Local regulations for the use of artificial intelligence in the management of public records – a literature review

Abstract

Purpose

This study investigated the regulatory landscape surrounding artificial intelligence (AI) in the context of e-government development. The purpose of this article is to identify record-keeping challenges, opportunities and weaknesses that emerge from AI loose regulation. The research focuses on Sweden, Finland and South Africa, examining the interplay between existing guidelines, recommendations and legal structures at various levels.

Design/methodology/approach

The research adopted comprehensive systematic and scoping literature reviews, encompassing academic papers, reports and legal documents, along with an analysis of non-academic sources relevant to the study. This methodological approach helped to obtain a deep understanding of the evolving AI regulatory frameworks.

Findings

There is currently limited research that focuses on the impact AI deployment has on the management of critical records in government administrations. Also, the findings reveal that AI regulatory environment varies from country to country. The European Union stands as a noteworthy example of a comprehensive framework for AI governance. In contrast, South Africa, while at its infancy stage, demonstrates potential initiatives and policies at different levels. There is emphasis on the need to focus on co-operation, skills development and uniform regulatory frameworks.

Practical implications

This research holds significant practical implications for policymakers, government bodies and stakeholders involved in AI governance. It emphasizes how crucial it is to incorporate AI alongside a solid records management system. The study advocates for strategic investments in education and skills development to enable individuals to navigate the complexities of AI governance.

Originality/value

This research adds to the existing body of knowledge by providing an examination of AI legislation in e-government in the context of public records management. The analysis helps to review literature and other research materials across different geographical areas. The study explores the distinctive strategies used by Sweden, Finland and South Africa. The recommendations offer policymakers and stakeholders suggestions on how to foster effective AI governance and innovation in the public sector but at the same time manage public records effectively.

Citation

Svärd, P., Guerrero, E., Balogun, T., Saurombe, N., Jacobs, L. and Henttonen, P. (2024), "Local regulations for the use of artificial intelligence in the management of public records – a literature review", Records Management Journal, Vol. 34 No. 2/3, pp. 109-130. https://doi.org/10.1108/RMJ-10-2023-0061

1. Introduction

The objective of this research is to identify record-keeping challenges, opportunities and weaknesses that emerge from AI loose regulation using systematic and scoping literature reviews of AI guidelines and regulations applicable in Sweden, Finland and South Africa. The utilization of artificial intelligence (AI) technologies within the realm of e-government development has garnered increased attention in recent times. Governments worldwide are actively striving to enhance the efficiency and effectiveness of their digital services, thus propelling the prominence of AI. Concurrently, AI holds the potential to usher in transformative opportunities for societies at large (Vinuesa et al., 2020; Bondi et al., 2021; Goralski and Tan, 2020). For example, Gomes de Sousa et al. (2019) conducted a study that underscored the broad deployment of AI, with notable applications spanning public service, economic affairs and environmental protection. Moreover, sectors encompassing education, agriculture, healthcare and manufacturing have embraced AI, thereby ushering in paradigm shifts and competitive advantages (Munn, 2023).

The public sector has seized the opportunity to harness technological advancements, fostering operational efficiencies and delivering superior services to citizens. Mikhaylov et al. (2020) offered insights into AI's potential to revolutionize the public sector through robotics and automation in the UK. However, Mehr et al. (2017) countered this optimism, highlighting the constraints posed by resource limitations and human ingenuity in fully realizing AI's governmental potential. Mehr et al. (2007) issue a cautionary note, emphasizing the need for considerate implementation to avert privacy and ethical pitfalls. This concern is echoed by Munn (2023), who critiques the simplistic ethical guidelines adopted by governments and the technology industry in addressing complex AI challenges. Munn (2023), Giovanola and Tiribelli (2023) and Wiens et al. (2020) argued that data-driven models could perpetuate opacity and bias, thus undermining democratic and egalitarian principles, particularly within welfare and social support systems. Baron and Payne (2017) further illuminated how digital technologies, while aiming to enhance democracy, trust and institutional efficiency, have inadvertently erected barriers to information access and exacerbated vulnerabilities in recordkeeping systems, thereby hampering privacy safeguards and transparency.

Though AI holds promise as a catalyst for advancing the welfare state and enhancing competitiveness, it equally has potential risks (Riksdag, 2019). For instance, AI’s potential to revolutionize e-government development in Africa, enhancing service efficiency, accessibility and effectiveness, is recognized (Blom and Uwizeyimana, 2020; Layton-Matthews and Landsberg, 2022). Yet, the adoption and adaptation of AI across diverse nations and regions varies. As Africa embraces technology, AI's potential to automate tasks, optimize decision-making and customize services is evident. Maximizing AI's utility, mandates proficiency, adept data analysis, robust data preservation capabilities and a digital infrastructure conducive to managing voluminous data sets. Consequently, despite AI’s potential societal benefits, adherence to prevailing legal frameworks governing the management of public records remains paramount (Howarth, 2002; Haries, 2009; Kargbo, 2009; Svärd, 2017). It is a known fact however, that the core values of democracy, particularly transparency and accountability, are rooted in effective recordkeeping protocols (Mnjama and Wamukoya, 2007; Mutula and Wamukoya, 2009).

