English

Law and computer science meet because software now governs much of social life, and society governs through law. As computation has spread into every domain — communication, commerce, employment, healthcare, criminal justice, the basic infrastructure of daily life — the systems that computer scientists build have become objects of legal and political concern, and the law has had to grapple with technologies it was not designed for. The relationship is characteristically tense, because the two fields move at different speeds and reason in different ways: technology changes fast and reasons about what is possible, while law changes slowly and reasons about what is permissible, and the gap between them is where many of the hardest problems at this boundary live. The law is perpetually catching up to technologies that have already reshaped the world by the time it arrives.

The relationship is also bidirectional in a way that is easy to miss. Law shapes technology — privacy regulations constrain what data systems may collect, intellectual property law determines what can be built on what, liability rules influence what gets deployed. But technology also shapes law, and more deeply than the law sometimes recognizes: the architecture of systems determines what is possible, and what is possible constrains what law can effectively require. Lawrence Lessig’s formulation — “code is law” — captures the insight that the design of technical systems regulates behavior as powerfully as legal rules do, and sometimes more so, because the code determines what can be done while the law only determines what is permitted. The technical architecture is a form of regulation, and the people who design it are, whether they intend to be or not, making policy.

This section examines the relationship through three domains where it is most consequential: privacy (where technical and legal conceptions of a fundamental value interact), intellectual property (where law struggles to fit software and now AI into frameworks designed for other things), and algorithmic accountability (where the use of algorithms in consequential decisions raises new demands for transparency, fairness, and recourse). It connects to security and cryptography (§4.5), to the societal dimensions of AI (§5.7), and to the professional ethics of §8.9, and it engages law and policy that are outside this guide’s scope but whose relationship to computation is the subject.

Background: Security and cryptography (§4.5), AI safety and societal impact (§5.7), and professional practice (§8.9) provide the technical and professional context; law, policy, and ethics supply the institutional one.

The Relationship: Code, Law, and the Governance of Computation

Privacy is the domain where the technical and legal conceptions of a value interact most intricately, because privacy is simultaneously a technical property (what a system reveals or protects) and a legal right (what the law permits and forbids), and the two conceptions do not align cleanly. Understanding privacy requires holding both, and the relationship between them is where the difficulty lies.

The legal conception of privacy developed long before computation and has struggled to adapt to it. The foundational articulation — Warren and Brandeis’s “The Right to Privacy” (1890), prompted by the new technology of the portable camera — defined privacy as “the right to be let alone,” a framing oriented toward intrusion. But computational privacy is not primarily about intrusion; it is about data — its collection, aggregation, inference, and use — and the legal frameworks have had to evolve toward a data-centric conception. The result is a patchwork: comprehensive data-protection regimes (the EU’s GDPR, the most influential, with its principles of consent, purpose limitation, data minimization, and the rights to access and erasure), sectoral rules (health, finance, children), and a fragmented landscape that varies enormously by jurisdiction. The law is reasoning about a value it has long recognized, applied to technologies that create privacy problems the older conceptions did not anticipate.

The technical conception of privacy is different and in some ways more advanced: computer science has developed precise, mathematical notions of privacy that the law’s looser concepts lack. Differential privacy (Dwork and others, 2006) is the landmark: a mathematical definition of what it means for a data analysis to protect individual privacy, guaranteeing that the output reveals almost nothing about any individual, with a precise, tunable parameter quantifying the privacy guarantee. Differential privacy provides what the legal conception cannot — a rigorous, provable guarantee — and it has been deployed at scale (by the US Census, by major technology companies). Other technical privacy tools — secure multiparty computation (computing on data without revealing it), homomorphic encryption (computing on encrypted data), federated learning (training models without centralizing data) — give technical means to achieve privacy goals that the law can only mandate in the abstract. The technical conception offers precision and provable guarantees; the legal conception offers enforceable rights and social legitimacy; and the relationship between them — how legal requirements map onto technical mechanisms, how technical capabilities should inform legal standards — is an active and consequential frontier.

The tension between the conceptions is real. The law’s consent-based model (privacy is protected if the user consented to the data use) sits awkwardly with the technical reality that meaningful consent is nearly impossible at the scale and complexity of modern data systems — no one reads or understands the privacy policies they accept, and the inferences that can be drawn from data far exceed what any consent could meaningfully cover. The law’s notion of personally identifiable information sits awkwardly with the technical reality that anonymization is far harder than it appears (re-identification of supposedly anonymous data is a recurring demonstration) and that data not identifying on its own becomes identifying in combination. The gap between what the law assumes about data and what is technically true about data is a source of ineffective regulation, and closing it requires the legal and technical conceptions to inform each other — which is the relationship at its most necessary.

