AI Literacy Under the AI Act: An Assessment of its Scope
The AI Act introduces significant measures aimed at enhancing AI literacy among stakeholders involved in the operation and use of AI systems. Specifically, Article 4 mandates providers and deployers of AI systems to ensure that their staff possesses a sufficient level of AI literacy tailored to their roles and the contexts in which these systems are employed.
Understanding AI Literacy
According to Article 3(56) of the AI Act, AI literacy encompasses the skills, knowledge, and understanding necessary for informed deployment and engagement with AI systems. This includes awareness of both the opportunities and risks associated with AI technologies.
The primary objective of Article 4 is to ensure that all stakeholders involved in AI systems—from operators to end-users—receive adequate training to understand the systems they engage with, as well as the potential benefits and dangers these systems may present. This training is vital, especially in organizations that develop or deploy high-risk AI systems, which necessitate a deeper understanding compared to systems classified under lower risk categories.
The Scope of Article 4
AI literacy is categorized as a sui generis obligation within the AI Act, situated in Chapter I – General Provisions. This positioning complicates the interpretation of the obligations stemming from Article 4, as it appears disconnected from the risk categorizations typically associated with AI systems.
An isolated interpretation could wrongly suggest that AI literacy obligations apply universally to all systems meeting the definition of an AI system as per Article 3(1). Given the broad nature of this definition, such an understanding would significantly expand the scope of the AI Act well beyond its intended audience.
However, when considering the definition of AI literacy in conjunction with Article 4, it becomes evident that obligations may not extend to all AI systems, particularly those not classified within the traditional risk categories. Providers and deployers of AI systems outside these categories are not strictly subject to AI literacy obligations as outlined in the AI Act.
Enforcement Challenges
Enforcement of Article 4 raises a series of questions. Notably, Article 99(3-5) does not stipulate monetary penalties for non-compliance with AI literacy obligations. This absence of financial sanctions creates a paradox where an obligation exists without an accompanying enforcement mechanism, which is typically vital for ensuring compliance.
While market surveillance authorities may possess the power to enforce compliance, the lack of financial repercussions may diminish the perceived significance of AI literacy obligations within the broader regulatory framework. Additionally, Member States have the option to impose their penalties, but this could lead to inconsistencies and fragmentation across jurisdictions.
Identifying AI Systems
For providers and deployers wishing to understand their obligations under the AI Act, a preliminary evaluation of their AI systems is crucial. Identifying which systems fall outside the established risk categories allows organizations to ascertain whether they are subject to AI literacy requirements. This evaluation is not merely a procedural step but a foundational aspect of accountability within the context of the AI Act.
Alternative Sources of Literacy Obligations
For those acting as data controllers under the GDPR, the non-applicability of Article 4 does not eliminate the need for literacy and training obligations arising from other EU legal frameworks. Particularly, for AI systems relying on personal data, adequate training is imperative to comply with accountability measures mandated by the GDPR.
Article 39(1)(b) of the GDPR emphasizes the role of data protection officers in evaluating training requirements, ensuring that staff is adequately prepared to handle the complexities of AI systems, especially in contexts involving personal data processing.
In conclusion, while the AI Act aims to establish a robust framework for AI literacy, the effectiveness of its implementation hinges on clear interpretations of its provisions, consistent enforcement mechanisms, and the integration of complementary regulations like the GDPR. As the landscape of AI continues to evolve, so too must the strategies for ensuring all stakeholders are equipped with the knowledge and skills necessary to navigate its complexities.
