The unspoken link between the GDPR and the AIA.

There’s an unspoken link between the AIA and the GDPR.

One of the key elements of the GDPR is the accountability principle. Article 5.2 of the GDPR states that the “controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

Article 5.1 then sets out the key principles of the GDPR: the processing of personal data has to be lawful, fair, transparent, accurate, purpose-limited and purpose-proportionate.

The accountability principle is great in theory, but it’s very hard to enforce in practice.

Then along comes the AIA. The AIA is not just about AI systems using personal data (it has provision for deep fakes, misinformation, critical infrastructure, systemic risk and so on), but most of it is. The prohibited practices are all about personal data, and 5 of the 6 high risk activities are about personal data.

The AIA then sets out obligations in relation to risk-management, data and data governance, human oversight, cyber security, corrective actions, and so on. And if the AI system doesn’t comply with these obligations, it can’t appear in the EU market.

That all comes pretty close to enforcement of the GDPR’s accountability principle.

?

?