The summer break often provides an opportunity to reflect and look ahead. However, the clock is ticking relentlessly as we work toward compliance with the AI Regulation. The AI Regulation takes effect on August 1, 2024, and will be implemented in phases. Therefore, by August 2, 2027, organizations must have a clear understanding of which high-risk AI systems they have in place, as well as the measures they are taking to manage these risks. That may seem far off, but conducting a thorough analysis and developing and implementing appropriate measures takes time.
Inventory of AI Systems
Organizations must take inventory of(and document) their use of AI, which can be done through a risk analysis. A risk analysis provides answers to the following questions, among others:
- What systems are used?
- Is AI used there or not?
- In which processes are these AI systems used?
- Have employees been trained to use this AI?
In addition, the AI Regulation identifies four risk categories into which AI systems must be classified. The following four categories are defined therein:
1. Unacceptable risk: This refers to AI applications that could seriously harm fundamental rights or safety, such as social scoring, manipulative AI, and real-time biometric identification in public spaces. These systems are completely banned in the EU.
2. High risk; Systems with a substantial impact on citizens or critical processes, such as AI in recruitment, credit scoring, education, and critical infrastructure. These systems must meet strict requirements such as data quality, documentation, logging, and human oversight. Therefore, the organization must implement appropriate measures to ensure compliance.
3. Limited risk; AI systems that require transparency, such as chatbots and deepfakes. Organizations must inform users that they are interacting with AI so that they can distinguish between real content and AI-generated content.
4. Minimal risk: Low-risk applications, such as spam filters. These are not subject to the legal obligations of the AI Regulation.
What does this mean for your organization?
For organizations and executives, now is therefore the perfect time to gain insight into the use of AI within the organization through a risk analysis. Identify AI systems, determine which risk category under the AI Regulation they fall into, and implement the measures necessary to comply with the AI Regulation in a timely manner. Getting started early is essential, as gaining insight into AI systems and meeting the associated obligations cannot be achieved overnight.
Want to learn more?
Would you like to know what the AI Regulation specifically means for your organization? Govers is happy to help you gain insight into the impact of the regulations, conduct risk analyses, and implement appropriate controls related to AI. Our specialists combine expertise in information security, AI, and privacy with practical experience in governance, risk, and compliance. For more information or a no-obligation consultation, please contact Rolijn van Vught at rolijn.vanvught@govers.nl.