AI and compliance: Staying in the right side of the law and regulations

AI Laws and Governance

AI’s governance is governed by many laws and regulations, some of which overlap. There are also data privacy and security legislation, as well as guidelines and frameworks that set standards for AI use in areas where legal sanctions may not be available.

According to Efrain Ruh of Digitate, the EU AI Act and other AI regulatory frameworks are based on a risk assessment, namely the risks that these new technologies may pose to people.

However, the wide range of applications in this area and the rapid pace of innovation make it difficult for regulators define specific controls around AI technology.

The plethora rules also makes it difficult for organisations to comply. According to research by AIPRMa firm that helps smaller businesses make the most out of GenAI, the US has 82 AI policies and strategies, the EU has 63, and the UK has 61.

Among these, the stand-out law is the EU’s Artificial Intelligence Act, and its first “horizontal” AI law governing AI, regardless of where or how it is used. But the US’s Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence also sets standards for AI security, privacy and safety.

In addition, international organisations such as the OECD, the UN and the Council of Europe have developed AI frameworks. But the task facing international bodies and national law makers is far from easy.

According to White & Case, an international law firm that tracks AI developments“governments and regulatory bodies around the world have had to act quickly to try to ensure that their regulatory frameworks do not become obsolete…

“But they are all scrambling to stay abreast of technological developments, and already there are signs that emerging efforts to regulate AI will struggle to keep pace,” it says.

This, in turn, has led to different approaches to AI regulation and compliance. The EU has adopted the AI Act as a regulation, meaning it applies directly in law in member states.

The UK government has so far opted to instruct regulators to apply guiding principles to how AI is used across their areas of responsibility. The US has chosen a mix of executive orders, federal and state laws, and vertical industry regulation.

This is all made more difficult still by the absence of a single, internationally accepted definition of AI. That makes regulation and compliance by organisations that want to use AI harder. Regulators and firms have had time to learn how to work with regulations such as the General Data Protection Regulation (GDPR), but we are not yet at that stage with AI.

“As with other regions, there is a fairly low level of maturity when it comes to AI governance,” Says Gartner’s Henein. “Unlike GDPR, which followed four decades of organic development in privacy norms, AI regulatory governance is new.”

Compliance with the AI Act, he adds, is made more complicated because it applies to AI features of technology, not just to whole products. CIOs and compliance officers now need to account for AI capabilities in, say, software as a service applications they have been using for years.

Moving to compliance

Fortunately, there are steps organisations can take to ensure compliance.

The first is to ensure CIOs know where AI is being used across the organisation. Then they can review existing regulations, such as GDPR, and ensure that AI projects keep to them.

But they also need to monitor new and developing legislation. The AI Act, for example, mandates transparency for AI and human oversight, notes Ralf Lindenlaub, chief solutions officer at Sify Technologies.

Boards, though, are also increasingly aware of the need for “responsible AI”with 84% of executives rating it as priority, according to Willie Lee, a senior worldwide AI specialist at Amazon Web Services.

He recommends that all AI projects are approached with transparency, and accompanied by a thorough risk assessment to identify potential harms. “These are the core ideals of the regulations being written,” says Lee.

Digitate’s Ruh says: “AI-based solutions need to be built up-front with the correct set of guardrails in place. Failure to do so might result in unexpected events with tremendous negative impact on the company’s image and revenue.”