Motivated by these dynamics, this study investigates the potential impact of AI deployment on recordkeeping and, by extension, public records management. Our endeavor commences with exploring AI's applications within the context of e-government development and the role of regulatory frameworks. This collective insight empowers study participants to identify recordkeeping challenges specifically in Sweden, Finland and South Africa. Subsequent phases comprehensively examine how AI interventions can ameliorate identified recordkeeping obstacles.

Our aim is to discern and address recordkeeping challenges that may influence public records management. Notably, the global drive for e-government development is grounded in the aspiration for high-quality service delivery (Bernhard et al., 2018) and the promotion of transparency, accessibility and efficiency in public administrations (Bekkers and Homburg, 2007). This initiative is poised to enhance administrative cost-effectiveness, propagate democratic values and bolster inclusivity (Bernhard et al., 2018). Furthermore, the realm of e-government development necessitates intricate interplay between government institutions and other societal stakeholders, particularly in developing multifaceted e-services. This complexity surfaces in scenarios involving diverse actors, including private organizations and individuals, as illustrated in the third-generation e-government development. Against a backdrop of perpetual change and disruptive technologies, government administrations face the challenge of evolving recordkeeping norms to align with contemporary demands. Notably, prior research underscores how the advent of New Public Management, focusing on efficiency through private-sector outsourcing, impacted public information management. The inadequacies in contractual formulation led to information management oversights (Svärd, 2019; Klareld, 2016; Mulgan, 2015).

2. Research problem

Within e-government development, governments have started to embrace AI to advance their processes. E-government development refers to the use of communication technologies to deliver quality services to the citizens, to improve the government officers’ skillset and to promote accountability and transparency. The effective management of information is of key importance to this development. Public records are essential for the efficient functioning of government processes and that is what leads to effective and efficient service delivery. Good record-keeping supports good governance (Mnjama and Wamukoya, 2007). Public records (electronic or not) are the official documents that capture the activities, decisions and transactions of public authorities and the interactions they have with the citizens. They provide evidence of the activities undertaken by the government. Hence, they enable transparency, accountability and trust in e-government by allowing citizens to access information, monitor performance and hold officials accountable (Svard, 2014; Kallberg, 2013). In this context, AI-based technologies are expected to be a technological disruptor in the field of public records management and in e-government development in general (United Nations, 2022). AI systems can perform complex tasks, such as image analysis, natural language processing and decision-making, human-made tasks that are common in the public records field (Susar and Aquaro, 2019). However, these systems also raise ethical, legal and social issues, such as privacy, accountability, transparency, fairness and human dignity (European Commission, 2019, 2017). Regulating AI to safeguard lawfulness, fairness and transparency (some of the GDPR principles) is not easy, as it requires balancing the interests of various stakeholders. To date, several guidelines, and recommendations, but few (law-enforced) regulations have been implemented at the national or multilateral level (see Table 2), producing an environment of skepticism among policymakers (Susar and Aquaro, 2019) and public records management practitioners and researchers (Garaba, 2015). Moreover, there is a gap in the AI and public records management literature examining thoroughly (successful/unfortunate) use cases of AI software managing public records, the long-term impact of AI-based software in e-government and the general empirical evaluation of AI-based systems in non-laboratory settings.

To date, potential challenges, opportunities and threats of AI for the public records field have been highlighted loosely in different guidelines which has motivated this study. Under the described background above, we believe that lessons learned from different countries regarding the use (and the perspective of use) of AI-based software for public records need to be identified and shared and this study is the first attempt to establish a comprehensive survey of AI related regulations that reflect heterogeneous values and principles.

Therefore, the study answers the following research question (RQ):

RQ1.

What legal acts or guidelines regulate artificial intelligence mechanisms used in creating digital records for e-government exist in Sweden, Finland and South Africa?

3. Research method

The systematic and scoping literature reviews were adopted to comprehensively explore and synthesize existing literature on local regulations related to the use of AI in public records management in Sweden, Finland and South Africa. Although the systematic review is subject to limitations inherent to secondary data analysis (Wickham, 2019), it was considered appropriate for the study because it serves as a robust framework for systematically examining and synthesizing the local regulations surrounding the utilization of AI in public records within Sweden, Finland and South Africa. By identifying key regulatory trends and gaps, this study contributes to a comprehensive understanding of this domain's legal and policy landscape. The scoping literature review enabled us to access gray literature.

Therefore, the well-established review process introduced by Kitchenham and Brereton (2013) was adopted for the study. The five steps indicated in the study guided the study as follows:

1. Definition of keywords based on the research questions.

2. Definition of the selection/rejection papers criteria.

3. Database tests and keyword adjustment.

4. Data extraction from databases.

5. Data screening.

Details about the application of the process introduced by Kitchenham and Brereton (2013), the procedure and the tools used during the review are presented as follows:

3.1 Definition of keywords

We focused on the main research question: What legal acts or guidelines regulate AI mechanisms used in creating public records for e-government exist in Sweden, Finland and South Africa to define and adjust related keywords. Databases like Scopus, Web of Science, ACM, Emerald were consulted for the study. Based on the RQ, we defined a general set of keywords that we used in academic databases: KEY1: (rule* OR guideline*) AND (“artificial intelligence” OR AI) AND (record* OR archive*) AND (“e-government” OR “electronic government”) AND (Sweden OR Finland OR “South Africa”). For instance, we used the following keywords to retrieve relevant materials from Scopus: ALL (record* OR archive*) AND ALL (recommend* OR guideline* OR rule* OR legisl*) AND ALL (“artificial intelligence” OR ai) AND ALL (“e-government” OR “electronic government”) AND ALL (Sweden OR Finland OR “South Africa”).

