Regulatory context
The EU Artificial Intelligence Act (AI Act) and personal data protection law make the deployment of artificial intelligence a matter of legal obligation. An organisation that uses solutions based on AI models knows what it is using, for what purpose, on what data and under whose oversight.
The timeline for applying individual obligations is subject to ongoing legislative work, so we base our recommendations on the law as it stands at the time each decision is made.
Key obligations
The scope of obligations depends on how the organisation uses artificial intelligence. For most organisations, the following areas apply:
- staff competence as a formal requirement,
- inventory and register of AI systems,
- risk classification of use cases,
- human oversight that is in place and documented,
- transparency towards employees and end customers,
- compliance assessment of personal data processing in model-based solutions.
Inventory
We begin with a complete picture of the AI solutions operating in the organisation, including the tools employees use every day. This is the starting point for informed management.
We describe each tool using a single template: purpose, users, data processed, processing location and owner. The inventory is part of the AI readiness audit and produces the first entries in the register.
Register and risk classification
The AI system register is a continuously updated list of the solutions operating in the organisation and part of day-to-day management. Every new solution is entered in it before going live, and every significant change is recorded there.
Risk classification sets the appropriate level of control for each use case: low-risk use cases follow simplified rules, while sensitive ones are subject to full oversight. Both elements are part of AI governance and oversight.
Competence and human oversight
The regulation requires people who work with AI solutions to have the appropriate competence. Here, compliance connects with the organisation-wide competence programme: role-specific learning paths are defined and documented, so the organisation can demonstrate who has been prepared and to what extent.
Human oversight rests on the same competence. A person makes the decision wherever it concerns people, money or regulatory compliance, and the person exercising oversight understands how the supervised solution works.
Our role
Interpreting the law and providing legal opinions is the role of law firms. Our role is to design and build a compliant solution: the register, risk classification, oversight, data architecture and documentation. The best results come from both parties working together from the start of the project.
Obligation as an opportunity
The review required by the regulation gives the organisation a complete picture of the tools in use, the data processed and the allocation of responsibilities. This picture becomes the foundation for further implementations.
A regulatory obligation is an opportunity to bring structure to how the whole organisation works with artificial intelligence.