Intellectual Property: Old Frameworks for New Objects

Intellectual property law — copyright, patents, trade secrets — was designed for a world of physical goods, creative works, and mechanical inventions, and fitting software into it has been a decades-long struggle that the rise of AI has now reopened in acute form. The relationship here is one of law straining to apply frameworks designed for other things to objects that do not fit them well.

Software itself was hard to place. Is a program a creative work (protected by copyright, like a book) or a functional invention (protected by patents, like a machine)? The law settled, awkwardly, on both: software is copyrightable (the expression, the specific code) and potentially patentable (the underlying methods, in jurisdictions and forms that have shifted repeatedly), and the boundary between the copyrightable expression and the unprotectable idea or function has generated enormous litigation. The fit is imperfect because software is genuinely a new kind of object — functional like a machine but written like a text, copyable at zero cost like information but engineered like a product — and the existing categories were not designed for it. The open-source movement emerged partly as a response, using copyright law ingeniously against its grain (copyleft licenses use the copyright in software to require that derivatives remain open, turning the IP system toward openness) — a case of technologists reshaping how the legal framework operates in practice.

The rise of generative AI has reopened intellectual property questions in their most acute form yet, and the law is in the early, unsettled stage of grappling with them. The training of AI models on copyrighted data — text, images, code, scraped at scale to train models — raises the question of whether this is infringement or fair use, a question being litigated and not yet resolved, with enormous stakes for both the AI industry and the creators whose work is used. The output of generative models raises further questions: who owns AI-generated content, can it be copyrighted at all (the position so far in some jurisdictions is that purely AI-generated work lacks the human authorship copyright requires), and does output that resembles training data infringe? These questions are genuinely hard because AI does not fit the existing categories: a model trained on millions of works is neither copying them (the model does not store them) nor independent of them (it learned from them), and the legal frameworks have no ready category for this. The law is being made now, through litigation and legislation, and the outcomes will shape the AI industry and the creative economy profoundly. This is the relationship at its most active and most uncertain — old frameworks confronting an object that may not fit them, with the resolution genuinely undetermined.

Algorithmic Accountability: Transparency, Fairness, and Recourse

As algorithms make or inform consequential decisions — about credit, employment, housing, criminal justice, benefits — a new domain of the relationship has emerged: the demand that these algorithmic decisions be accountable, which raises technical and legal questions together. When an algorithm denies someone a loan, flags them as a risk, or screens them out of a job, the questions of why, whether the decision was fair, and what recourse the person has, become both legal demands and technical challenges.

The transparency demand — that algorithmic decisions be explainable — sits at a hard intersection of law and technical reality. The legal and ethical case for explanation is strong: a person subject to a consequential automated decision has a legitimate claim to know why, both for dignity and for the ability to contest error. Some legal frameworks have moved toward requiring it (the GDPR’s provisions on automated decision-making and a contested “right to explanation”). But the technical reality is that the most capable algorithmic decision systems — deep neural networks — are not transparent, and explaining their decisions is the unsolved problem that the interpretability research of §5.6 addresses. The legal demand for explanation collides with the technical difficulty of providing it, and the collision raises hard questions: should systems that cannot be explained be used for consequential decisions? is a post-hoc approximate explanation good enough? does the demand for explainability force a tradeoff with accuracy (if the explainable models are less capable)? These are questions that neither law nor computer science can answer alone.

The fairness demand — that algorithmic decisions not discriminate — has revealed deep difficulties that are simultaneously technical and conceptual. Algorithms trained on historical data learn the patterns in that data, including the patterns of past discrimination, and can reproduce or amplify them (the documented cases — biased risk-assessment tools, discriminatory hiring algorithms, disparate facial recognition accuracy — are numerous). The technical study of algorithmic fairness has tried to define and ensure fairness mathematically, and in doing so has discovered something important: there are multiple, incompatible mathematical definitions of fairness, and they cannot all be satisfied simultaneously (the impossibility results showing that different reasonable fairness criteria are mutually exclusive). This is a finding that bears directly on law and policy: it means that “fair” is not a single well-defined technical target but a contested choice among incompatible criteria, and the choice of which fairness criterion to use is a value judgment that cannot be settled technically. The law’s demand for non-discrimination meets the technical finding that non-discrimination has multiple incompatible meanings, and the resolution requires a normative choice that is properly legal and political, informed by but not determined by the technical results.

The recourse demand — that people affected by algorithmic decisions have a way to contest and correct them — connects accountability to the architecture of systems. Recourse requires that decisions be contestable, that errors be correctable, that there be a human who can be appealed to, and these requirements bear on how systems are designed, not just on how they are regulated. The “code is law” insight returns here: if the system is designed without provision for contest and correction, then no legal right of recourse can be effective, because the architecture forecloses it. Effective accountability requires that the technical design and the legal requirements be developed together, with the system built to support the accountability the law demands — which is, again, the relationship at its most necessary, where neither the law nor the technical design can achieve the goal alone.

