What is the EU AI Act
The draft AI act is the first ever attempt to enact a horizontal regulation for AI. The proposed legal framework focuses on the specific utilisation of AI systems and associated risks.
When will it be enforced
Pending final EU procedures (the trilogue), the act will likely be adopted in early 2024 before June 2024 European Parliament elections. Its enactment will be followed by a transition period of at least 18 months before the regulation becomes fully enforced.
The risk-based approach
The draft AI act follows a risk-based approach whereby legal intervention is tailored to concrete level of risk. To that end, the draft AI act distinguishes between AI systems posing (i) unacceptable risk, (ii) high risk, (iii) limited risk, and (iv) low or minimal risk. AI applications would be regulated only as strictly necessary to address specific levels of risk.
Data quality and data governance at a higher level
The draft AI act put high emphasis on the data quality and governance for the adoption of AI.
Potentially new requirements and obligations:
- Obligation to have an appropriate internal organization with an AI management and monitoring system
- Conformity assessment based on quality management assessment and assessment of technical documentation
- A Code of conduct of AI is encouraged to be introduced
- Automated activity (logs) tracking and documentation of AI operation
- Maintain human oversight over machine operation
- Transparency obligation of AI use
- Technical measures for robustness and cybersecurity
Supporting innovation and SMEs
The draft AI act promotes national authorities to establish regulatory sandboxes and real-world-testing, in order to support the develop and train of innovative AI before placement on the market.
CSSF and EU AI Act
While waiting for a European regulatory framework (the EU AI Act proposal), the CSSF has issued some documentation to assist regulated entities in understanding and evaluating the risks related to AI use cases in the financial sector.
