3
by Masha Stochenko and Beryl KubukConsultant, Regulatory Change and Compliance, Synechron
aAfter five years, the European Union's Artificial Intelligence Act (EU AI Act or AI Act) has finally been approved. The EU AI Law is the culmination of thousands of discussions and one of the most comprehensive efforts to date to provide guidance for the emerging field of artificial intelligence. Most requirements apply 24 months after deployment, but some requirements apply after 6 months, and some obligations for high-risk AI systems only apply after 36 months.
The final document underwent multiple revisions during the drafting and consulting stages. The original proposal took a “technology-neutral approach,” which meant that regulations should not be created in technology silos, so the same regulatory principles should apply regardless of the technology used. means. The new amendments clearly depart from this by introducing specific obligations for general purpose AI models.
By introducing specific obligations for general-purpose AI models, the Legislature risks making AI law too fragmented for industries deploying AI systems. This can cause requirements to lose relevance in the face of rapid technological developments. But the challenges posed by this technology, which has been introduced to the public in recent years, are too great to ignore and are causing too much concern in European capitals.
The European Union recognizes the tensions involved in developing rules that are valid now and in the future.in article Explaining the framework, the European Commission (EC) said: “The proposal has a forward-looking approach, allowing the rules to adapt to technological change.”
peel back layers
EU AI law takes a “risk-based approach” with respect to AI systems. Next he has 4 levels.
- No/minimal risk,
- limited risk,
- high risk,
- Unacceptable risk.
The high-risk category includes one example that is highly relevant to financial services organizations. It is an “essential private and public service” (e.g. credit scoring that denies a citizen the opportunity to obtain a loan).
The EU has directly stated that there are some requirements for systems within high-risk areas.
- appropriate risk assessment and mitigation systems;
- High-quality datasets fed into the system to minimize risks and discriminatory outcomes,
- Logging of activities to ensure traceability of results,
- Detailed documentation providing all the necessary information about the system and its purpose required by authorities to assess the compliance of the system.
- Provide clear and appropriate information to adopters,
- appropriate human monitoring measures to minimize risks;
- High level of robustness, security and accuracy.
In other words, the AI Act means that the entire financial system must demonstrate a strong commitment to ensuring the trustworthiness and trustworthiness of AI systems. Failure to comply risks significant fines and regulatory action, which can cripple even the largest institutions.
Understand the legal definition
First, it is helpful to define what AI means in a legal context.
EU AI law defines it as follows: AI system “It is designed to operate with varying levels of autonomy and may exhibit adaptability after deployment, making predictions, content, recommendations, etc. from the input it receives, for explicit or implicit purposes. “machine-based systems that infer how to produce output, or decisions that can affect a physical or virtual environment. ”
This law also General-purpose AI model, Recent advances in AI. These models are developed using algorithms designed to optimize the versatility and versatility of their output. They are trained on diverse data sources and extensive datasets to perform a wide range of tasks, including tasks for which they were not originally designed. Generic AI models can be integrated into a variety of downstream systems or applications. This means that a single general-purpose AI model can be used in many downstream AI applications. As a result, they are becoming increasingly important in a variety of applications and systems.
Challenges for financial institutions
The precise obligations outlined for general purpose AI models, particularly those with systemic risks, require special attention. Financial institutions will need to adjust their development pipelines to fit the new framework while ensuring their existing infrastructure is compliant. This comes as shareholders and investors put pressure on companies to use emerging technologies to offer new products and improve profits.
Processes such as credit scoring, fraud detection, and recruitment are generally classified as high-risk AI systems under AI law. Risk level classification and transparency, accountability, and accountability significantly raise the bar for compliance.
Tight timelines for compliance can strain existing systems and processes, requiring swift and effective action to avoid heavy penalties. The burden of identifying potential risks in the model and implementing governance structures is significant.institution Must I manage this in parallel with my daily work.
Implementation can be a complex process, but once completed, it is consistent and predictable.
Unique opportunities are on the rise.
The AI Act should also create opportunities by introducing a common set of requirements. Traditionally, organizations have made their own decisions about the governance and rules of artificial intelligence, but these decisions are now largely in the hands of regulators. This provides a clear common path to follow. Implementation can be a complex process, but once completed, it is consistent and predictable.
In some areas, it is already clear that AI can deliver value to businesses and customers. For example, AI-driven chatbots streamline customer support and improve user experience. In addition, advanced AI algorithms analyze vast datasets to uncover complex patterns and provide predictive analytics critical for regulatory compliance, KYC/AML (Know Your Customer/AML) purposes, and investment decisions. provide to the institution. And this is clearly just the beginning. New generations of chips promise more computing power and new applications.
The goal is to remove the “black box” element, the magic cube in which technology mysteriously produces results. Instead, AI should be a tool that can be explained and modified as needed.
The requirement to adhere to more transparent standards could pave the way for increased functionality and increased reliability in technology deployments. Organizations expect to be able to understand and explain to the market exactly what their systems and processes are doing and why. The goal is to remove the “black box” element, the magic cube in which technology mysteriously produces results. Instead, AI should be a tool that can be explained and modified as needed.
Moving forward: What steps should financial institutions take?
Now that this legislation has been approved, it's time to conduct a thorough investigation of all current and planned AI applications within your organization. The next step is to conduct a comprehensive gap and risk assessment and classify AI systems into risk levels based on guidance provided by the EU.
High-risk systems must demonstrate that they meet the requirements of the AI Act. Various assessments will be required, including conformity assessments, data protection impact assessments, and other assessments. This will likely include a list of potential risks and how the company will respond if “these risks materialize.”
Institutions need a model risk management framework with appropriate AI governance structures, internal policies, human oversight, model validation, AI system monitoring, record-keeping, and grievance and redress procedures arrangements.
Beyond compliance
AI is driving a massive technology evolution for organizations. Financial institutions serve as responsible intermediaries between society and government by providing important services. As they evolve their business models, they remain sensitive to sustainability, technology development, and other real-world needs and requirements. As the AI environment matures, the need for expertise both inside and outside the enterprise will continue to grow. The EU AI law is just one step for him on a much longer journey.