What This Perspective Changes

Seeing the relationship between computer science and law changes how a practitioner understands the systems they build and their responsibility for them.

The first change is recognition that technical design is policy. The practitioner who has internalized “code is law” understands that the architecture of the systems they build regulates behavior — determines what is possible, what is private, what is contestable — and that in designing systems they are making policy choices with social consequences, whether or not they intend to. This recognition brings responsibility: the design decisions are not merely technical but have the force of regulation, and the practitioner is, in effect, a policymaker for the domain their system governs. This connects directly to the professional ethics of §8.9.

The second change is the ability to engage with the legal and policy dimensions of technical work. The practitioner who understands the relationship can participate in the conversations that increasingly surround technical work — about privacy, about intellectual property, about algorithmic accountability — with an understanding of both the technical realities and the legal frameworks. They can explain to non-technical stakeholders what is technically possible and what is not, can recognize when a legal requirement is technically infeasible or when a technical capability has legal implications, and can help bridge the gap between the fields that is the source of so many problems at the boundary.

The third change is calibration about hard problems that are neither purely technical nor purely legal. The practitioner who understands the boundary recognizes that the hardest problems — explainability colliding with the opacity of capable models, fairness having multiple incompatible definitions, privacy’s consent model failing at scale — cannot be solved by either field alone. They are joint problems requiring both technical and legal-political resolution, and the practitioner who sees this avoids both the technical hubris (we can solve this with a better algorithm) and the deference (this is a legal matter, not my concern) that prevent the joint engagement these problems require.

The fourth change is appreciation of the stakes and the responsibility. The practitioner who sees that the systems computer scientists build now govern consequential domains of social life — and that the law is often unable to keep up — appreciates that the responsibility for building these systems well, including their privacy, fairness, and accountability properties, falls substantially on the people who build them, because the law that would otherwise constrain them is perpetually behind. This is a heavy responsibility, and recognizing it is part of mature professional practice in a field whose products have become socially consequential faster than society’s mechanisms for governing them.

Resources

Foundational and Bridging Texts

Lawrence Lessig’s Code: And Other Laws of Cyberspace (Version 2.0, Basic Books, 2006, the updated edition of the 1999 original) is the foundational text on the relationship, the source of “code is law” and the systematic argument that technical architecture regulates behavior as law does. It remains the essential framing for understanding how the design of technical systems is a form of regulation, and how the choices technologists make are policy choices. It is the single best entry to the relationship.

For privacy specifically, Daniel Solove’s work (Understanding Privacy, 2008, and The Digital Person) provides the conceptual frameworks for thinking about privacy in the information age, mapping the different things “privacy” means and how they apply to data. On the technical side, the differential privacy literature — Dwork and Roth’s The Algorithmic Foundations of Differential Privacy (2014, free) — is the rigorous treatment of the technical conception, and reading it alongside the legal frameworks reveals the gap and the connection between the technical and legal conceptions.

For algorithmic accountability and fairness, Barocas, Hardt, and Narayanan’s Fairness and Machine Learning: Limitations and Opportunities (free at fairmlbook.org) is the authoritative text on the technical study of fairness, including the impossibility results showing that fairness criteria conflict. Cathy O’Neil’s Weapons of Math Destruction (2016) is the accessible account of algorithmic harm in consequential decisions, and Virginia Eubanks’s Automating Inequality (2018) documents the effects on vulnerable populations. Frank Pasquale’s The Black Box Society (2015) addresses the accountability problem of opaque algorithmic systems.

Resource Role Type
Lessig, Code: And Other Laws of Cyberspace (v2.0) “Code is law”; the foundational framing Depth
Solove, Understanding Privacy Conceptual frameworks for privacy Depth
Dwork & Roth, The Algorithmic Foundations of Differential Privacy (free) The technical conception of privacy Depth
Barocas, Hardt & Narayanan, Fairness and Machine Learning (free) Technical study of fairness; impossibility results Depth
O’Neil, Weapons of Math Destruction Algorithmic harm, accessibly Entry

Intellectual Property, AI, and Ongoing Developments

Intellectual property in the age of AI is developing too fast for books to be current; the primary sources are the litigation, legislation, and policy documents being produced now. For the foundations, Lessig’s Free Culture (2004, free) and the writing on the open-source and free-software movements (the Free Software Foundation’s materials, the history of copyleft) provide the background on how IP law and software interacted. For the current AI-and-IP questions, the ongoing litigation (the cases on AI training and copyright), the copyright offices’ policy statements on AI-generated works, and the legal scholarship being produced now are the live sources; this is a domain where staying current requires following the developments rather than reading settled treatments.