However, due to the peculiarities of each academic database, some had different methods for adding queries. In some cases, the original wording differed from others, producing different outputs.

3.2 Criteria for selection and rejection of papers

We established four criteria for selecting and rejecting papers:

1. The year of publication, which was between 2012-2023;

2. Articles written in English language;

3. Accept only peer-reviewed papers; and

4. Articles with mature results, no workshop, short papers or blue-sky papers. Note that these criteria are general for gathering articles.

3.3 Manual addition of documents/articles

Given the nature of the review, it was assumed that the number of publications on this specific subject could be lower than other types of systematic reviews, therefore, using the scoping review, more gray literature was added such as documents created and published by governments or multilateral organizations, legal acts, guidelines and recommendations to our review, after the systematic process.

3.3.1 Search strategy at the national level.

We started by searching the official documents that the three countries have published in multilateral organizations and finding the national institutions in charge of such publications. We followed the Organization for Economic Cooperation and Developments (OECD) AI Policy Observatory where such recommendations can be sourced. Then, given that some policies were not registered in the OECD.AI web portal, we searched manually governmental and state-related organizations web portals for Finland, South Africa and Sweden. Table 1 lists the official government agencies in Sweden, Finland and South Africa that produce and publish AI-related regulations, guidelines, recommendations and standards, which were used for the manual search in the literature review.

3.3.2 Search strategy for multilateral organizations.

Given that Finland and Sweden are covered by regulations published by the European Union (European Commission), we searched current guidelines and regulations in web portals connected with the European Commission. We also searched for multilateral organizations from a global perspective that have published such recommendations, (technical) standardization organizations and organizations in charge of seeking and documenting AI-related recommendations and guidelines. Table 2 presents the list of sources where we manually found additional guidelines, recommendations and regulations for this paper.

3.4 Data extraction from databases

We used four academic databases to evaluate the suggested keywords. We found 484 potential papers, as is presented in Table 3.

3.5 Review transparency

The extraction of the papers was made using RIS format in Scopus, Emerald and Web of Science, but ACM used Endnote format. We collected data using Zotero reference manager (desktop and Web client tool), creating a public access list of the potential references, which is available in the following URL: www.zotero.org/groups/4716211/interparesse-fi-sa/items

3.6 Data screening

Given the size and the heterogeneous nature of the potential papers, we decided to use an automated screening tool called ASReview that uses Machine Learning mechanisms for (pre)screening papers (Van De Schoot et al., 2021), whether they were related or not to RQ. ASReview uses active learning to categorize related papers, then, the process to make our review using the ASReview screening was as follows:

• Create a local ASReview project.

• Import data from Zotero (the 484 papers).

• Set prior knowledge based on relevant/irrelevant papers.

• Select the feature extraction technique and classifier.

• Generate the screening.

Following this data screening process, we selected 15 papers related to the research question, as presented in Figure 1. Additional documentation such as governmental and international regulations were not counted in this process.

3.7 Findings from academic sources

We selected 15 academic articles that were published between 2018–2022 following the systematic literature review procedure. From the 15 papers, the article by Borglund and Engvall (2014) provided grounded definitions regarding the discourse context where archives, records and information are used, sometimes simultaneously as in many guidelines and recommendations for the use of AI systems, for example, in the Swedish proposal for regulation on AI (Regeringen, 2021). Figure 2(a)–(b) highlights the type of articles analyzed in the review process and the percentage of published materials included in the study.

4. Results

In the following, we summarize the general findings of our review, based on the academic sources and the information gathered from the multilateral institutional and organizations web portals.

4.1 General findings

Ranerup and Henriksen (2022) presented a study on the introduction of Robotic Process Automation (RPA) in a Swedish municipality. RPA is being introduced by technology suppliers, legislators and administrative agencies. In Sweden, it has been applied to social services. The focus of their study was on the lack of digital discretion in automated decision-making in social services combined with values of efficiency, effectiveness, standardization and service delivery. They argued that RPA has changed the understanding of decision-making in the public sector but confirmed that digitalization has had a positive effect on the civil servants’ discretionary practices. They, however, argued that the automated decision-making processes needed to be simplified to enhance a better understanding of the complexities behind them. This required critical thinking about the algorithms and the sociotechnical aspects of human and non-human actors and their agency. This was in regard to their ethical, democratic and professional values because of the fair and uniform decision-making (Ranerup and Henriksen, 2022). In Anastasiadou et al. (2021), a panel of information systems (IS) experts highlighted the AI capabilities and their possibilities to further involve citizens in governmental projects. These experts claimed that IS and interoperability technologies constitute one of the most fundamental technologies together with AI in implementing e-government solutions. The Anastasiadou et al. (2021) paper highlighted the importance of AI-related technologies in solving challenges of current democracies, specifying functional relationships between specific technology and democratic outcomes.

