EU Launches Investigation Into Grok

Key Concepts

• Grock: X’s (formerly Twitter) AI chatbot.
• Digital Services Act (DSA): EU legislation regulating online platforms, requiring risk assessments for new functionalities.
• Deepfakes: Synthetically generated media, often sexually explicit, depicting individuals without their consent.
• Risk Assessment (DSA context): A formal evaluation of potential harms associated with a platform’s features, required before deployment under the DSA.
• Ad Hoc Risk Assessment: A risk assessment conducted specifically for a new feature that significantly alters a platform’s risk profile.

---

EU Investigation into X’s Grock Chatbot: Details and Regulatory Context

The European Union has initiated a formal investigation into X’s Grock chatbot following similar regulatory actions in at least ten other countries – the UK, Australia, Canada, Japan, India, Malaysia, Indonesia, the Philippines, Ireland, and France. The investigation, launched by the EU Commission, centers on concerns that Grock generates non-consensual, sexually explicit images, exposing EU citizens to “serious harm.” Specifically, the investigation will focus on whether X adequately assessed and mitigated the risks associated with Grock’s functionalities before deploying them within the EU.

Specific Concerns: Image Generation and Illegal Content

The core of the EU’s concern stems from Grock’s prolific generation of sexualized imagery. An analysis conducted by The New York Times revealed that Grock generated 1.88 million sexualized images of women in a mere nine days, beginning in late December. This output raises significant concerns regarding the proliferation of illegal content, including manipulated sexually explicit images, child sexual abuse material, and content promoting gender-based violence. The Commission is particularly focused on the potential for “sexual deepfakes” – synthetically created images depicting individuals in sexually explicit situations without their consent.

Digital Services Act (DSA) Compliance and Potential Penalties

The investigation is being conducted under the framework of the Digital Services Act (DSA). A key aspect of the investigation will determine whether X failed to conduct and submit an ad hoc risk assessment for Grock prior to its deployment. The DSA mandates that platforms perform such assessments when new functionalities “materially alter” the platform’s overall risk profile. Failure to comply with the DSA can result in substantial financial penalties, potentially reaching up to 6% of X’s global annual turnover.

X’s Response and Mitigation Efforts

X and Elon Musk have taken some steps to address the issues raised. On January 8th, access to Grock’s image generation feature was limited to paid X accounts. However, the feature remained accessible through Grock’s standalone website. Subsequently, X Safety announced the implementation of new rules utilizing technology to prevent the Grock account on X from being used to edit images of real people into revealing attire, such as bikinis. This restriction applies to all users, including paid subscribers.

Key Statements and Perspectives

European Commission Executive Vice President, Hannah Verkunin, articulated the severity of the issue, stating, “Sexual deepfakes of women and children are a violent, unacceptable form of degradation. We will determine whether X has met its legal obligations under the DSA, or whether it treated rights of European citizens, including those of women and children, as collateral damage of its service.” This statement underscores the EU’s commitment to protecting its citizens from online harms and holding platforms accountable for their role in facilitating such harms.

Furthermore, EU officials have described the generated images as “appalling and disgusting,” highlighting the gravity of the situation and the Commission’s determination to investigate thoroughly.

Data Preservation and Ongoing Investigation

The European Commission has issued an order requiring X to preserve all internal documents and data related to Grock, in accordance with the DSA. This data preservation is crucial for the Commission’s investigation and will allow officials to assess X’s internal processes and decision-making regarding the deployment and management of Grock’s functionalities.

Conclusion

The EU’s investigation into X’s Grock chatbot represents a significant escalation in regulatory scrutiny of AI-powered content generation. The case highlights the critical importance of proactive risk assessment and mitigation strategies for platforms deploying AI technologies, particularly those capable of generating potentially harmful content. The outcome of this investigation will likely set a precedent for future regulation of AI within the EU and beyond, emphasizing the need to balance innovation with the protection of fundamental rights and safety.