For privacy regulation specifically, the text of the major regimes (the GDPR, and the emerging frameworks in other jurisdictions) and the analyses of them are the references for understanding what the law actually requires and how it maps (or fails to map) onto technical reality.

For the broader policy conversation, the work of technology policy researchers and organizations (the AI Now Institute, academic centers on technology and society) provides ongoing analysis of the relationship as it develops.

Resource Role Type
Lessig, Free Culture (free) IP, software, and the commons Depth
GDPR and major privacy regimes (primary text) What privacy law requires Reference
EU AI Act official text / AI Act Explorer (free) Current AI regulation primary source Reference
U.S. Copyright Office, Copyright and Artificial Intelligence reports (free) AI copyright policy primary source Reference
NIST AI Risk Management Framework (free) Practical AI risk governance framework Practice
OECD AI Principles (free) International AI governance principles Reference
AI-and-copyright litigation and policy (ongoing) The unsettled IP frontier Reference
Technology policy research (AI Now and others) Ongoing analysis of the boundary Reference

Traps

Trap Why it misleads Better response
Believing technical design is value-neutral The view that building systems is a technical activity separate from policy and values — that the technologist builds and others decide how it is used — ignores that technical architecture regulates behavior, determines what is possible, and embeds value choices. A system’s design decides what is private, what is contestable, what is possible, and these are policy choices made by the designer whether acknowledged or not. Recognize that technical design is policy, in Lessig’s sense: the architecture is a form of regulation, and the design choices have the force of law for the domain the system governs. Accept the responsibility this entails — the privacy, fairness, and accountability properties of a system are determined by its design, and the designer is accountable for them. Value-neutrality is not available; the choice is whether to make the value choices deliberately or by default.
Assuming the law will handle the consequences Technologists sometimes assume that the social consequences of what they build are the law’s concern, not theirs — that if something should be prevented, the law will prevent it. But the law is perpetually behind technology, often by years, and for much of the time a technology is reshaping the world, there is no law governing it. The assumption that the law will handle the consequences leaves them ungoverned during the long period before the law catches up. Recognize that the responsibility for building systems well falls substantially on the builders, precisely because the law is behind. During the period before regulation arrives — which is most of the period that matters — the design choices of technologists are the main thing determining the system’s social effects. Build as though the responsibility is yours, because in the absence of effective law, it is.
Treating “fairness” as a single technical target The demand that algorithms be fair is sometimes treated as a technical specification to be met — make the algorithm fair. But fairness has multiple, incompatible mathematical definitions that cannot all be satisfied simultaneously, which means “fair” is not a single target but a contested choice among incompatible criteria. Treating it as a technical target obscures that the choice of fairness criterion is a value judgment that cannot be settled technically. Understand that fairness is a contested normative choice, not a technical specification. The impossibility results show that different reasonable fairness criteria conflict, so a choice must be made about which to prioritize, and that choice is a value judgment properly made through legal and political processes, informed by but not determined by the technical analysis. The technical work clarifies the options and the tradeoffs; it does not settle which fairness to pursue.
Demanding or promising explainability without confronting the technical reality The legal and ethical demand for explainable algorithmic decisions collides with the technical reality that the most capable systems are not transparent and that explaining them is an unsolved problem (§5.6). Demanding explainability as though it were technically straightforward, or promising it when it cannot honestly be delivered, both ignore the genuine difficulty and the hard tradeoffs it forces. Confront the collision honestly. Explaining capable models is genuinely hard, post-hoc explanations may be approximate or misleading, and there may be a real tradeoff between explainability and capability. The hard questions — whether unexplainable systems should be used for consequential decisions, whether approximate explanation suffices — require engaging both the legal demand and the technical reality, not assuming explainability is available when it is not or dismissing the demand because it is hard.

中文

法律与计算机科学之所以相遇，是因为软件如今治理着社会生活的许多部分，而社会则通过法律来治理。随着计算扩展到各个领域——通信、商业、就业、医疗、刑事司法，以及日常生活的基础设施——计算机科学家构建的系统已经成为法律和政治关切的对象，而法律也不得不应对那些它原本并未为之设计的技术。这种关系具有典型的紧张性，因为两个领域变化速度不同，推理方式也不同：技术变化迅速，思考的是“什么是可能的”；法律变化缓慢，思考的是“什么是被允许的”。二者之间的缝隙，正是这个边界上许多最困难问题所在。法律总是在追赶那些它抵达之前就已经重塑世界的技术。

这种关系也具有一种容易被忽视的双向性。法律塑造技术——隐私法规限制数据系统可以收集什么，知识产权法决定什么可以建立在什么之上，责任规则影响什么会被部署。但技术也塑造法律，而且比法律有时意识到的更深：系统架构决定什么是可能的，而什么是可能的，又约束法律能够有效要求什么。Lawrence Lessig 的表述——“代码即法律”（code is law）——抓住了这一洞见：技术系统的设计像法律规则一样有力地规制行为，有时甚至更有力，因为代码决定什么能被做，而法律只决定什么被允许做。技术架构是一种规制形式，而设计它的人，无论是否有意，实际上都在制定政策。