Three papers from the 15 selected papers (Criado and Gil-Garcia, 2019; Scholl, 2020; Handzic, 2003) presented theoretical or conceptual reviews or positions regarding the use of (electronic) records in support of e-government or “digital government” as is named in Scholl (2020). Criado and Gil-Garcia (2019) illustrated a continuous process of change in public value generation over time, because of the different public management paradigms, but also different types of technologies (including AI). In this paper, the notion of “smart governance” was also highlighted, denoting a next level of governance using AI-based systems. Similarly, in Scholl (2020), it was foreseen that the future of digital government will be “smart” covering cities, government and governance using AI-related approaches such as Machine Learning and Internet of Things, among others. Scholl (2020) highlighted some negative potential scenarios of the misuse of some technologies in government, which the author called the “Dark Digital Government” and presented examples of such dark patterns from specific countries. Wen and Hwang (2019) highlighted the potential links between an index of open government data and five country characteristics, capability, national competitiveness, corruption perception, economics and resource competition. Their findings were in line with the results presented by the UNESCO in the 2022 report about e-government development in United Nations (2022).

In our review, we found six articles presenting specific frameworks, technical platforms and lessons learned from South Korea, Turkey, Australia, China, Indonesia and Greece. Papadopoulos and Charalabidis (2021) presented the structure of the Greek AI strategy highlighting the needs expressed in the European Commission’s report (see European Commission, 2021a), where the authors expressed that an expert with a technological profile and background developed such strategy as reflected in the general techno-optimistic approach of the text, in comparison to most of the recommendations and guidelines that shed light on the potential negative impact of AI.

A case of the strategies of open government data in Indonesia is presented in Parung et al. (2018), where five barriers were found, namely, legal and privacy, government culture, social, technical and economic as key for the lag of the Indonesian government in its open government development. In Mao et al. (2022), a complex technological-based framework was presented as a platform for enhancing the Chinese open government strategy, where AI-based mechanisms are used and empirical results from different tests were presented. In Iskender and Özkan (2013), a methodology to assess the e-government transformation success is presented for the Turkish case, which was based on a survey to collect data from different stakeholders about political and legal bases, institutional information, social and technical/technological capabilities. Yoon et al. (2018) presented the challenges that the South Korean government need to improve its e-government lag. The authors recommended improvements in the technologies use legislation.

Finally, from our survey, we found four papers (Konashevych, 2020; Meijer and Ubacht, 2018; Rana et al., 2022; Saxena et al., 2022) that focused on the use of Blockchain technology to improve the public sector for e-government. In general, these papers presented a technical proposal for the use of specific Blockchain-based technology to improve Reliance, Trust and Control (Meijer and Ubacht, 2018), enhance public peer-to-peer database communications (Konashevych, 2020) and ensure that e-government services are “secure by design” (Saxena et al., 2022). Additionally, the paper by Rana et al. (2022) highlighted 16 challenges that this technology has for a successful application in open data contexts and they are as follows: 1. Scalability; 2. Privacy; 3. Security; 4. Regulatory compliance; 5. Lack of adequate skills; 6. Initial cost; 7. Integration with legacy system; 8. Legal issues; 9. Lack of standards; 10. Lack of validation; 11. Lack of understanding and knowledge; 12. Reluctance to use blockchain technology; 13. Ethical issues; 14. Latency cost; 15. Flexibility; and 16. Adoption of blockchain in the public sector.

4.2 Findings from non-academic, manually obtained sources

Based on the scoping literature review, we also present findings from non-academic articles, that is, information obtained from Web portals at national, and multilateral organizations and institutions, several guidelines, recommendations, views and law-based regulations that were in connection with the use of AI and public records. In the following section, we summarize the findings.

4.2.1 Artificial intelligence regulation, recommendations and guidelines.

In our review, we found that guidelines and legal frameworks (e.g. laws, acts, rules, etc.) for using specific AI software applied to e-government are a concern at every level national, regional and multilateral. A key finding of this survey is the differentiation between guidelines, recommendations and legal frameworks. Guidelines and recommendations for the use of AI (see for example Table 2), define codes of conduct for AI designers/developers, inclusive of users with no mandatory commitment, however the guidelines scope usually is broader than national or regional laws. On the other hand, laws and their proposals require higher specifications than guidelines. In the following, we specify our review findings considering guidelines and regulations at the European level (general), and for Sweden, Finland and South Africa.

4.2.2 European level guidelines.

At the European level, the European Commission has focused on the “Ethics Guidelines for Trustworthy AI” (European Commission, 2019), and they further introduced a law-proposal in 2021 for the regulation of the European Parliament and of the council laying down harmonized rules on AI and amending certain union legislative acts. Such a set of proposed rules were called The AI Act or AI Act (European Commission, 2021a), which evolved from a set of policy options called the White Papers in 2017 (European Commission, 2017), with the following specific objectives:

• Ensure that AI systems placed on the European Union’s market and used are safe and respect existing laws on fundamental rights and Union values.

• Ensure legal certainty to facilitate investment and innovation in AI.

• Enhance governance and effective enforcement of existing laws on fundamental rights and safety requirements applicable to AI systems.

