  Recent proposals aiming at regulating artificial intelligence (AI) and
automated decision-making (ADM) suggest a particular form of risk regulation,
i.e. a risk-based approach. The most salient example is the Artificial
Intelligence Act (AIA) proposed by the European Commission. The article
addresses challenges for adequate risk regulation that arise primarily from the
specific type of risks involved, i.e. risks to the protection of fundamental
rights and fundamental societal values. They result mainly from the normative
ambiguity of the fundamental rights and societal values in interpreting,
specifying or operationalising them for risk assessments. This is exemplified
for (1) human dignity, (2) informational self-determination, data protection
and privacy, (3) justice and fairness, and (4) the common good. Normative
ambiguities require normative choices, which are distributed among different
actors in the proposed AIA. Particularly critical normative choices are those
of selecting normative conceptions for specifying risks, aggregating and
quantifying risks including the use of metrics, balancing of value conflicts,
setting levels of acceptable risks, and standardisation. To avoid a lack of
democratic legitimacy and legal uncertainty, scientific and political debates
are suggested.
