What Business Leaders Need to Know About the EU’s AI Act

The EU AI Act is the first EU regulation that establishes a common regulatory and legal framework for AI. It was adopted in March 2024 and will be fully applicable within 24 months, with some parts applying sooner. 

So, what steps should businesses take to comply with the new regulation? 

First, let’s take a look at why the Act is groundbreaking. Globally, this is the first regulatory framework to address the development, deployment and use of AI across sectors. It uses a ‘risk-based’ approach for accessing AI systems, thus requirements for compliance are aligned to the potential impact on safety and fundamental rights. The Act requires AI systems to be transparent, explainable and understandable, where organizations developing them are accountable for the outcomes.

Over time, many believe this regulation will build public trust in AI systems.

Comparison of Regulations in the EU, US and UK

When comparing the EU AI Act with approaches in the US and UK, there are clear differences.

In the US, regulation is fragmented, where some specific sector guidelines are in place, but there is no overarching federal AI regulation similar to the EU AI Act. The US has provided frameworks and standards through the National Institute of Standards and Technology (NIST), but these are non-binding. As such, there is a reliance on industry to have more self-regulation to develop ethical AI.

Related:AI Legislation and Governance

The UK approach is similar to the US where there are non-binding frameworks and principles in place for developing ethical AI rather than regulation at this point.  With this in mind, the EU AI Act could be used as a blueprint for other countries or jurisdictions to develop approaches/frameworks for regulation, given the comprehensive and structured approach of the Act.

As the prevalence of AI continues to grow, regulation will no doubt mature, too. Providing guardrails for organizations to develop AI safely will help build public trust, adoption and innovation, so regulation should be seen as positive and a way to unleash innovation.

What can organizations do to prepare for the EU AI Act?

Firstly, organizations can start to look at where they are adopting AI and conduct a risk assessment aligning with the risk levels in the EU AI Act. This will help them to measure future impacts in advance and adjust their development.

Secondly, they should ensure there is accountability at the executive level and across the organization as to what use cases are being developed and the purpose of each of them, checking that the development of the system and training datasets are aligned with that purpose.

Related:AI at Work: Navigating the Path to Productivity Without Burnout

Thirdly, as the AI systems are created, the development team should ensure the algorithms are well documented, so they are explainable and transparent.

They should also ensure the datasets used for developing the algorithms are fit for purpose, the data is fair and any outputs from the AI system are respectful of fundamental rights.

Once developed, the AI system will need to be monitored regularly to ensure there are no risks or issues emerging.  Furthermore, organizations should invest in data literacy and AI training so that all employees understand ethical risks or issues.  

Finally, organizations should engage with their regulators where they can collaborate in forums and working groups and shape initiatives in this space.  This will help organizations and regulators prepare for the future.