Putting AI compliance into practice is one of the biggest challenges organizations face today. Preparing for the obligations under the AI Act should be broken down into phases, aligned with the timeline of the EU AI Act, and tailored to your organization’s specific needs and resources. Prioritization and distribution of ownership are key.
Compliance with the EU AI Act determines how quickly you can move forward on your AI implementation journey.
Three steps to meeting the requirements of the EU AI Act
-
Phase 1: Inventory
The first step in operationalizing AI compliance in an organization’s day-to-day is to conduct two full inventories. These are an inventory of current compliance, governance, security and responsibility practices, and an inventory of all AI systems and tools and their use cases deployed in the organization.
After you have a full inventory, you can risk assess each AI use case. The AI Act’s risk-based framework mostly focuses on high-risk cases, but each AI instance should be categorized nevertheless. If one AI tool is used for multiple distinct use cases, it is possible that there are multiple risk categories attached to one tool.
Remember to maintain an industry-specific viewpoint – the AI Act’s high-risk framing mostly derives from specific industry categorization, such as Employment or Law Enforcement. Furthermore, MIT identified that Information, Finance and Insurance, and National Security are the currently most vulnerable sectors to AI risks in general (including AI risks not directly addressed in the AI Act as well).
-
Phase 2: Action plan
After gaining visibility on the entire AI tool landscape and relevant compliance needs, it is time to plan how to move forward. Develop an action plan outlining how to move from visibility to understanding and how the obligations under the EU AI Act will impact your organization.
At this phase, you should be ready to start executing the action plan, with a clear understanding of what processes already exist, how they can support your AI compliance structure, and where ownership for decision-making and execution lies.
-
Phase 3: Execution
This is the most important phase. The AI Act is already partly in force and the rest is kicking in gradually during the next few years, and preparation takes time.
Obligations range from light processes to heavy duty governance, depending on the risk categories and roles mandated by the AI Act and determined case-by-case by the inventory phase. This means some actions can be taken almost instantly, and some require longer, multi-step plans of action. Therefore, breaking the process down piece by piece, prioritizing, and starting right now is essential.
What governance model or framework works best for an organization must be evaluated case-by-case, and again, the steps you take should be prioritized based on compliance timelines, organizational resources and goals. After conducting a full inventory on current practices and discovering what works and what does not, you should have a good starting point in designing a working AI governance model that can effectively transform compliance policy into practice.
Day-to-day AI compliance
One of the biggest challenges of AI compliance is operationalizing policy. Having a clear governance process documentation and understanding legal texts is one feat, but transforming those policies into efficient action is another, much larger challenge – not to mention continuous monitoring and assurance that the designed governance and compliance model works, and iterating when not.
This is why it is so important to not only understand only the AI tools in place and compliance obligations but also the status quo of related functions; organizational landscape, culture and resources; as well as the reality of day-to-day operations; and the industry one operates in. Compliance does not sit in a vacuum, or at least effective and lasting compliance does not.
Whitepaper: AI compliance in practice
In the whitepaper you'll find more detailed steps on how any organization can begin its AI compliance journey and operate in accordance with the EU AI Act. It also covers opportunities and challenges you might run into on the way.
Author of the whitepaper: Aino Valkama, AI Compliance & Responsibility Manager at Norrin
