossible to foresee that these obligations may be met by an autonomous machine instead of a human remote pilot. Another option that could possibly be analysed is a combination of an autonomous machine with a human supervisor who would not pilot the drone but make sure that specific tasks are carried out in a manner that is complying with the legislation and be there if there is any need to intervene.

10. However, to fully expand the technology to a point where it can be used in a widespread manner, the EU must deliver on the regulation of management of traffic for unmanned aircraft (U-space)[v][vi]. Exponential growth of operations in a manner that ensures safety and harmonisation across the Union depends on it. Thereby it is key for the European Commission to streamline efforts on an Implementing Regulation regulatory framework for the U-space as requested by EASA.

11. Of course, there are other challenges, such as the ones arising from data protection. Would these drones be equipped with sensors and/or cameras that collect and process personal data? In fact, one could easily imagine, at least, a few types of data protecting operations needed to implement delivery through these autonomous machines and that could pose a challenge for legal scholars (for instance whether the data processing happens directly in the drone or through a parallel system). One is data from the drone’s surroundings, for example, to avoid obstacles on take-off or when descending to deliver their cargo. The other could be identification and location data from the client to identify the person to whom the order should be delivered. With deliveries being swifter and more accurate, consumer profiles could also be built by deploying certain tracking technologies and interconnecting data (in comparison to what is realistically possible today), and that could also merit further study.

Under the “specific” category, the UAS operator is required to comply with certain procedures, which include “(iv) procedures to ensure that all operations are in respect of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [or “General Data Protection Regulation” or “GDPR”]. In particular it shall carry out a data protection impact assessment [“DPIA”], when required by the National Authority for data protection in application of Article 35 of Regulation (EU) 2016/679;”  Furthermore, data protection with the use of AI should always be carefully assessed, including if it triggers, for instance, the application of Article 22 (on automated individual decision-making, including profiling) of the General Data Protection Regulation.

12. Nevertheless, in our opinion, the GDPR is flexible enough to address possible privacy and data protection concerns of data subjects while allowing new technologies to be implemented. Of course, special attention should be given to principles such as minimisation, transparency and privacy by design and by default. In addition, and as it flows from above and even from just the general conditions contained within article 35.º of the GDPR[vii], a DPIA will probably be a requirement. Ultimately, if operations are properly prepared from a legal standpoint, it should be possible to implement an AI-enabled drone delivery solution that is fully GDPR-compliant.

13. Lastly, though it may be somewhat delayed as the Commission and other European Institutions put their focus on battling the epidemic, new European rules regulating AI will still come in the future, so keeping an eye open for them is still a good idea.

[i] UAS, as defined in the UAS Regulation, includes the unmanned aircraft and the equipment to control it remotely.

[ii] The European Union Aviation Safety Agency (EASA) released last November Opinion 05/2019 on standard scenarios for UAS operations in the “specific” category butthe relevant draft regulations (that will amend the UAS Regulation and the Commission Implementing Regulation 2019/945/EU) were not approved yet though.

[iii] “UAS operator” means any legal or natural person operating or intending to operate one or more UAS, in accordance with the UAS Regulation.

[iv] “Autonomous operation” means an operation during which an unmanned aircraft operates without the remote pilot being able to intervene.

[v] In fact, for drone delivery to be used in a widespread manner, being AI-based or not, this aspect is crucial.

[vi] According to Annex to EASA Opinion No 01/2020 containing a draft COMMISSION IMPLEMENTING REGULATION (EU) “on a high-level regulatory framework for the U-space”, “«U-space» is the term used in the European Union to refer to the management of traffic for unmanned aircraft. It is meant as a set of services provided in a specific volume of airspace designated by the Member States to manage a large number of UAS operations in a safe an efficient manner”.

[vii] In this scenario we have to take into account that the necessity of a DPIA may arise from data processing relating to the UAS operations, data processing relating to the use of AI or both in combination. “Guidelines on Data Protection Impact Assessment”, WP29, accessed April 13, 2020, Guidelines on Data Protection Impact Assessment; Tiago Sérgio Cabral, AI Regulation in the European Union: Democratic Trends, Current Instruments and Future Initiatives (Master’s thesis: University of Minho, 2019).

Picture credits: DJI inspire… by DFSB DE.