EU AI Act: Welcome To The Dawn Of A New AI Era

Risk management, auditing, and monitoring. This chapter includes classic risk management activities. It has two main components, depending on the ultimate recipients of risk activities: internal or external. Internal risk management activities include the creation of an inventory of AI systems, risk assessments to determine use case risks and inherent risks of use-cases, etc. External risk management activities are aimed at the delivery of market conformity assessments (when needed) and other documentation directed to compliance authorities, third-party audits, etc. Auditing and monitoring are also part of this chapter.

Data governance, quality, and policies. This chapter is about “all things data.” It contains an array of activities that refer to data governance in a broader sense. Better understanding of data sources, which is the foundation of key principles of responsible AI (such as transparency and explainability), ensuring quality of data, and tracking data provenance are part of this chapter. It covers policies, too. From expected usage of systems to policies for the protection of intellectual property, privacy, and consumers’ and employees’ protection, organizations will need to refresh existing policies and create new ones to meet the new requirements.

Technical measurements. Despite the lack of details around technical standards and protocols, at a minimum, organizations must prepare to measure and report on the performance of their AI systems. This is arguably one of the main challenges of the new requirements. Companies must start with measuring the performance of their AI and generative AI (genAI) systems from critical principles of responsible AI, such as bias, discrimination, unfairness, etc. This chapter will become richer and longer with time, as new standards and technical specifications will emerge.

AI culture and literacy. Building a robust AI culture is also a pillar of AI governance, and the AI Act makes it even more urgent. Organizations must run their AI literacy program to meet compliance requirements. This goes from standard training for employees who are involved daily in managing AI systems to enabling organizations to create alignment in the design, execution, and delivery of business objectives through the use of AI. Literacy also transforms a “human in the loop” into a professional able to effectively perform oversight of AI systems, which, according to the Act, must have adequate levels of competence, authority, and training.

Communication and instructions. The ability of an organization to communicate about the use of AI and genAI as they relate to products and/or services that they bring to market is another critical element of AI compliance. But communication is not only disclosure to consumers or employees about the use of the technology. Communication also includes the creation of “instructions” that must accompany certain AI systems. Expected and foreseen outcomes from risk assessments, as well as remedies, must also be part of this disclosure exercise.