The proposed EU AI Act takes a comprehensive approach to regulating artificial intelligence, laying down obligations for providers and deployers in an effort to ensure safe and ethical use of AI technology. To do this, the EU has proposed the first regulatory framework for AI, including categorizing risk levels for different systems. 

Breaking down risk levels

The draft EU AI Act breaks down risk for AI systems into four different categories: 

1. Unacceptable
   
   
2. High
   
   
3. Limited
   
   
4. Minimal risk systems

Unacceptable risk  

This category bans AI systems that are clear threats to human safety or rights. For example, toys with voice assistance promoting dangerous behavior or social scoring by governments that might lead to discrimination are considered unacceptable. 

High risk 

The draft EU AI Act considers AI systems that pose a threat to human safety or fundamental rights to be high risk. This can include systems used in toys, aviation, cars, medical devices, and elevators – all products that fall under the EU’s product safety regulations. 

High risk systems can also include things like critical infrastructures (like transport systems) where a malfunction could endanger lives. But aside from physical safety, these risk levels are also designed to help protect human rights and quality of life; for instance, scoring exams or sorting resumes with AI is considered a high-risk system, as it could impact someone’s career path and future. 

Various law enforcement activities are also considered high risk, like evaluating the reliability of evidence, verifying travel documents at immigration control, and remote biometric identification.

Limited and minimal risk 

This level targets AI systems with specific transparency needs, like using a chatbot for customer service. Your users have to be aware that they’re interacting with a machine and be given the opportunity to opt out and speak to a human instead. Limited risk systems rely on transparency and informed consent of the user, as well as giving them the easy option to withdraw.  

Minimal risk is the lowest level of risk set forth in the AI Act, and refers to applications, like AI-powered video games or email spam filters. 

Generative AI

Recently, the EU Parliament introduced amendments that address Generative AI and impose additional transparency rules for its use. Negotiations between the European Parliament, Council, and Commission have also focused on the tiering of foundation models, and so we may see additional clarifications around their use. 

AI tools like large language model-backed chatbots (think ChatGPT) may have to follow additional rules like revealing that the content was produced using AI, ensuring that the model isn’t creating illegal content, and publishing summaries of copyrighted data used for training. 

Putting risk levels into context

It’s one thing to see the EU AI Act’s risk levels laid out, but it’s another to understand how they fit into your daily business operations. 

Using automated workflows

Unacceptable risk systems, as the name suggests, are prohibited by the AI Act, and therefore can’t be used by anyone in your organization. A tool like OneTrust AI Governance will automatically flag and reject any systems that are categorized in this level of risk, protecting your organization and freeing up your team’s time for other reviews.

On the other end of the risk spectrum, limited and minimal risk systems can be automatically approved by your AI Governance tool, allowing your broader team to move forward with their project and continue to innovate with AI. 

In both these risk cases, the decision of whether to approve or deny use of the system can be done automatically by your tool, as the guidelines are clear either way. Where things get less clear is when it comes to high-risk systems.  

Diving into high-risk systems

Systems that are deemed high risk aren’t automatically banned under the draft EU AI Act, but they do have more requirements that need to be met before that system can be deployed. These requirements demonstrate that the technology and its use doesn’t pose a significant threat to health, safety, and fundamental human rights. 

Developers of AI systems determine their system’s risk category themselves using standards set forth by the EU. Once the systems determined high risk are in use, the deployers have responsibilities for ongoing compliance, monitoring, human oversight, and transparency obligations once they decide to put a high-risk system to use.

This ongoing compliance and monitoring can take a lot of manual labor, so finding ways to automate these reviews will save your team a lot of time. OneTrust flags high-risk systems for manual review, so they aren’t automatically rejected, but your compliance team does need to take the time for due diligence to decide if using the system – and taking on the additional operational responsibility – is worth it, or if it would be better to pursue a different system instead.

See it in practice: Building personalized marketing emails using GPT-4

To see how a real project might move forward using an AI system and an AI Governance tool, here’s a practical example. 

Suppose your marketing team wants to use OpenAI’s GPT-4 to create personalized marketing emails. This is the project initialization phase, where a team identifies a use case for an AI system and needs to get it approved. 

Your compliance team would then need to conduct an assessment to determine if the system makes sense and is safe to use. OneTrust offers these accessible and concise assessments, where the project owner can lay out their goals and intentions. 

From there, the project needs to be assigned a risk categorization. OneTrust automates this process by assessing the project and automatically assigning a risk level, as explained above. 

Depending on the level of risk assigned, your team can then expedite deployment of their project. In this case, the use of GPT-4 has been deemed low-risk by the AI Governance tool, and is automatically approved for the marketing team to move forward with their project. 

Innovate with speed and safety

The OneTrust AI Governance solution offers more than just compliance with the EU AI Act. It's a complete solution for overseeing AI activities in your organization. 

We help you innovate faster without neglecting safety, whether you're dealing with the EU's regulations or other governance challenges. 

Request a demo today to explore how OneTrust can play an integral role in your AI journey.