#10things you should know about proposed AI regulations

The European Union (EU) has become the first governmental body in the world to issue a comprehensive response to the increase of artificial intelligence (AI) being embedded throughout business and consumer lives. McKinsey reports that the EU has produced draft regulations into the development and ethical and legal use of AI. The proposed regulations currently only apply to AI systems “used or providing outputs within the European Union”, but there are implications for organisations around the world. McKinsey says that most organisations have a lot of work to do to prepare themselves for coming AI regulations; and to actually address the risks associated with AI more broadly.

McKinsey describes a comprehensive AI risk-management program as one that minimises the legal, reputational, and commercial risks of using AI; and ensures that all AI systems are used fairly and ethically. These are 10 things McKinsey highlights:

1. Risk: In 2020, only 48% of organisations reported that they recognised regulatory-compliance risks, and even fewer (38%) reported actively working to address them. Far smaller proportions of the companies surveyed recognised other glaring risks, such as those around reputation, privacy, and fairness, McKinsey reports.

2. Competitive: McKinsey says it is alarming that so few companies have addressed the risks associated with AI, as AI presents tremendous opportunity for advancements in technology and society. “It’s revolutionising how organisations create value in industries from healthcareto miningto financial services. For companies to continue to innovate with AI at the pace required to remain competitive and reap the greatest return on their AI investments, they need to address the technology’s risks.”

3. Returns: Companies that are seeing the highest return from AI investment are those that are also engaged far more in active risk mitigation.

4. AI future: The EU regulations are the only benchmark in the industry right now, specifically concerning AI, so if companies take steps now towards compliance, they will be ahead in understanding the implications; as well as mitigate other, nonregulatory AI risks.

5. Regulation: In terms of the EU draft legislation, AI systems in the unacceptable-risk category would no longer be permitted in the European Union – such as subliminal, manipulative, remote biometric ID systems or all forms of social scoring. High risk systems are those that evaluate consumer creditworthiness, recruitment, biometric ID; and need the following to be in place, according to McKinsey: human oversight, transparency, cybersecurity, risk management, data quality, monitoring, and reporting obligations.

6. Oversight: The draft legislation includes oversight obligations, such as, conformity assessments; understanding of the systems and their function; and organisation-wide cyberrisk management practices.

7. Transparency: Users of AI systems must be informed that they are interacting with machines, as well as whether the AI system in question uses emotion recognition or biometric classification; and if content has been generated or manipulated by AI.

8. Penalties: While enforcement of the regulations is up to EU member states, as with GDPR, penalties will probably be phased in, says McKinsey.

9. Timelines: It took seven years for the GDPR process from proposal of legislation to implementation, so McKinsey expects a similar timeline to adoption for AI regulations – in about 2027.

10. Compliance: There are already AI systems regulations in place in other pieces of legislation globally, creating oversight mechanisms, such as GDPR; the Canadian algorithmic impact assessments; US financial regulations; and Federal Trade Commission enforcement of unfair trade practices using AI.

*For more, read McKinsey’s report, What the draft European Union AI regulations mean for business.

Main image credit: Photo by Tara Winstead from Pexels.

– Receive the Retailing Africa newsletter every Wednesday • Subscribe here.