The EU AI Act: Empowering Innovation. Building Trust.

More and more organisations are adopting Generative AI (GenAI) for their business functions, including generating legal agreements, code, and hyperrealistic portraits, to name a few, from a couple of text prompts. Given its vast capabilities, AI is now impacting organisations and their supply chains on a wide scale.

Opportunities across the business

The technology can provide businesses with a competitive advantage, both on the local and international stage, by driving projects at faster rates. In recent times, we have witnessed the application of GenAI across several functions, such as:

However, a renowned cliché remains relevant more than ever: with great power comes great responsibility. The power to generate outputs on a whim can also exacerbate the dissemination of misinformation and fake news. AI content can be subject to bias and data sources may be illegitimate. The risks associated with AI adoption are various, but implementing appropriate safeguards and meeting regulatory requirements, such as under the EU AI Act, can help organisations make AI trustworthy.

For the purposes of the EU AI Act, a technology is considered to be an AI system when it meets the following requirements:

• It is a machine-based system with varying levels of autonomy;

• It may exhibit adaptiveness after deployment;

• For explicit or implicit objectives, it infers, from the input it receives, how to generate outputs (e.g. predictions, content, recommendations); and

• Such outputs can influence physical or virtual environments.

Main roles under the regulation

Organisations can be classified under different roles in terms of the EU AI Act, namely as providers, deployers, importers, and distributors of AI systems. Depending on their classification under the law, organisations will have different requirements to meet - with most of the obligations being on the providers and the deployers. In some instances, businesses may be classified as both providers and deployers at the same time. It is therefore crucial for organisations dealing with AI systems to review their role on an ongoing basis to fulfil their obligations correctly.

Classification of Risks

Regulation Timeline

The AI Act was formally approved by the European Council on 21 May 2024. The final text will enter into force 20 days following its publication in the EU’s Official Journal.

Tentative timeline which may be subject to change depending on when the EU AI Act is published in the Official Journal.

Where to start?

With the fairly short transitory periods of the EU AI Act, it is important for organisations adopting AI systems and GPAI models to be adequately prepared for their respective obligations. As a point of departure, businesses are recommended to take the following steps:

• Enhancing literacy in AI, by educating stakeholders (including C-suite leaders and Board members) on the organisation’s obligations under the EU AI Act. Increased awareness can help organisations better formulate business and risk strategies and make informed decisions;
  

• Conducting a scoping exercise with respect to the EU AI Act, in order to adequately understand the organisation’s role/s, the risk-classification level of the AI system/ model, and the corresponding obligations under the regulation; and
  

• Performing a regulatory gap analysis exercise, including evaluation of current policies and procedures, to easily identify and prioritise key risk areas in terms of the EU AI Act.