本节将通过三个最具后果的领域考察这种关系：隐私，在这里，一种基本价值的技术观念和法律观念彼此互动；知识产权，在这里，法律艰难地把软件以及如今的 AI 放进为其他对象设计的框架中；算法问责，在这里，算法被用于重大决策，引发了对透明度、公平性和救济机制的新要求。本节连接到安全与密码学（§4.5）、AI 的社会维度（§5.7），以及 §8.9 的职业伦理；同时也涉及本指南范围之外的法律和政策，而它们与计算的关系正是本节主题。

背景知识：安全与密码学（§4.5）、AI 安全与社会影响（§5.7），以及职业实践（§8.9）提供技术和职业语境；法律、政策和伦理则提供制度语境。

这种关系：代码、法律与计算治理

隐私：在技术观念与法律观念之间被争夺的价值

隐私是技术观念与法律观念互动最复杂的领域，因为隐私同时是一种技术属性，也是一项法律权利。作为技术属性，它关心系统揭示什么、保护什么；作为法律权利，它关心法律允许什么、禁止什么。而这两种观念并不能整齐对应。理解隐私，必须同时把握二者；困难也正位于二者之间的关系中。

法律上的隐私观念早于计算出现很久，并且一直艰难地适应计算时代。其奠基性表述是 Warren 和 Brandeis 的《隐私权》（“The Right to Privacy”，1890）。这篇文章受到便携式相机这一新技术的刺激，把隐私定义为“不受打扰的权利”（the right to be let alone），这种框架主要面向侵扰。但计算时代的隐私主要不是关于侵扰，而是关于数据——数据的收集、聚合、推断和使用。因此，法律框架不得不转向以数据为中心的隐私观。其结果是一种拼接式格局：全面性数据保护制度，例如欧盟 GDPR，这是影响最大的制度，包含同意、目的限制、数据最小化、访问权和删除权等原则；分领域规则，例如医疗、金融、儿童；以及因司法辖区不同而差异巨大的碎片化格局。法律正在处理一种它早已承认的价值，只是现在要把它应用于那些产生了旧观念未曾预料的隐私问题的技术。

技术上的隐私观念则不同，并且在某些方面更先进：计算机科学已经发展出精确的、数学化的隐私概念，而法律较为松散的概念并不具备这种精确性。差分隐私（differential privacy，Dwork 等，2006）是里程碑：它用数学定义说明一次数据分析怎样才算保护个体隐私，并保证输出几乎不会泄露关于任何个体的信息，同时用一个精确且可调的参数量化隐私保证。差分隐私提供了法律观念无法提供的东西——严格的、可证明的保证——并且已经被大规模部署，例如美国人口普查和大型科技公司。其他技术隐私工具——安全多方计算（在不暴露数据的情况下对数据进行计算）、同态加密（在加密数据上计算）、联邦学习（在不集中数据的情况下训练模型）——提供了实现隐私目标的技术手段，而这些目标法律通常只能抽象地命令。技术观念提供精确性和可证明保证；法律观念提供可执行的权利和社会合法性；二者之间的关系——法律要求如何映射到技术机制，技术能力又应如何影响法律标准——是一个活跃且后果重大的前沿。

这两种观念之间的张力是真实的。法律以同意为中心的模型——只要用户同意数据使用，隐私就得到了保护——与现代数据系统的技术现实并不协调：在现代数据系统的规模和复杂性下，有意义的同意几乎不可能实现。没有人会真正阅读或理解自己接受的隐私政策，而且能够从数据中推断出的内容，远远超出任何同意所能有意义覆盖的范围。法律关于个人可识别信息的概念，也与技术现实并不协调：匿名化远比看上去困难，对所谓匿名数据的重新识别已经被反复证明；而某些数据单独看并不能识别个人，但与其他数据结合后就会变得可识别。法律对数据的假设与数据的技术事实之间的差距，是无效监管的来源之一。弥合这种差距，需要法律观念和技术观念相互塑造——这正是这种关系最必要的地方。

知识产权：用旧框架处理新对象

知识产权法——版权、专利、商业秘密——原本是为实体商品、创作作品和机械发明的世界设计的。把软件放进这一框架，已经是一场持续数十年的艰难适配；而 AI 的兴起如今又以更尖锐的形式重新打开了这一问题。在这里，法律与计算机科学的关系表现为：法律勉强把为其他对象设计的框架应用到并不适合这些框架的新对象上。

