Blog
What the EU AI Act means for your business
The EU AI Act has been a long time coming. What do we know so far, and what does it mean for your organization?
Lauren Diethelm, AI Content Marketing Specialist, OneTrust
December 11, 2023
After months of deliberation, and a 3-day final trilogue, the EU reached a deal on the EU AI Act on December 8th. Designed to be broad and industry-agnostic, the AI Act aims to strike a balance between protecting innovative AI and ensuring that peoples’ safety and fundamental human rights are protected when they’re interacting with AI systems.
Breaking down the AI Act
The EU AI Act takes a risk-based approach to regulating AI and creates categories including the following: unacceptable, high, minimal, and low risk. Unacceptable risk systems are prohibited by the AI Act and can’t be used. Most minimal and low-risk systems, like email spam filters, can be used without any additional safeguards in place.
The Act also lays out specific guidelines for generative AI (GenAI) systems, such as additional transparency requirements, including disclosing that the content was generated by AI, designing the model to prevent it from generating illegal content, and publishing summaries of any copyright data that was used for training the model.
Systems categorized as high-risk by the AI Act can be used, but they have additional requirements they need to meet before they can enter the market or be widely used. For example, high-risk systems may have to undergo conformity assessments.
Conformity assessments determine whether a high-risk AI system has met additional requirements, which are:
- Risk management system
- Data governance
- Technical documentation
- Record keeping
- Transparency and provision of information
- Human oversight
- Accuracy, robustness, and cybersecurity
Conformity assessments must be completed before an AI system is put on the market and available for public use. Once the assessment is complete and the system is widely available, conformity assessments should be performed again any time the system goes through substantial changes.
These assessments are typically performed by providers or developers of high-risk AI systems. But in certain cases, they may be conducted by responsible actors, which may be a distributor, importer, deployer, or other third party.
Foundation model debate and general-purpose AI systems
In the evolving landscape of AI regulation, the Act encountered a significant hurdle in early November concerning the regulation of foundation models, which are central to generative AI systems and utilize data from diverse internet sources. Initially, there was consensus on a tiered regulatory framework, applying stricter rules to more potent systems. However, during the trilogue meeting on November 10, major stakeholders like Germany, France, and Italy opposed any special regulation for foundation models. They argued that imposing tiered regulations on certain systems could inhibit innovation and undermine the Act's overall risk-based methodology.
Despite these challenges, legislation has progressed to include the dynamic nature of general-purpose AI (GPAI) systems and their integration into high-risk areas. This not only covers the various uses of GPAI systems but also their specific applications.
Specifically for foundation models, new rules have been set. Renowned for their versatility in performing complex functions such as generating videos, texts, images, and engaging in advanced language interactions, these models are now subject to strict transparency requirements before they enter the market. The regulations are particularly stringent for 'high impact' foundation models, characterized by their large-scale data training, complex functionalities, and superior performance, which could pose systemic risks in multiple sectors.
Guardrails for general AI systems
The regulation of general AI systems has also been refined to accommodate their wide range of capabilities and rapid development. GPAI systems and their underlying models are now mandated to comply with transparency guidelines as initially proposed by the Parliament. This includes the creation of technical documentation, adherence to EU copyright laws, and the provision of detailed summaries of the training content used.
For GPAI models identified as having high systemic risk, the Parliament has secured more rigorous regulations. These models are required to undergo thorough evaluations, address and mitigate systemic risks, perform adversarial testing, report serious incidents to the Commission, ensure strong cybersecurity, and report on their energy efficiency. Until EU-wide standards are established, GPAI systems at risk of causing systemic issues may adhere to existing codes of practice as a means of regulatory compliance.
What the EU AI Act means for your business
Though critical for protecting the safety and fundamental rights of people using AI systems, the AI Act does represent one more piece in the complex puzzle of regulations that companies will have to make sure they comply with.
For companies not operating in the EU, given the extraterritorial effect of the Act, compliance is still a concern. Since the Act is so comprehensive, it can serve as a guiding light for US companies looking to get ahead of the AI governance and compliance curve, just as many companies have been using the GDPR for years.
If you’re not a provider of AI systems, the responsibility of conducting conformity assessments on high-risk systems likely won’t fall to you. Where you will have obligations is making sure you have visibility within your own organization and understand where AI is being used in your business. From there, you can begin to educate employees about risk, offer responsible use policies, and monitor systems for significant changes that may impact their risk categorization.
Next steps
It’s important to note that the EU AI Act isn’t quite a done deal just yet. There’s still technical work to be done regarding ironing certain provisions and stipulations in the Act, and it’s yet to be voted on by the Council or Parliament.
How OneTrust helps
Understanding where AI models are used in your organization and what risk level they fall into is a key part of setting up your AI governance program under the guidelines of the EU AI Act. With OneTrust AI Governance, you can easily maintain your inventory of AI systems across your business.
To get started with your AI governance program and to learn how OneTrust can help you through the process, request a demo today.
