Logo: to the web site of Uppsala University

ChatGPT (an AI language model designed togenerate human-like responses to diverse inputsin the form of prompts) was introduced in late2022 and its use has been steadily increasing ina variety of contexts (academia, medicine andbusiness, among others). While seen as a promisingtool, its functionalities, general availability, andease of use raise significant concerns about howthis specific AI system (and generative AI moregenerally) might impact our society, including oursocial rights and freedom. Accordingly, dierentstakeholders, including professionals in the fieldsof AI, economics, ethics, public policy, the socialsciences and the humanities, and in some caseslay publics are debating whether and how to bestregulate its use.Some policymakers have already taken certainsteps. For instance, the Italian Data ProtectionAuthority (IDPA) temporarily banned the use ofChatGPT in Italy over privacy and use by minorsconcerns at the end of March 2023. OpenAI, thedeveloper of ChatGPT, was accused of not havingconformed with the EU General Data ProtectionRegulation (GDPR), that is with the EU regulation on data protection. OpenAI reacted to this action first by suspending the useof ChatGPT in Italy, then adopting relevant changes which made possible torestore the normal use of the chatbot. Yet the IDPA eventually consideredthose changes not sucient to address all of the contested issues. In fact, itsent a notification of breaches of privacy law to OpenAI at the beginning of2024 accusing it of not having properly handled a number of points, includingpersonal data processing, the risk of ChatGPT ‘hallucinating’ (i.e., providingwrong information), transparency, and use by minors.This controversy between the Italian authority and OpenAI illustrates thatgeneral-purpose AI (GPAI) models, including Large Language Models (LLMs)which inform ChatGPT, are very problematic from a regulatory point of view.Also, the EU AI Act, while not including them in the first proposal, eventuallypaid specific attention to GPAI models.In this chapter, I first describe the issues that according to the IDPA arise fromChatGPT (and generative AI more broadly), including a reference to workconducted by the European Data Protection Board on the same issues. I thendescribe how the EU AI Act covers the issues arising from AI in general andGPAI models in particular; finally, against this background, I reflect on someethical issues emerging from ChatGPT and on their possible impact on theimplementation of AI regulation in Europe, concluding that it is desirable tocomplement the actual regulatory approach with a broader ethical analysis