Understanding AI Regulations Across the World | Experts Share All

All right, welcome to the webinar. This is Richie. Now, as I'm sure you're all aware, AI has the power to do great things. The flip side is that it can also cause problems. And that means that regulatory bodies around the world have realized that there ought to be some rules about what you can and can't do with AI. And there have, of course, been some rules for a long time, but these have been mostly restricted to specific industries or use cases. And with generative AI thrusting AI into the public consciousness, the time has come for a raft of more thorough legislation. The EU AI act is the most developed since it's actually been approved. And that's going to form the basis of our discussion today. But there are some other upcoming laws around the world that we'll also touch on. Our guests are Shalini Kurupati, the CEO and co founder at Clearbox AI. So Shalini is. Well, Clearbox AI is a synthetic data platform and Shalini leads the strategy, operations and business development there. She's also a certified Information Privacy professional for Europe, covering data protection regulation in the eu, focusing on gdpr. And Shalini was previously a fellow at Politecnico de Torino. She's been a data steward at Delft University of Technology and managing partner at Stochastica AI Consulting. Shaleen's also the instructor of the Data Camp courses Introduction to Data Ethics and Understanding gdpr. Definitely course is worth taking. Our second guest is Nick Reiners. So, Nick is a senior analyst at Eurasia Group. His research focuses on the technology policy environment of the EU and its member states, focusing on issues such as platform regulation, data flows, AI competition and trade. So before that, Nick worked for the UK government, where he's responsible for the UK's policy on the free flow of data. And he also worked as a diplomat at the UK Mission for the eu, representing the UK government in meetings with the council of the EU, which included negotiations on the EU's reforms to copyright rules. And he also took part in negotiations on post Brexit free trade agreements between the UK and the eu. So welcome Shalini and Nick. All right, wonderful. Glad to have you both here. I feel like there's a lot of exciting stuff to cover today, so I want to just by talking about why are AI regulations needed? Nick, do you want to go first?

Sure. And thanks for having me. Pleasure to be here. You sort of covered it in your intro, really, because as everyone knows, AI, it's kind of a cliche at this point, but AI has opportunities and also risks. But more seriously, it's quite normal that we regulate new technology to try to maximize the good aspects and minimize the bad and to ensure that businesses have the right incentives. So we avoid a kind of race to the bottom dynamic. So when you have one clear set of regulation, that means every company is playing by the same set of rules and has to adhere to the same standards. And then no one can gain a competitive advantage by releasing unsafe products. So that's quite normal as it applies to physical products like airplanes or cars, for example. And we have the same kind of thing with digital products. We've all seen the problems that have come from the social media landscape being unregulated. So there's quite a consensus building around the world that we don't want to repeat with that with AI and we don't want to wait until a catastrophe happens before regulating. Better to regulate and avoid that happening in the first place.

Absolutely. I certainly wouldn't want a world where cars were completely unregulated. That sounds terrible and a source of possible disasters. So, yeah, I feel like the same thing is true for AI. Shalini, do you want to talk me through, like, what the most important AI regulations are that Data and AI practitioners need to know about?

Yeah, absolutely. Just to reiterate what Nick was saying, like right now in the AI landscape we are a little bit of a wild west. You know, there are not really regulations about how to use it, especially when they're going to impact the fundamental rights of people and the way that they are going to. For instance, now AI is being used in almost every domain. It's very far reaching. And if that's going to have an impact on people's lives, of course we need to be sure that people's rights are respected, economies are respected and democracy is respected. Of course, in terms of regulations, as you had also mentioned earlier, one of the most comprehensive and kind of wide ranging regulations is from Europe, the EU AI act, which is probably also covering all the European countries. It's not just from one nation, however, it's not the only one. There are also other countries that are being regulating in. China already has some kind of AI regulation and a couple of days ago Japan even published their intention to regulate. And of course United States, not at the federal level, but like at the state level, like New York for instance, has, you know, already set out something on the anti discrimination in terms of hiring. So it's a little bit more fragmented. But I have to say, if you have to consider like the law that kind of, you know, which is very comprehensive and Covers pretty much all the technologies and applications would be the EU AI Act.

Okay, so the EU AI act is a big one, but there are some of the regulations around the world. Okay, excellent. And so you mentioned that AI is sort of, it's taking over like every single industry. I'm curious as to whether there are any particularly industries or areas of business that are going to be most affected by regulations around AI. Actually. Yeah, Shiling, do you want to take this one again?

