Time flies. This expression, which we often use for so many things, is relevant when talking about Artificial Intelligence.
On July 12, 2004, the Artificial Intelligence Regulation (hereinafter, RIA)
And I said that time flies, although that's relative, as Einstein would say, given that, for many, the AI Regulation has taken a long time to see the light of day. Because the approval and publication process has been long, as is generally the case with regulations emanating from the European Parliament, given its complexity and its unique governance.
Therefore, we shouldn't be too surprised, given that this "sword of Damocles" has been hanging over our heads for some time. The fact is that companies and organizations, both public and private, have enough to do just to keep their businesses going in such turbulent and uncertain times, both from a social perspective (post-COVID, remote working, etc.) and a political one at the European and global levels, and they are now anticipating these challenges.
Still, there are companies that can afford to anticipate, that do their homework, that have a special interest in Artificial Intelligence, or companies that are very efficient and have managed to do the most basic things by the time the RIA is approved and published.
But let's get back to the fact that time flies: just as companies are still trying to raise awareness and/or educate themselves about what artificial intelligence is, what uses it could have, what risks it entails, and so on, the RIA is suddenly approved. And that means the countdown begins, with deadlines for its entry into force that must be taken into account. We're talking about RIA obligations that will apply to a very significant number of companies within a period of no more than 24 months from its approval.
There isn't that much time. And companies should be worried. I'd say almost all of them. Because those who think they won't have problems, because they don't even know what AI is or don't plan to use it, may have a product they use and a supplier who does, and they need to take this into account.
Therefore, it is time to know the obligations of the RIA and to (i) understand whether it impacts us or not and (ii) be alert because the future is presumably loaded with Artificial Intelligence, so it may not impact us today, but it may in the near future.
Artificial Intelligence Regulation
The Artificial Intelligence Regulation's sanctioning regime is no small feat. Once again, potentially devastating sanctions will be imposed on companies that attempt to break the rules. This means that companies that don't intend to do so, but do, could also be subject to sanctions, with extremely serious consequences.
And where should we start as a company? Well, we have to go step by step, because what the RIA says can be overwhelming. Without a doubt, the first thing we should do, in addition to reading the RIA carefully and conducting an initial legal assessment, is to identify the Artificial Intelligences already being used in my company. This is essential and the basis for continuing with the rest of the actions.
This discovery or survey of AIs will likely bring surprises to many companies, where places where there was no certainty or understanding of AI use will be identified. We will need a procedure and a recording method that allows us to identify the aspects that should be known about each AI in use. Importantly, we will identify not only those AIs that my company has developed, but also any that are in use (it's crucial to review supply chains, for example).
This exercise, which we will carry out thanks to the RIA, will provide significant added value to the organization, as it will also allow us to better manage our risks and offer AI models in use to other areas of the organization. Likewise, we will be able to control those uses that, de facto, are not legal within the RIA specifications, thus avoiding serious regulatory issues.
We will govern these AIs, establish internal policies, processes, and procedures, review their requirements and usefulness, and build a solid foundation on which to build regulatory compliance as significant as this one, among others, as a side effect.
It should not be forgotten, although it has already been anticipated, that uncontrolled use of AI could lead to all kinds of risks, with the protection of personal data being another important one to consider, without a doubt.
Awareness and training will also play a crucial role, as this allows for establishing a minimum level of knowledge for employees, ensuring the company minimizes corporate risks. We cannot forget the high risk that companies already face and will face in a few months, in the face of RIA, with what we could call "Shadow AI" or the unknown and uncontrolled corporate use of AI.
What is certain is that there will be companies with a strong or weak appetite (or even fear) for using AI, but in any case, the law must be complied with.
Continue learning about Artificial Intelligence on our blog
