EU AI Act: Implications for Your Organisation

The European Union’s Artificial Intelligence (AI) Act is a significant regulatory change. The goal is to standardise AI systems across the Union. As organisations already rely on AI, mostly in the form of machine learning, and with a view to increasingly adopt Gen AI, understanding this new legislative framework is essential. This will include services by third-party partners, many of whom will leverage capabilities and functions through Software-as-a-Service (SaaS) offerings.?

The AI Act enforces compliance requirements, especially for high-risk AI systems. Organisations must implement cybersecurity measures to protect against threats, including data poisoning and adversarial attacks. Regular security checks and updates are required as are detailed risk assessments. This is especially the case for high-risk AI systems, which need to be documented and ready for regulatory review, covering impacts on health, safety, and fundamental rights.

Organisations must maintain detailed records of the AI system’s design, purpose, risk management steps, and compliance with the AI Act, accessible to regulatory bodies. The decision-making processes of AI systems must be transparent and understandable.

Additionally, high-risk AI systems must be recorded in a centralised EU database, facilitating authorities to oversee compliance and promptly tackle any non-compliance issue. This enhanced surveillance is designed to identify and mitigate risks, and to promote safer AI deployments.

While the AI Act promotes trustworthy AI, it could challenge innovation. Compliance requires significant resources—time, money, and expertise. Smaller organisations and startups may struggle with these demands. However, the Act encourages the development of AI systems that align with ethical principles such as non-discrimination, privacy protection, and human oversight, fostering a responsible AI ecosystem.

The Act also reinforce the EU’s data protection framework. AI systems must comply with the General Data Protection Regulation (GDPR), including obtaining explicit consent for data processing, ensuring data accuracy, and upholding individuals’ rights regarding their personal data. Specific provisions address the use of biometric data, like facial recognition, requiring measures to prevent unauthorised access and misuse.

Different sectors will experience varied impacts based on their reliance on AI technologies. In healthcare, AI systems such as diagnostic tools and patient monitoring must meet high safety and accuracy standards, involving rigorous testing and validation. Financial institutions using AI for credit scoring, fraud detection, and customer service must ensure their systems avoid biases and protect consumer rights. AI-driven manufacturing systems, including robotics and predictive maintenance tools, must demonstrate reliability and safety to comply with the AI Act.

The EU’s AI Act aims to balance AI’s benefits with the need to protect fundamental rights and ensure safety. For organisations in the EU, this means adapting to a regulatory landscape that demands greater transparency, strong risk management, and strict compliance measures. Organisations must stay informed and be proactive, leveraging expertise and resources to navigate the AI Act’s complexities and responsibly harness AI’s full potential.