软件本身就很难归类。程序是一种创作作品吗？如果是，它就像书一样受版权保护。还是一种功能性发明？如果是，它就像机器一样受专利保护。法律最后以一种别扭的方式同时选择了两者：软件可以受版权保护，保护的是表达，也就是具体代码；也可能受专利保护，保护的是底层方法，尽管具体适用的司法辖区和形式反复变化。可版权保护的表达与不可保护的思想或功能之间的边界，已经引发大量诉讼。之所以难以适配，是因为软件确实是一种新型对象：它像机器一样具有功能，又像文本一样被书写；它像信息一样可以零成本复制，又像产品一样被工程化。既有分类原本并不是为它设计的。开源运动在一定程度上正是对此的回应：它巧妙地逆向使用版权法。copyleft 许可证利用软件版权要求衍生作品继续保持开放，从而把知识产权制度转向开放。这是技术工作者在实践中重塑法律框架运作方式的案例。

生成式 AI 的兴起，则以迄今最尖锐的形式重新打开了知识产权问题，而法律仍处于早期且尚未稳定的应对阶段。用受版权保护的数据训练 AI 模型——文本、图像、代码，被大规模抓取并用于训练模型——提出了一个问题：这究竟是侵权，还是合理使用？这个问题仍在诉讼中，尚未解决，并且对 AI 行业以及作品被使用的创作者都有巨大利害关系。生成模型的输出又引出进一步问题：谁拥有 AI 生成内容？它能否受到版权保护？一些司法辖区目前的立场是，纯 AI 生成作品缺少版权所要求的人类作者性。以及，如果输出与训练数据相似，是否构成侵权？这些问题确实困难，因为 AI 不适合既有分类：一个在数百万作品上训练出来的模型，既不是在复制这些作品——模型并不存储它们——也不是与这些作品无关——它确实从它们那里学习。法律框架没有现成类别可以容纳这一点。法律正在通过诉讼和立法被塑造，而结果将深刻影响 AI 行业和创意经济。这是这种关系最活跃、也最不确定的状态：旧框架正在面对一个也许并不适合它们的对象，而最终解决方案确实尚未确定。

算法问责：透明度、公平性与救济

随着算法做出或影响重大决策——关于信贷、就业、住房、刑事司法、福利——这种关系中出现了一个新领域：要求算法决策具有问责性。这同时提出了技术问题和法律问题。当一个算法拒绝某人的贷款申请，把某人标记为风险对象，或在招聘中筛掉某人时，为什么会这样做、这个决定是否公平、当事人有什么救济途径，就同时成为法律要求和技术挑战。

透明度要求——算法决策应当可解释——位于法律和技术现实的困难交叉处。从法律和伦理角度看，要求解释具有强理由：一个受到重大自动化决策影响的人，有正当理由知道为什么；这既关系到人的尊严，也关系到质疑错误的能力。一些法律框架已经开始朝这个方向移动，例如 GDPR 关于自动化决策的规定，以及存在争议的“解释权”。但技术现实是，最有能力的算法决策系统——深度神经网络——并不透明，而解释它们的决策正是 §5.6 可解释性研究所面对的未解决问题。法律对解释的要求与技术上提供解释的困难发生碰撞，而这场碰撞提出了艰难问题：无法解释的系统是否应该用于重大决策？事后的近似解释是否足够？对可解释性的要求是否会迫使我们在解释能力与准确性之间做取舍，如果可解释模型能力较弱的话？这些问题无法由法律或计算机科学任何一方单独回答。

公平性要求——算法决策不应歧视——揭示出一些同时具有技术性和概念性的深层困难。用历史数据训练的算法会学习这些数据中的模式，包括过去歧视的模式，并可能复制或放大这些模式。相关记录案例很多：有偏的风险评估工具、歧视性招聘算法、人脸识别准确率差异等。算法公平性的技术研究试图用数学方式定义并保证公平，而在这一过程中发现了一个重要事实：公平有多个互不兼容的数学定义，而且它们不能同时被满足。相关不可能性结果表明，不同的合理公平标准彼此冲突。这个发现直接影响法律和政策：它意味着“公平”不是一个单一且定义良好的技术目标，而是在互不兼容的标准之间进行选择；选择使用哪一种公平标准，是价值判断，不能由技术自身解决。法律对非歧视的要求遇到了技术上的发现：非歧视有多种彼此不兼容的含义。因此，解决方案需要一种规范性选择，这种选择应当属于法律和政治领域，由技术结果提供信息，但不能由技术结果决定。

