Dan Nechita, an EU AI Act negotiator, breaks down the regulation's four risk tiers for AI systems. High-risk applications require risk management, data quality checks, logging, and fundamental-rights assessments. Customizing an off-the-shelf model can push it into high-risk territory, shifting liability to whoever modified it.
Chapters
Let's think about the risk levels, right? So you mentioned unacceptable risk, high risk systems, limited risk systems, and essentially no risk systems like the ones that you find in agriculture, et cetera. So maybe when you think about kind of the different levels of risk here, what are the implications from a regulatory perspective if you're an organization like rolling out use cases that could fit these different risk criteria? I know no risk, there's no regulation here. But maybe walk me through what are the implications from a regulatory perspective if I'm an organization looking to maybe look at a limited risk system, for example, which I think where maybe the majority of use cases sit, if you're an.
Average organization, recall I was saying this is a very long and complex regulation, right? So I think it is case by case. But I'll try to generalize in terms of the implications and I'll walk through all of them. I think that in prohibitions it's fairly clear, right? Like if you engage in one of those prohibited practices, well, you don't want to do that for sure. The fines and the consequences for that are really, really, really high and are meant to be very, very dissuasive. For if you're building a high risk case system, now we're talking about those building, then you have a certain set of obligations that are comprised in a, you know, what we now call a conformity assessment that you have to fulfill before placing that system on the market. And that deals with having a risk management system in place, having good data quality, good data governance, maintaining logs, maintaining documentation, ensuring that you have an adequate level of cybersecurity for the system and so on. So those are obligations. If you build it, if you use it, you have a number of obligations depending on the type of entity that we're talking about. So public authorities and those who are providing essential services. So of course that would be, you know, have the highest impact on fundamental rights. They have the obligation to conduct a fundamental right impact assessment before putting the system into use. And that fundamental right impact assessment is in a sense a parallel to the data protection impact assessment that comes from the gdpr. But it is really focused on making sure that within a specific context of use, the AI system, when you use it, really performs in accordance with what it was supposed to do. So say, for example, you use it in a, you know, a neighborhood that is, you know, mostly immigrants, is the system really going to perform the same as if you were to use it in your average neighborhood? And if not, you know, what are the corrective measures that you're Taking to ensure that it doesn't lead to discrimination then the limited risk, in a sense that's very simple on the provider side. So those who build those chatbots, those systems that can generate deep fakes and generative AI that generates contents, need to make sure that the content is labeled and that's on the deployer side. And then of course on the provider side, on the deployer side, of course there is also a best effort obligation that this happens in the AI value chain. There is a lot more actors here. So there's different targeted obligations for different actors. So say for example, you take an off the shelf system and then you transform it into, you customize it to fit your personal, your company's needs. And whether by intent or by just the way you deploy it, that becomes a high risk a system. Then you take on the responsibilities from the previous provider because of course once you've modified it, you've changed the intended purpose of the system. I think that to also go broader than the technical explanation, I think that the general implication for those who deploy AI would be to check their systems against the use cases in the regulation that are considered to be high risk. If it is, then of course you need to follow all the rules in there applicable. But also I would say if it's in the gray area, in a gray area that might or might not be. Look, the intention behind the AI act is to make those systems safer. Safe means more trust. It means a competitive edge on the market. None of these are considered bad systems, it's just that they're made safer. So in the gray areas around those use cases, I think that the implication would be to try to get as close to conformity as possible. But that's a whole nother story how to do that.