Facilitate the development of a single market for lawful, safe and trustworthy AI applications and prevent market fragmentation.

Such proposed regulations through the AI Act create a consistent framework together with the EU Charter of Fundamental Rights (European Commission, 2012a, 2012b) and the existing secondary Union legislation on data protection, consumer protection, non-discrimination and gender equality. The proposal is without prejudice and complements the General Data Protection Regulation (GDPR) (European Commission, 2018).

We found that there exists a joint commitment between the EU Commission, member states such as Switzerland and countries outside the EU such as, Norway, to coordinate plans on AI regulations, published in 2018 (European Commission, 2019). We also found that in 2021, a reviewed report named “Coordinated Plan on Artificial Intelligence” (European Commission, 2021b) was published with a threefold aim:

1. To accelerate investments in AI technologies to drive resilient economic and social recovery aided by the uptake of new digital solutions.

2. To act on AI strategies and programs by fully and timely implementing them to ensure that the EU benefits from first-mover adopter advantages.

3. To align AI policy to remove fragmentation and address global challenges.

However, to fulfill the above aims, the European Commission established three horizontal expert groups:

1. High-Level Expert Group on AI which focused on the ethical implications of AI for policymaking, having as main deliverables the following guidelines: Ethics guidelines for trustworthy AI (European Commission, 2019); Policy and investment recommendations for trustworthy AI; and An Assessment List for Trustworthy AI (ALTAI) (European Commission, 2020).

2. High-Level Expert Group on the Impact of the Digital Transformation on EU Labor Markets, responsible for investigating recommendations for short-, medium- and long-term businesses policies considering the current digital transformation of the labor (work). The main output of this expert group was a report summarizing their findings.

3. Expert Group on Liability and New Technologies, responsible for publishing a report on liability for AI and other emerging digital technologies.

In Table 4 we present the status of every national strategy that has been published to date on the European Union portals. Please, note that this is a subset of information that every country of the European Union shares in different languages.

4.2.3 Swedish regulations and guidelines.

In 2012, the Swedish government created a digitalization committee with a directive to ensure that the IT political goals are achieved. This directive was prolonged to 2016 and the extra year was to enable the committee to consolidate the knowledge generated on the digitalization effects on the society and the individual but also in support of the government’s work on the digitalization promoting issues. We also found that in 2020 the Swedish government published a “Proposal for a Regulation laying down harmonized rules on artificial intelligence (artificial intelligence act) and amending certain union legislative acts” (European Commission, 2021a) and which aligns with the AI Act with specific updates in the Swedish legislation context. In this proposal, a risk-based assessment approach was adopted with the aim of creating a structured separation between different types of AI systems and their use where some were prohibited, others allowed but with restrictions and requirements in the form of, inter alia, supervision and registration with the responsible authority (Regeringen, 2021). The idea was meant to allow for the unrestricted use of any AI systems that pose no risk or little risk. There is also a proposal to introduce a “system of market surveillance and compliance through public bodies at both national and EU level”, which adopts the CE marking from the European Union.

Additionally, we found that a private and public organization called “AI Sweden” published a White book on AI in 2022 (Fryden et al., 2022) that provided a plan on how an organization should benefit from and work with AI.

4.2.4 Finnish regulations and guidelines.

In our review, we found that Finland was one of the first countries in the European Union to create a national AI strategy in 2017 (see Table 4). The strategy was published in 2017 and titled “Finland’s Age of Artificial Intelligence”. The strategy envisioned that in five years AI would be an active part of every Finn’s daily life and Finland would make use of AI boldly in all areas of society and be a safe and democratic society that produces the world’s best services in the age of AI. One of the areas transformed would be the public sector to make use of the possibilities offered by AI in its own activities and to effectively produce high-quality public services (Steering Group of the Artificial Intelligence Programme, 2017, pp. 15–16). Especially public health care sector and care for elderly need solutions because of the rapidly aging Finnish population (Steering Group of the Artificial Intelligence Programme, 2017, pp. 24, 31).

In 2021, the Artificial Intelligence 4.0 program report (see Table 4) was published presenting an action plan that implements the strategy of green and digital recovery following the COVID-19 crisis and responds to Finland’s specific challenges related to digitalization, such as the relatively low level of digital investment, slow reform of value creation among SMEs and delays in strategic investments to promote the fourth industrial revolution (4IR) in Finland. The Artificial Intelligence 4.0 program is an integrative roadmap to create an environment enabling the private and public sectors to be aware, assist and integrate AI mechanisms in chain of services or/and products. In this sense, one of the outcomes of the Artificial Intelligence 4.0 program, is the introduction of the Artificial Intelligence Index that is a self-assessment tool for companies, considering four levels of integration of AI technologies as follows: Level 1: AI awareness; Level 2: Assisting AI; Level 3: Integrated AI; and Level 4: AI part of the identity, which assess key factors such as Information, Technology, Internally, Products and Services, Competence and AI as resource.

In February 2023, a new decree regulating automated public sector decision-making was enacted (Valtiovarainministeriö, 2023), and older legislation updated to enable AI solutions of the third category. The new legislation poses stringent regulatory requirements for automated decision-making in the administration.

