AI Explainer Series #5: your top 3 EU AI Act priorities detailed in your pre-project game plan

Here's the fifth issue in the Purpose and Means 'AI explainer series.'

You’ve no doubt been tracking it as a regulatory risk on your corporate risk register but now the #EUAIAct clock is ticking. Contrary to what many are advising on Linkedin and at conferences, I suggest you start somewhere else.

Most advise to launch initiatives immediately to identify AI systems, do GAP analysis, establish various boards, etc.

Yes, all key tasks but there are other things you must do that can make or break your EU AI Act endeavour.

Here’s my suggested list of priorities. They're visualised in a pre-project game plan that can easily be presented in less than 15 min.

Priority #1: get leadership attention and secure initial funding

• Before you start talking to senior leadership, educate yourself by reviewing your company’s business strategy specifically around existing use and planned use of AI systems
• Identify the senior colleagues who are responsible for business strategy execution and achievement of strategic objectives underpinned by AI systems
• Understand and identify your company’s role(s) in relation to the act: provider, deployer, product manufacturer, etc.
• Create a brief education pack for these senior stakeholders that focuses on value creation & #BusinessStrategy execution rather than the emphasising the 7%, 3%, and 1% fines - mention them but don’t use them as a scaremongering tactic. Include narratives and analogies that apply to your business strategy - you need to focus on business enablement rather than quoting EU AI Act articles and recitals
• Engage with the senior colleagues responsible for the strategic objectives and provide high level (max. 15 min.) education. I can’t emphasise enough that these meetings are extremely critical. Eventually, you will leverage the goodwill you establish here, especially when you need to discuss your funding model
• Request sufficient funding using your company’s RFA process (or similar) to conduct a #FeasibilityStudy to get a sense of the impact and scale of what’s needed to live up the EU AI Act.

Why is this important? These days, blank cheques don’t exist and you need to justify every penny spent. By requesting funding for a specific task, i.e. the feasibility study, you are also setting the expectation that a far greater sum will be needed for the actual project or programme. This is also about establishing and building relationships with the key stakeholders and changing the perception that often exists in companies that this type of work is a ‘necessary evil.’

Priority #2: feasibility study and business case creation

This step also heavily involves lots of stakeholder interaction where you need to frame the work and educate colleagues in a way that is relatable rather than theoretical.

Why is this step important? Before starting any new project or initiative, you must assess its feasibility. A feasibility study examines the technical, financial, and operational viability of the proposed project. The business case focuses on the financial justification to determine if the project is financially viable.

Depending upon your background and experience, you may struggle to complete this step on your own. To complete this effectively, get assistance from a Business Analyst (BA). These colleagues are worth their weight in gold. They have a deep understanding of how your company operates, especially how technology underpins business objectives. They are equipped with a range of techniques to elicit requirements and insights from the right people. They will help you identify the parts of the company that will be affected and suggest who will need to take part in assessing the impacts. Together with your BA, you then need to:

• Determine information needs and create relevant high-level education packs e.g. HR has different needs to Product Development
• Engage with the colleagues, provide a contextual introduction to the work (max. 15 minutes), elicit input to the benefits case
• Through interviews and workshops, identify and assess organisational impacts using a structure technique like POTI or the old COBIT 5 enablers. I wrote an article several years ago that briefly discusses this technique. This analysis will also allow you to identify existing inventories of systems, specifically #AI systems. If inventories don’t exist, create a tactical inventory to capture info about the AI systems.

From there, you’ll be able to assess whether existing AI systems fall under the Act and then classify the systems according to the Act with initial prioritisation on suspected prohibited and high-risk AI systems.

Your findings from this work will feed into your business case. Again, your BA should be able to drive this together with others who can help quantify realistic costs and benefits. Quality is essential here - you may be held accountable for future benefits realisation.

Business cases do not need to be huge, thick documents. Less is more, ensure you include:

• Problem statement - here you'll articulate the impact of the EU?AI?Act on your business and the key compliance obligations
• Options considered and recommendation - here you'll detail the need to initiate a project or programme that will bring about the needed change in the organisation including aspects like:

• Alignment with existing business objectives - here you need to detail EU?AI?Act impacts against relevant elements of your company's business strategy. This is a great opportunity to frame the needed work as a business enabler rather than a matter of pure compliance.
• Risks - here you'll describe and differentiate the various types of risk of your company moving forward with this undertaking so there'll be a strong focus on project/programme risk
• Cost/benefit analysis - all of the often-difficult quantification of costs and benefits will need to detailed here along with the benefit realisation plan, and who is responsible for harvesting the benefits. The benefits may be linked directly to the business strategy execution, and/or risk reduction to name a couple of examples. If you have the opportunity at this stage, also include a funding model that shows a breakdown of the contributions that the various parts of the organisation will contribute to the costs. This will probably reflect the benefits that different parts of the business are realising as a result of deploying AI?systems.
• Timeline - include a first-cut roadmap rather than attempting to make a detailed schedule from start to finish- that will be impossible at this stage. A?roadmap will provide a 1-3 year view but you should include detail about your next steps in the coming 3 months

Once you are comfortable that your business case is watertight and robust, you’ll be ready for the next step.

Priority #3: presentation to senior leadership & approval of business case

The amount of time you are allocated to present your case will vary depending upon your organisation.

You may get only 15 minutes on an existing agenda, or you may have the luxury of being able to spend 1-2 hours with them, or even a whole day, but that is probably a rarity. If it happens, you’ll have a tremendous opportunity to deep dive into some key topics and provide some key knowledge and insights to them.

Let’s assume you only have 15 minutes. Here’s what you might consider doing:

• In the meeting invitation, make the following very clear (i) the purpose of the meeting (e.g. to review and approve the business case), (ii) to get the green light to initiate the project/programme, (iii) that pre-read is needed (see below), and (iv) your envisaged next steps
• Make a simple one-page version of your business case and circulate this together with the full version in advance of the meeting as pre-read. Consider using ‘risktelling’ in your one-page version of the business case. See this article from a few years ago that mentions this technique that I have found beneficial.
• Make a one-page game plan for your project/programme, and at the meeting, present this together with the business case one-pager.

So essentially you’re presenting just 2 pages/slides - the one-page business case and the one-page game plan. The documents must have a business focus. Avoid quoting articles and recitals from the EU AI Act itself.

Ideally, have the Business Analyst in the meeting who can assist with answering some of the tougher questions you may be asked.

After the meeting, follow up immediately with brief meeting notes and actions that ideally confirm the approval you were seeking.

In the #VisualGamePlan the project definition and scope will of course vary depending on business context - these are just suggestions. A?short video shows the key steps in the visual game plan:

..:: Follow Purpose and Means for daily updates about privacy & emerging technology issues ::…