Third-Party Risk Management for the EU AI Act
The European Union’s AI Act is a landmark piece of legislation poised to reshape how organizations develop, deploy, and use AI systems worldwide. During the phased implementation stage, organizations must take action to meet compliance requirements.
A critical aspect of this preparation involves understanding and managing the risks associated with third-party AI systems or AI components integrated into their operations. Failure to do so can result in significant financial penalties, reaching up to EUR 35 million or 7% of global annual turnover. This study guides organizations in creating a plan, internal policies, and systems to monitor and report third-party risk in compliance with the EU AI Act.
Understanding the Scope and Implications of the EU AI Act
The EU AI Act adopts a risk-based approach, categorizing AI systems into four levels: unacceptable, high, limited, and minimal risk.
The obligations are directly proportional to the perceived risk, with high-risk AI systems (HRAIS) facing the most stringent requirements. These include AI systems used in areas like critical infrastructure, education, employment, law enforcement, and financial services. Additionally, the Act introduces specific provisions for general-purpose AI (GPAI) models, which are regulated regardless of their specific use case, with more demanding requirements for those deemed to pose a systemic risk.
For organizations engaging with third parties for AI solutions—whether as providers (developing or placing AI on the market), deployers (using AI systems), importers, or distributors—understanding their role and the risk level of the AI involved is paramount. The EU AI Act’s extraterritorial influence means that even organizations located outside the EU but placing AI systems on the EU market are subject to its regulations.
Crafting a Comprehensive Compliance Plan for Third-Party AI Risk
Developing a robust plan is the first step towards managing third-party AI risk under the EU AI Act. This plan should include the following key stages:
- Identify Your Role(s) and Obligations: Determine whether your organization acts as a provider, deployer, importer, or distributor in relation to the third-party AI systems you use or offer. Each role carries specific obligations.
- Map and Classify Third-Party AI Systems: Conduct a thorough inventory of all AI systems or components procured from or provided to third parties. Assess the risk level associated with each system based on its intended use, aligning with the Act’s risk categories.
- Establish Due Diligence Processes: Implement rigorous due diligence procedures for evaluating potential third-party AI providers and their systems before adoption. This should include assessing the provider’s understanding of and adherence to the EU AI Act requirements.
- Incorporate EU AI Act Requirements into Contracts: Ensure contracts with third-party AI providers clearly define responsibilities regarding compliance, covering data governance, transparency obligations, and incident reporting.
- Conduct Risk Assessments for Third-Party AI: Perform thorough risk assessments focusing on the integration and use of third-party AI systems, identifying potential risks to fundamental rights and safety.
- Develop a Compliance Timeline: Align your plan with the EU AI Act’s implementation timelines, noting key dates for prohibitions and requirements.
Developing Internal Policies for Managing Third-Party AI Risk
Well-defined internal policies are crucial for translating the compliance plan into actionable practices across the organization. These policies should address:
- Third-Party Vendor Management: Outline procedures for selecting, onboarding, and continuously monitoring third-party AI providers.
- Acceptable Use of Third-Party AI: Define guidelines for how employees can appropriately and securely utilize third-party AI systems.
- Data Governance for Third-Party AI: Establish rules for managing data shared with or processed by third-party AI systems, ensuring compliance with data governance measures.
- Incident Response for Third-Party AI: Develop procedures for managing and reporting incidents related to third-party AI systems.
- AI Literacy and Training: Implement training programs to ensure staff involved in AI systems have sufficient AI literacy.
Establishing Systems for Monitoring and Reporting Third-Party AI Risk
To ensure ongoing compliance and effectively manage risks associated with third-party AI, organizations need to establish robust monitoring and reporting systems:
- Regular Audits and Assessments: Conduct periodic audits of third-party AI systems to verify continued compliance with contractual obligations.
- Performance Monitoring of HRAIS: Establish mechanisms to monitor the performance of third-party-provided HRAIS.
- Incident Logging and Reporting: Implement a system for logging all incidents related to third-party AI systems.
- Record-Keeping: Maintain comprehensive records related to the assessment, deployment, and monitoring of third-party AI systems.
- Transparency and Information Sharing: Foster open communication channels with third-party providers regarding compliance efforts.
- Establish a Feedback Mechanism: Create a process for internal stakeholders to report concerns related to third-party AI systems.
A Proactive Approach to Third-Party AI Risk
Navigating the complexities of the EU AI Act requires a proactive and comprehensive approach to managing third-party risks. Organizations can mitigate the risks associated with using AI systems from external providers by developing a detailed compliance plan, implementing robust internal policies, and establishing effective monitoring and reporting systems.
Early preparation is crucial. Identifying roles, assessing AI systems, and developing a robust compliance strategy now will help avoid potentially significant penalties and foster trust and responsible innovation in the age of artificial intelligence. Stay informed about further guidance and standards that will be published during the two-year implementation period, and consider seeking expert support to ensure comprehensive compliance.