You may also like
Webinar
Responsible AI
Overcoming the privacy pitfalls of GenAI
This webinar will explore the key privacy pitfalls organizations face when implementing GenAI, focusing on purpose limitation, data proportionality, and business continuity. Attendees will gain insights into how to navigate these challenges through strong data governance, version control, and detailed model documentation to ensure compliance and mitigate risks.
December 10, 2024
Report
Responsible AI
Getting Ready for the EU AI Act, Phase 1: Discover & Catalog, The Gartner® Report
Getting Ready for the EU AI Act, Phase 1: Discover & Catalog, The Gartner® Report
October 16, 2024
Webinar
AI Governance
California's approach to AI: Unpacking new legislation
This webinar unpacks California’s approach to AI and emerging legislations, including legislation on defining AI, AI transparency disclosures, the use of deepfakes, generative AI, and AI models.
October 15, 2024
eBook
AI Governance
Securing reliable AI solutions: Strategies for trustworthy procurement
Download this eBook to explore strategies for trustworthy AI procurement and learn how to evaluate vendors, manage risks, and ensure transparency in AI adoption.
September 12, 2024
Webinar
AI Governance
Ensuring compliance and operational readiness under the EU AI Act
Join our webinar and learn about the EU AI Act's enforcement requirements and practical strategies for achieving compliance and operational readiness.
August 22, 2024
Video
AI Governance
OneTrust AI Governance demo video
Learn how OneTrust AI Governance acts as a unified program center for AI initiatives so you can build and scale your AI governance program
August 13, 2024
Webinar
Responsible AI
Privacy and AI: Bridging the divide
Watch this webinar for insights on ensuring responsible data use while building effective AI and privacy programs.
July 31, 2024
Webinar
AI Governance
AI governance masterclass miniseries: EU AI Act
Discover the EU AI Act's impact on your business with our video series on its scope, roles, and assessments for responsible AI governance and innovation.
July 31, 2024
Resource Kit
Responsible AI
EU AI Act compliance resource kit
Download this resource kit to help you understand, navigate, and ensure compliance with the EU AI Act.
July 22, 2024
Webinar
AI Governance
From build to buy: Exploring common approaches to governing AI
In this webinar, we'll navigate the intricate landscape of AI Governance, offering guidance for organizations whether they're developing proprietary AI systems or procuring third-party solutions.
July 10, 2024
eBook
AI Governance
Navigating the ISO 42001 framework
Discover the ISO 42001 framework for ethical AI use, risk management, transparency, and continuous improvement. Download our guide for practical implementation steps.
July 03, 2024
Webinar
AI Governance
AI Governance Leadership Webinar: Best Practices from IAPP AIGG with KPMG
Join out webinar to hear about the challenges and solutions in AI governance as discussed at the IAPP conference, featuring insights and learnings from our industry thought leadership panel.
June 18, 2024
Webinar
AI Governance
Colorado's Bill on AI: Protecting consumers in interactions with AI systems
Colorado has passed landmark legislation regulating the use of Artificial Intelligence (AI) Systems. In this webinar, our panel of experts will review best practices and practical recommendations for compliance with the new law.
June 11, 2024
Webinar
AI Governance
Governing data for AI
In this webinar, we’ll break down the AI development lifecycle and the key considerations for teams innovating with AI and ML technologies.
June 04, 2024
Report
AI Governance
Global AI Governance law and policy: Jurisdiction overviews
In this 5-part regulatory article series, OneTrust sponsored the IAPP to uncover the legal frameworks, policies, and historical context pertinent to AI governance across five jurisdictions: Singapore, Canada, the U.K., the U.S., and the EU.
May 08, 2024
Webinar
AI Governance
Embedding trust by design across the AI lifecycle
In this webinar, we’ll look at the AI development lifecycle and key considerations for governing each phase.
May 07, 2024
Webinar
AI Governance
Navigating AI policy in the US: Insights on the OMB Announcement
This webinar will provide insights for navigating the pivotal intersection of the newly announced OMB Policy and the broader regulatory landscape shaping AI governance in the United States. Join us as we unpack the implications of this landmark policy on federal agencies and its ripple effects across the AI ecosystem.
April 18, 2024
Webinar
AI Governance
Data privacy in the age of AI
In this webinar, we’ll discuss the evolution of privacy and data protection for AI technologies.
April 17, 2024
Resource Kit
AI Governance
OneTrust's journey to AI governance resource toolkit
What actually goes into setting up an AI governance program? Download this resource kit to learn how OneTrust is approaching our own AI governance, and our experience may help shape yours.
April 11, 2024
White Paper
AI Governance
Getting started with AI governance: Practical steps and strategies
Download this white paper to explore key drivers of AI and the challenges organizations face in navigating them, ultimately providing practical steps and strategies for setting up your AI governance program.
March 08, 2024
Webinar
AI Governance
AI regulations in North America
In this webinar, we’ll discuss key updates and drivers for AI policy in the US; examining actions being taken by the White House, FTC, NIST, and the individual states.
March 05, 2024
In-Person Event
Responsible AI
Data Dialogues: Implementing Responsible AI
Learn how privacy, GRC, and data professionals can assess AI risk, ensure transparency, and enhance explainability in the deployment of AI and ML technologies.