4.2.5 South African regulations and guidelines.

We found that there was no single and unified regulation for the use of AI-related software in Africa on the Web portal of the African Union. However, there were some efforts to develop AI governance policies and regulations in Africa. According to a 2022 report by ALT Advisory (Davis et al., 2022), a South African-based law firm that specializes in technology and human rights, there are currently 55 African countries with AI policies or regulations. The report also highlighted that there was a need for more comprehensive AI governance policies and regulations in Africa. In addition, the OECD has called for African countries to develop their own AI strategies to help tackle economic problems (Candelon, 2022). The OECD also suggested that African countries should focus on developing AI solutions that address local challenges such as agriculture and remote health. At the national level, the South African government published the “Protection of Personal Information Act 4 of 2013” (South African Government, 2013), with different aims including AI-related mechanisms:

• Promote the protection of personal information processed by public and private bodies.

• Introduce certain conditions to establish minimum requirements for the processing of personal information.

• Provide for the rights of persons regarding unsolicited electronic communications and automated decision-making, among others.

The South African Government acknowledged the potential use of data and its automation in the report “The Fourth Industrial Revolution” (South African Government, 2020). We also found that the South African Government published the South African National Policy on Data and Cloud (South African Government, 2021), that aims to integrate public and private data in a single data platform. In that policy, certain regulations and considerations were added for the use of data and its automation.

5. Discussion

5.1 Sweden, artificial intelligence, digitalization and e-government

Based on the results of our review, Sweden’s stand on AI was that it should be regulated in a manner that respected values of democracy, privacy, inclusiveness but at the same time enabled innovation, competitiveness and sustainable development that would improve all European’s quality of life. AI as a technology has already been practically applied in areas of Internet platforms development, information retrieval, image recognition and automated translation. It was therefore seen as a technology that would improve the quality of services delivered by the public sector, but also contributed to efficiency (Vinnova, 2018).

Digitalization and the development of new technologies should be tools for achieving a more competitive, inclusive, secure and sustainable Europe. It was important that society had confidence in new technology and therefore the Swedish government supported the development of rules that aimed to increase transparency and promote compliance (Regeringen, 2021). Harmonizing AI rules within the EU was meant to strengthen the competitiveness and functioning of the internal market, avoid fragmentation of the internal market, protect health, safety and fundamental rights, promote the positive aspects of AI and ensure free movement of AI systems. An area that was highlighted in this development was the role of data in promoting an understanding of the people, the society and the environment. Data offered possibilities and challenges to individuals, organizations and the public sector. A lot of data was being generated by individuals and organizations through digital footprints. This data was claimed to have innovation and knowledge generating potential. The increased access to and use of data also posed challenges that required regulation and policy. A data-driven society further posed challenges of the protection of the data, the integrity of individuals, issues of participation and equality. Big data and algorithms offered innovative potential and competitive advantages. Algorithms facilitated decision-making processes and data driven innovation increased growth. The areas that would be improved through data analysis included transport, health, agriculture, the military and the welfare to mention but a few. Within the European Union (EU) a data-driven economy requires regulations in the areas of interoperability, data protection, security and copyright protection. This was also feared to have a negative impact on organizations that had the potential to use data-based analyses (Regeringen, 2016).

5.2 Finland, artificial intelligence, digitalization and e-government

The national AI strategy noted that there are ethical questions that need public discussion (Steering Group of the Artificial Intelligence Programme, 2017, p. 59). While at the time there was no AI specific Finnish legislation, and it was said that AI has not created new requirements for actions taken by the authorities. The same requirements apply as before and that, the need to follow principles of good administration and GDPR, need for legality, legal protection, equality, data protection and principle of publicity, and to make sure that officials bear responsibility for the legality of their actions (Paasikivi et al., 2022, pp. 14, 18, 20). A key measure was to encourage companies and public-sector actors to introduce ethical self-regulation and to share best practices (Leading the Way, 2019, p. 14). It was noted in the report of The Finnish Innovation Fund, SITRA (Paasikivi et al., 2022) that public services and other factual administrative conduct appear to be a particularly suitable area for using AI. Broader use of AI appeared pertinent also in the internal processes of public authorities, especially in data management and processing, for example as a tool for document management, natural language recognition and for producing and searching information. The report classified public sector usage of AI in four categories according to influence on people’s rights and degree of AI autonomy (Paasikivi et al., 2022, p. 51):

In the first category both influence, and degree of AI autonomy were minimal and, thus, there was no need for limitations of AI (e.g. creation of visualizations, prediction of resource needs, supervision of infrastructure). One may advocate unrestricted use of AI technology. The second category (e.g. giving guidance, producing public services) posed no problems if principles of good administration, information governance and data security were followed. The third category included routine tasks which involved limited decision-making. The problem here was that exercise of power by public authority must always have a legal basis, which decision-making systems working independently or semi independently do not have. In such cases, utilization of AI in the decision-making process must be supported by legislation. In the last category, decision-making was intrusive from the perspective of individuals. Thus, it required broad deliberation. In this category, using AI conflicts with constitutional requirements for public authority and, therefore, it was not possible.

