EU AI Act: Essential Compliance Strategies for SMBs

The EU AI Act and SMB Compliance

The EU AI Act is a significant piece of legislation that has far-reaching implications for businesses operating within the European Union (EU), particularly for small and medium businesses (SMBs). The Act aims to regulate the use of artificial intelligence to ensure safety, transparency, and accountability in AI systems.

Broad Application of the Law

One of the critical aspects of the AI Act is its broad definition of an “AI system.” It describes an AI system as a machine-based system designed to operate with varying levels of autonomy and may exhibit adaptiveness after deployment. This definition encompasses a wide range of software applications used by many SMBs.

Businesses must understand the various roles defined by the Act, including:

• Provider: Any entity that develops an AI system or contracts someone else to do so and places it on the EU market.
• Deployer: Any individual or organization using an AI system (excluding personal use).
• Importer: Any entity in the EU that brings an AI system to the market under its name or trademark from a third country.
• Distributor: Anyone in the supply chain, other than the provider or importer, who makes an AI system available on the EU market.

If your company engages with AI systems in any capacity, it is crucial to remain informed about the Act’s requirements.

Documentation Requirements

SMBs must determine if the AI systems they work with qualify as high-risk. If so, they are obligated to establish several documentation protocols, including:

1. Risk and Quality Management Systems: Identifying and managing risks to health and safety.
2. Data Governance Program: Ensuring the provenance and quality of training data to mitigate biases.
3. Detailed Technical Documentation: Describing the design, development process, and performance of the AI system.
4. Transparency: Providing clear information on the AI system’s capabilities and limitations.
5. Accuracy, Robustness, and Cybersecurity: Ensuring consistent performance and resilience against attacks.
6. Post-Market Monitoring: Continuously gathering data on the AI system’s performance and compliance.
7. Human Oversight: Ensuring human operators can respond appropriately to the AI system’s operations.

Even systems classified as low-risk must comply with additional requirements related to technologies that create lifelike content, known as deepfakes.

Expanding Liability Risks

Under the EU AI Act, SMBs face increased risks of both government and private legal actions. The Act establishes fines for non-compliance, which can impose a significant financial burden on smaller organizations.

Furthermore, proposed changes to the Product Liability Directive (PLD) may create a presumption of defectiveness for AI products that do not comply with mandatory safety standards. This change could facilitate legal actions by private parties against AI providers.

ISO 42001 as a Risk Management Tool

Published in late 2023, ISO 42001 is a compliance standard that outlines best practices for establishing an AI Management System (AIMS). Following ISO 42001 can help organizations build customer trust and ensure effective AI governance.

Compliance with ISO 42001 is likely to be recognized as a harmonized standard under the EU AI Act, providing a pathway for high-risk AI systems to demonstrate compliance. Implementing ISO 42001 involves:

• Defining organizational roles and responsibilities related to AI.
• Monitoring for incidents and non-conformities.
• Conducting AI risk and impact assessments.

Additionally, the standard offers optional controls to promote responsible AI development and effective data governance.

Conclusion

The EU AI Act represents the most significant regulatory effort regarding artificial intelligence to date. As it comes into force over the next two years, SMBs with any exposure to the EU market must evaluate their operations to ensure compliance.

Certifying an AI Management System under ISO 42001 not only provides a legal defense in specific scenarios but also enhances organizational resilience and responsibility in using AI systems.