救济要求——受到算法决策影响的人应当有办法质疑和纠正这些决定——把问责连接到系统架构。救济要求决策可以被质疑，错误可以被纠正，并且存在可以申诉的人类主体；这些要求关系到系统如何被设计，而不只是系统如何被监管。“代码即法律”的洞见在这里再次出现：如果系统设计中没有为质疑和纠错预留机制，那么任何法律上的救济权都无法有效实现，因为架构已经提前排除了它。有效问责要求技术设计与法律要求共同发展，系统必须被构建成能够支持法律所要求的问责。这又一次说明，在这种关系最必要的地方，法律和技术设计任何一方都无法单独达成目标。

这种视角会改变什么

看清计算机科学与法律的关系，会改变实践者对其所构建系统及自身责任的理解。

第一种改变，是认识到技术设计就是政策。真正内化“代码即法律”的实践者会理解，他们所构建系统的架构正在规制行为——决定什么是可能的、什么是私密的、什么是可被质疑的——而在设计系统时，他们实际上正在做出具有社会后果的政策选择，无论他们是否有意。这种认识带来责任：设计决策不仅仅是技术性的，它们具有规制力量；实践者实际上是在为其系统所治理的领域制定政策。这直接连接到 §8.9 的职业伦理。

第二种改变，是获得参与技术工作的法律和政策维度讨论的能力。理解这种关系的实践者，能够参与那些越来越多围绕技术工作展开的对话——关于隐私、知识产权、算法问责——并且同时理解技术现实和法律框架。他们能够向非技术利益相关者解释什么在技术上可行，什么不可行；能够识别某个法律要求何时在技术上不可实现，或者某项技术能力何时具有法律含义；也能够帮助弥合两个领域之间的差距，而这种差距正是边界上许多问题的来源。

第三种改变，是对那些既非纯技术、也非纯法律的问题获得校准。理解这一边界的实践者会认识到，最困难的问题——可解释性要求与高能力模型的不透明性碰撞，公平性存在多种互不兼容的定义，隐私中的同意模型在大规模场景下失效——不能由任何一个领域单独解决。这些是共同问题，需要技术解决与法律—政治解决共同参与。看清这一点的实践者，能够避免两种错误：一种是技术傲慢，以为“用更好的算法就能解决”；另一种是推卸式服从，以为“这是法律问题，不关我的事”。这两种态度都会阻碍这些问题所需要的共同参与。

第四种改变，是认识到问题的利害关系和责任。实践者如果看见计算机科学家构建的系统如今已经治理着社会生活中的重大领域，而法律又常常无法跟上，就会理解：良好地构建这些系统，包括它们的隐私、公平和问责属性，在很大程度上落在构建者身上，因为本应约束它们的法律总是滞后的。这是一种沉重责任；认识到这一点，是一个产品变得比社会治理机制更快产生社会后果的领域中成熟职业实践的一部分。

资源

基础与桥接文本

Lawrence Lessig 的 Code: And Other Laws of Cyberspace（Version 2.0，Basic Books，2006，1999 年原版的更新版）是理解这种关系的奠基性文本，也是“代码即法律”这一说法的来源，并系统论证了技术架构如何像法律一样规制行为。它仍然是理解技术系统设计作为一种规制形式、以及技术工作者的选择如何成为政策选择的核心框架。这是进入这种关系的最佳单一入口。

具体到隐私，Daniel Solove 的著作，例如 Understanding Privacy（2008）和 The Digital Person，提供了理解信息时代隐私的概念框架，梳理了“隐私”这个词的不同含义，以及它们如何适用于数据。在技术侧，差分隐私文献——Dwork 和 Roth 的 The Algorithmic Foundations of Differential Privacy（2014，免费）——是对技术性隐私观念的严格处理。把它和法律框架放在一起阅读，可以看见技术观念与法律观念之间的差距和连接。

关于算法问责和公平性，Barocas、Hardt 和 Narayanan 的 Fairness and Machine Learning: Limitations and Opportunities（可在 fairmlbook.org 免费获取）是算法公平性技术研究的权威文本，包括说明公平标准彼此冲突的不可能性结果。Cathy O’Neil 的 Weapons of Math Destruction（2016）是关于重大决策中算法伤害的易读叙述；Virginia Eubanks 的 Automating Inequality（2018）记录了算法系统对弱势群体的影响。Frank Pasquale 的 The Black Box Society（2015）则讨论了不透明算法系统的问责问题。

资源 作用 类型
Lessig，Code: And Other Laws of Cyberspace（v2.0） “代码即法律”；奠基性框架 深入
Solove，Understanding Privacy 隐私的概念框架 深入
Dwork & Roth，The Algorithmic Foundations of Differential Privacy（免费） 隐私的技术观念 深入
Barocas、Hardt & Narayanan，Fairness and Machine Learning（免费） 公平性的技术研究；不可能性结果 深入
O’Neil，Weapons of Math Destruction 算法伤害的易读叙述 入门