In our review, we found that public agencies had implemented AI solutions that belonged to the aforementioned third category and whose legality had been consequently questioned by legality supervisors. These included automated decision-making systems of the Finnish Tax Administration and Social Insurance Institution of Finland (Kela). In automated decision-making, the Finnish Tax Administration and Kela have been forerunners. Also, the Finnish Immigration Service had taken steps to automatize its decision-making processes (European Union, 2022). Besides legal basis and responsibility for the decisions also other aspects needed attention. People must be able to rely on the trustworthiness and permanence of the decisions. If AI was used in decision-making, special care was to be taken to ensure that hearing and investigation processes were sufficient and appropriate, and grounds for the decision were transparent and understandable. Although there was no legal obligation for it, people were to be informed about usage of AI in the process (Paasikivi et al., 2022, pp. 24–26). Our review showed that in the recent published regulation of automated public sector (see Valtiovarainministeriö, 2023), automated decision-making was possible in Finland only if the case could be resolved without case-by-case consideration, there were human-formulated rules that defined how the resolution was reached, the natural person concerned was informed about the automated decision-making procedure and may be applied for a rectifying procedure. The goal of the new regulation was to guarantee that the process in which automated decision-making was applied was transparent to the citizen, that there were quality controls in place, clear distribution of responsibilities and explicit rules of decision-making that confirmed legal requirements. The new legislation was technology neutral: it specifically targets AI technology, defined what AI was and what was not, or included some technology in its sphere while excluding others (Oikeusministeriö, 2022). In practice, the new legislation prohibited use of AI technology as a “black box” in decision-making. There had to be documented rules that described how a resolution was reached from the inputs, and named officials who bore responsibility for the decisions and who were able to identify errors in the process. Machine learning solutions were unlikely to fill these criteria (Oikeusministeriö, 2022).

SITRA’s report (2022) recognized the need for publicity and transparency in connection with AI. The report highlighted transparency of AI usage in public administration. It also discussed possibilities for making the AI itself transparent by granting public access to its source code (Paasikivi et al., 2022). The report notes that long term preservation is a challenge but did not explicitly state the nature of this challenge. In the latest legislation, the approach was different: transparency did not come from access to source code but from rule-based automation that was documented. There always had to be a person (or a body) who accepted the automated decision and checked its legality. Minimum retention time for the related records was five years after the completion of the process.

5.3 South Africa, artificial intelligence and e-government

Although the African Union has called for structured regulation of AI to manage the benefits of the technology for Africans and to foresee and curb the risks (Effoduh, 2022), African countries are still in the early stages of such policy development and implementation. The South African government has acknowledged the need for AI regulation in Africa (South African Government, 2020). Although there is no specific legislation dealing with AI and its possible legal issues in South Africa yet (Snyders, 2022; Singh, 2020; Roux, 2020), the country has several legislative and regulatory guidelines that inform e-government development and the use of AI technologies. For example, the Protection of Personal Information Act 4 of 2013 and the Electronic Communications and Transactions Act 25 of 2002 provide guidelines toward the automation of information access and use through technological advances (Snyders, 2022). Also, the South African National Policy on Data and Cloud also aims to integrate public and private data in a single data platform to enhance government planning and enable AI (DCDT, 2021; Plantinga, 2022). Such legislation provides a legal and regulatory framework for using AI technologies and managing records in South Africa's e-government development. The legislation aims to ensure the responsible use of AI, protect personal information and support the management and preservation of records in the public sector. Also, it is important to note that South Africa is currently working on a draft policy on AI informed by different legislative guidelines (South African Government, 2020).

Also, the South African government has an integrated national strategy to deal with AI regulation. A Presidential Commission on the 4IR implementation has been set up with the aim to coordinate the development of South Africa’s national response action plan to deal with the 4IR. As part of this effort, the Commission is responsible for identifying policies, strategies and plans that are needed to position South Africa as a leading country in the evolution and development of the 4IR (South African Government, 2021). However, the exclusion of records management specialists from the Commission poses a threat to the systematic implementation of an integrated national strategy to respond to the 4IR (Netshakhuma, 2021). AI Legislation and policymaking are seen as critical to the success of AI adoption (Brand, 2022; Gwagwa et al., 2020). The legislation should not only serve the purpose of providing a legal framework for the responsible use of AI in government, but it could also be an enabler to improve the quality of public services.

6. Conclusions

The objective of this paper was to identify record-keeping challenges, opportunities and weaknesses that emerge from AI loose regulation using systematic and scoping literature reviews of AI guidelines and regulations applicable in Sweden, Finland and South Africa. We did this by responding to the question whether legal acts or guidelines regulate AI mechanisms used in creating digital records for e-government. Our findings, therefore, have a twofold reading, first, in general, establish that the current guidelines and recommendations at national level in Sweden, Finland and South Africa do not yet have a “strong coupling” with the legal systems due to lack of a specification of what type of technologies are valid to use or not to use toward the management of public records. In fact, all the reviewed AI regulations/legislation did not mention the management of public records. What was mentioned is the management of data and its potential to boost innovation. We however argue, that even if public records are now part of the open data developments, there is need to effectively manage records that are behind the creation of opaque algorithms and automatic decision-making processes. AI regulations do not mention public records despite the challenges that might arise out of AI deployment amidst e-government development and the automation of government processes. There are, however, ongoing opportunities for improving this situation led by the European Commission which has embedded regulations in the normativity of every European Union country. This is a promising step that is being followed by different nations including South Africa and the African Union in general. Second, the advance or lag in regulations of AI may indicate underlying issues of each country. Despite the risks that automated decision-making and the dependency on algorithms, there is a lack of mention of public records in AI legislations. This is an indication that there is currently limited research that focuses on the impact AI deployment has on the management of critical records in government administrations.