February 23, 2024
Webinar
AI Governance
Global trends shaping the AI landscape: What to expect
In this webinar, OneTrust DataGuidance and experts will examine global developments related to AI, highlighting key regulatory trends and themes that can be expected in 2024.
February 13, 2024
Webinar
AI Governance
The EU AI Act
In this webinar, we’ll break down the four levels of AI risk under the AI Act, discuss legal requirements for deployers and providers of AI systems, and so much more.
February 06, 2024
Webinar
Responsible AI
Preparing for the EU AI Act: Part 2
Join Sidley and OneTrust DataGuidance for a reactionary webinar to unpack the recently published, near-final text of the EU AI Act.
February 05, 2024
Webinar
Privacy Management
Data Privacy Day 2024: Reflecting on the past year and anticipating the next
Join our panel of expert privacy professionals as they dissect the key happenings in 2023 and how privacy professionals can approach what may occur in 2024.
January 31, 2024
Webinar
AI Governance
Getting started with AI Governance
In this webinar we’ll look at the AI Governance landscape, key trends and challenges, and preview topics we’ll dive into throughout this masterclass.
January 16, 2024
Webinar
AI Governance
First Annual Generative AI Survey: Business Rewards vs. Security Risks Panel Discussion
OneTrust sponsored the first annual Generative AI survey, published by ISMG, and this webinar breaks down the key findings of the survey’s results.
January 12, 2024
Report
AI Governance
ISMG's First annual generative AI study - Business rewards vs. security risks: Research report
OneTrust sponsored the first annual ISMG generative AI survey: Business rewards vs. security risks.
January 04, 2024
Webinar
AI Governance
Building your AI inventory: Strategies for evolving privacy and risk management programs
In this webinar, we’ll talk about setting up an AI registry, assessing AI systems and their components for risk, and unpack strategies to avoid the pitfalls of repurposing records of processing to manage AI systems and address their unique risks.
December 19, 2023
Infographic
Responsible AI
EU AIA Conformity Assessment: A step-by-step guide
A Conformity Assessment is the process of verifying and/or demonstrating that a “high- risk AI system” complies with the requirements of the EU AI Act. Download the infographic for a step-by-step guide to perform one.
November 17, 2023
eBook
AI Governance
Navigating the EU AI Act
With the use of AI proliferating at an exponential rate, the EU rolled out a comprehensive, industry-agnostic regulation that looks to minimize AI’s risk while maximizing its potential.
November 17, 2023
Webinar
Responsible AI
OneTrust AI Governance: Championing responsible AI adoption begins here
Join this webinar demonstrating how OneTrust AI Governance can equip your organization to manage AI systems and mitigate risk to demonstrate trust.
November 14, 2023
White Paper
AI Governance
AI playbook: An actionable guide
What are your obligations as a business when it comes to AI? Are you using it responsibly? Learn more about how to go about establishing an AI governance team.
October 31, 2023
Webinar
The Shifting US Privacy Landscape: Lessons learned from enforcement actions and emerging trends
Stay ahead of US privacy laws as we explore the lessons learned from CCPA and FTC enforcement and how AI is effecting the regulatory landscape.
October 12, 2023
Infographic
AI Governance
The Road to AI Governance: How to get started
AI Governance is a huge initiative to get started with for your organization. From data mapping your AI inventory to revising assessments of AI systems, put your team in a position to ensure responsible AI use across all departments.
October 06, 2023
White Paper
AI Governance
How to develop an AI governance program
Download this white paper to learn how your organization can develop an AI governance team to carry out responsible AI use in all use cases.
October 06, 2023
eBook
Responsible AI
AI Chatbots: Your questions answered
We answer your questions about AI and chatbot privacy concerns and how it is changing the global regulatory landscape.
August 08, 2023
Webinar
Responsible AI
Unpacking the EU AI Act and its impact on the UK
Prepare your business for EU AI Act and its impact on the UK with this expert webinar. We explore the Act's key points and requirements, building an AI compliance program, and staying ahead of the rapidly changing AI regulatory landscape.
July 12, 2023
Webinar
AI Governance
The EU's AI Act and developing an AI compliance program
Join Sidley and OneTrust DataGuidence as we discuss the proposed EU AI Act, the systems and organizations that it covers, and how to stay ahead of upcoming AI regulations.
May 30, 2023
White Paper
AI Governance
Data protection and fairness in AI-driven automated data processing applications: A regulatory overview
With AI systems impacting our lives more than ever before, it's crucial that businesses understand their legal obligations and responsible AI practices.
May 15, 2023
Webinar
AI Governance
AI regulation in the UK – The current state of play
Join OneTrust and their panel of experts as they explore Artificial Intelligence regulation within the UK, sharing invaluable insights into where we are and what’s to come.
March 20, 2023
Regulation Book
AI Governance
AI Governance: A consolidated reference
Download this reference book and have foundational AI governance documents at your fingertips as you position your organization to meet emerging AI regulations and guidelines.
Webinar
AI Governance
AI governance masterclass
Navigate global AI regulations and identify strategic steps to operationalize compliance with the AI governance masterclass series.