知识产权、AI 与持续发展

AI 时代的知识产权发展太快，书籍很难保持最新；主要来源是当前正在产生的诉讼、立法和政策文件。对于基础背景，Lessig 的 Free Culture（2004，免费）以及关于开源和自由软件运动的写作，例如 Free Software Foundation 的材料和 copyleft 的历史，提供了知识产权法与软件如何互动的背景。对于当前 AI 与知识产权的问题，正在进行的诉讼，也就是关于 AI 训练和版权的案件，版权机构关于 AI 生成作品的政策声明，以及当前正在产生的法律学术研究，才是活跃来源。这是一个必须持续跟踪发展，而不是阅读定型处理的领域。

具体到隐私监管，主要制度文本，例如 GDPR 以及其他司法辖区正在出现的框架，和对它们的分析，是理解法律到底要求什么，以及这些要求如何映射或无法映射到技术现实上的参考来源。

对于更广泛的政策讨论，技术政策研究者和机构，例如 AI Now Institute，以及关于技术与社会的学术中心，提供了随着这种关系发展而持续更新的分析。

资源 作用 类型
Lessig，Free Culture（免费） 知识产权、软件与公地 深入
GDPR 和主要隐私制度（原始文本） 隐私法要求什么 参考
EU AI Act 官方文本 / AI Act Explorer（免费） 当前 AI 监管的一手来源 参考
U.S. Copyright Office，Copyright and Artificial Intelligence reports（免费） AI 版权政策的一手来源 参考
NIST AI Risk Management Framework（免费） 实用 AI 风险治理框架 实践
OECD AI Principles（免费） 国际 AI 治理原则 参考
AI 与版权诉讼及政策（持续发展中） 尚未稳定的知识产权前沿 参考
技术政策研究（AI Now 等） 对这一边界的持续分析 参考

陷阱

陷阱 为什么会误导 更好的回应
相信技术设计是价值中立的 这种观点认为构建系统是一种与政策和价值分离的技术活动——技术人员只负责构建，别人决定如何使用。它忽视了技术架构会规制行为、决定什么是可能的，并嵌入价值选择。一个系统的设计决定什么是私密的，什么是可被质疑的，什么是可能的；这些都是设计者做出的政策选择，无论是否承认。 承认技术设计就是政策，这正是 Lessig 意义上的观点：架构是一种规制形式，设计选择对于系统治理的领域具有类似法律的力量。接受由此带来的责任——系统的隐私、公平和问责属性由其设计决定，设计者需要为此负责。价值中立并不存在；真正的选择是有意识地做出价值选择，还是让它们在默认状态中发生。
以为法律会处理后果 技术工作者有时会假设，他们所构建事物的社会后果属于法律的事务，而不是他们的事务——如果某件事应当被阻止，法律会阻止它。但法律总是落后于技术，而且常常落后多年。在一项技术重塑世界的大部分时间里，并没有法律有效治理它。假设法律会处理后果，实际上会让这些后果在法律追上来之前长期处于无人治理状态。 承认良好构建系统的责任在很大程度上落在构建者身上，正因为法律是滞后的。在监管到来之前的时期——而这通常正是最重要的时期——技术工作者的设计选择，才是决定系统社会影响的主要因素。应当像责任属于你一样去构建系统，因为在缺乏有效法律时，事实也确实如此。
把“公平”当成单一技术目标 算法应当公平这一要求，有时被当作一种可以满足的技术规格：让算法变公平即可。但公平有多个互不兼容的数学定义，无法同时满足。这意味着“公平”不是单一目标，而是在互不兼容的标准之间进行选择。把它当成技术目标，会遮蔽这样一个事实：选择哪种公平标准是一种价值判断，不能由技术本身解决。 理解公平是一种有争议的规范性选择，而不是技术规格。不可能性结果表明，不同的合理公平标准会彼此冲突，因此必须选择优先考虑哪一种；而这种选择是价值判断，应当通过法律和政治过程来做出，由技术分析提供信息，但不能由技术分析决定。技术工作可以澄清选项和取舍，但不能决定应追求哪一种公平。
在不面对技术现实的情况下要求或承诺可解释性 对算法决策可解释性的法律和伦理要求，与最有能力的系统并不透明、且解释它们仍是未解决问题（§5.6）这一技术现实发生碰撞。把可解释性要求得好像它在技术上很简单，或者在无法诚实提供时仍然承诺可解释性，都会忽视真正困难以及它迫使我们面对的艰难取舍。 诚实面对这种碰撞。解释高能力模型确实困难，事后解释可能只是近似的，甚至可能误导；而可解释性与能力之间也可能存在真实取舍。那些困难问题——无法解释的系统是否应该用于重大决策，近似解释是否足够——需要同时面对法律要求和技术现实，而不是在可解释性并不存在时假设它可用，也不是因为它困难就拒绝这一要求。