In summary, we found that the European framework for AI regulation with four levels of risk in AI: unacceptable, high, limited and minimal, setting clear requirements and obligations for AI systems, providers and users, as well as a governance structure at European and national level was the most advanced and integrative normativity to date. Africa, on the other hand, does not have for now a unified or harmonized approach to AI regulation. Instead, there are different initiatives and policies at the national, regional and continental level that aim to foster the development and governance of AI in Africa. According to a recent study (Daigle, 2021), only 14 out of 55 African countries had data protection legislation that addressed automated decision-making, which is a key aspect of AI. There is a clear imbalance between South Africa and European countries like Finland and Sweden regarding joint regulation of the use of AI-related technologies in the public sector. This is not a surprising finding. We found that despite the lack of legal regulation, most of African countries, specifically South Africa, acknowledge the opportunities that such technology may have in their economies. Based on OECD.AI data, we found that venture capital investing in AI is one of the measurements that make a difference between Sweden compared to South Africa and Finland jointly. We acknowledge that these results obtained from the OECD.AI data need further interpretation and analysis from the perspective of regulations of every country.

Another perspective from a combined vision of these three countries can be found in the opportunities that offered education and the generation of AI skills, that every national and multilateral organization has promoted. In fact, using the OECD.AI data, we found that there are several opportunities for South Africa, Sweden and Finland to cooperate for improving AI skills development, given that globally, the number of AI-skilled people in these three countries is small compared with other countries.

7. Recommendations

Based on the findings of this study, we recommend a targeted strategy for further research and policy development, and this should prioritize the significance of robust records management in conjunction with the deployment of AI technologies. It is important to encourage collaborative initiatives between countries in Europe and Africa to foster skills development, knowledge exchange and dissemination of best practices in AI governance.

We also recommend the creation of unified AI regulatory frameworks for African nations, using the basic model provided by the European Union. The creation of comprehensive legislation that covers data protection, automated decision-making and ethical issues should be prioritized. In addition, it is crucial to invest in education, training and skills development to establish a skilled AI talent pool. This investment will assist in empowering people with the skills needed to successfully manage the difficulties associated with AI governance and innovation.

Furthermore, it is important to use data on regulatory advancements or setbacks as indicators of the success of public policies. To ensure that AI governance adheres to societal norms and expectations, these metrics should act as guiding principles for evidence-based improvements to policymaking.

Thus, this paper provides insightful points of view on AI legislation in the management of public records, providing a crucial framework for ongoing scholarly endeavors and policy discussions. Stakeholders establish the foundation for a future in which AI is wisely used to improve public services, maintain democratic ideals and advance sustainable development by adopting these proposals.

Figures

Figure 1.

Screening and selection process of the review

Figure 2.

General results of the search and screening phases

Table 1.

Organizations and institutions producing and publishing AI-related regulations, guidelines, recommendations and standards, used for the manual search of the literature review

Finland Eduskunta Parliament of Finland https://eduskunta.fi/

Valtioneuvoston yhteinen julkaisuarkisto Valto The Government’s joint publication archive Valto https://julkaisut.valtioneuvosto.fi/

Tÿo- ja elinkeinoministerïo The Ministry of Economic Affairs and Employment portal https://tem.fi/etusivu

Finlex Data Bank Online database of legislative and other judicial information) www.finlex.fi/

South Africa South African Government portal www.gov.za/

Sweden Regeringskansliet Website of the Government and the Government Offices www.regeringen.se/

Source: Table by authors

Table 2.

Organizations and institutions producing and collecting AI-related regulations, guidelines, recommendations and standards, used for the manual search of the literature review

Organization/institution
Organisation for Economic Co-operation and Development (OECD) www.oecd.org/
OECD AI Policy Observatory (OECD.AI) https://oecd.ai/
International Organization for Standardization (ISO) www.iso.org/
European Telecommunications Standards Institute (ETSI) www.etsi.org/
The International Telecommunication Union (ITU) www.itu.int/
The United Nations Educational, Scientific and Cultural Organization (UNESCO) www.unesco.org/
African Union https://au.int/
European Union https://europa.eu/
AI Standards Hub https://aistandardshub.org/

Source: Table by authors

Table 3.

Academic databases used, and potential papers in our review

Database	No. of potential papers
ACM Digital	139
Emerald Insight	343
Scopus	1
Web of Science	1
Total	484

Source: Table by authors

Table 4.

National strategies of Sweden and Finland that are published in the European Commission portal

Finland Finnish strategy for AI (2017) (Finnish Government, 2017 ) AI 4.0 Report (2020)

Sweden Artificial Intelligence Decree, 2020/21:FPM 109 (2021) (Regeringskansliet, 2020)

Source: Table by authors