Yeah, of course. As a practitioner, what we see is the adoption of AI is also a bit more seen seen industries that are a little bit more ready, like the finance, banking, insurance companies that have a history of already like, you know, collecting data, doing analytics, but not necessarily with AI. They already can easily, you know, get into the AI wagon quite easily because they already have some kind of infrastructure and skills and industries that have, you know, have already done automation for instance, like those are also much more ready to start using it. However, some industries that are especially heavily regulated, like healthcare, even though the potential is great, we see a lot more in the research and development and not really in production. So we see some of the companies that are actually actively using these are definitely among the, you know, leading the pack of banking financial institutions.

Okay, that makes sense that the sort of the industries that are already quite heavily regulated, so finance and healthcare, this is where and they're all also very data heavy industries. This is where the AI regulations are going to have the most impact. Nick, I don't know whether there's anything you want to add to that.

I mean when it comes to the eu, it will automatically the AI act will apply to all the these kind of heavily regulated sectors. Actually was mentioning cars or machinery, these kind of things where it's perhaps a bit novel is where it applies to fundamental rights. So HR software for example, where it uses AI will count as high risk because it has the potential to affect your life in a big negative way if an HR system is used to hire or fire you. That kind of thing is a bit new and I think startups may struggle to adapt to the AI acts and some of the requirements contained within it.

Okay, yeah, so that HR example in particular seems very important because a lot of companies are now trying to have some sort of automation to their hiring float. You get 500 people apply to a job. It's like you want some way to filter out before a human looks at it. And so yeah, I can certainly see how that's going to impact an awful lot of companies. Okay, so let's get into like what the EU A act involves. So maybe just at a high level, what does it cover? Nick, do you want to go first on this?

Yeah. So the AI act is a kind of hybrid of this traditional EU product safety legislation and this more novel fundamental rights focused kind of legislation. So on the one hand it deals with these kind of physical products and on the other hand, like I was saying things like HR or Shereen was saying, financial services, this kind of thing. So it's very comprehensive. That's the main thing about it. It's a horizontal piece of legislation. It applies in theory to all sectors. In practice it designates a set of sectors as high risk. And this is the meat of the legislation is focused on these high risk applications. And developers and deployers of these high risk AI applications have to abide by a long list of requirements to make sure that the AI is going to operate safely and reliably. So that's the meat of it. It also notably prohibits certain so called unacceptable AI use cases like social scoring China style social scoring applications or AI that's used to manipulate you to carry out something that you wouldn't otherwise do this kind of thing. But the main part of the legislation is focused on these high risk applications.

Okay, excellent. So high risk applications seems to be the big focus. Shalini, do you want to make this a bit concrete? Have you got any examples of high risk applications of AI?

Yeah, absolutely. Anything that has to do with healthcare, AI, anything that has to do that will give you access to credit. So if a bank is using an application to give you a mortgage or not, that would be considered high risk because it has impact on your ability to access credit. Obviously there are also medium to low risk applications. Like, you know, for instance, people don't realize that their spam filter is kind of an AI application. And that doesn't really. They don't have to do much about AI act, for instance. And the other important thing probably just to add to what just Nick said, is they have added a legislation for the foundational models, which is the generative AI, the LLMs. They are considered the category called systemic risk, which is like they are so general purpose that it's really hard to kind of place them in any of these risks. So they, I think, I don't know if they are high risk or higher risk, but they have also a lot more obligations in terms of what they have to do or not. There's one thing that which is also interesting because there are also some applications which are not under AI act, which are kind of extreme exempted. Like if you do research in AI, you are allowed to do it. I mean, you don't have to worry about all the legislative requirements. If you think of putting, you know, creating open source free AI software, if you don't put it in the market, you're, you're not allowed, you don't have all these obligations. However, if you take that piece of software and build an application, put it in the market, of course you need to, you know, and naturally the military and national security things don't fall under AI Act. So the most important thing is if you think for either any kind of application, the good practice is to have kind of follow what the AI act requires. So most often it's really about technical documentation about how your models are built. The data that you have acquired, how are you treating the data? At the same time you have something called the conformity assessment, like is your product safe? Have you tested it enough? So there are a bunch of technical details that you need to follow. And even if you are not high risk, it's actually good practice to do it because it's also good for your efficiency.

Okay, yeah, so it certainly seems like a good idea that you know if the model you're creating is going to be safe or not before you sort of release it into the wild for the public. Now, something you both mentioned is the idea of high risk or low risk applications. I'm curious as to how it's determined, like whether something is high or low risk. Is there some sort of classification and what's it involve? Nick, do you want to take this?

Yeah, it's actually pretty simple. There's a list of all the high risk applications in an annex, the AI act called Annex 3. So this was, as you can imagine, heavily debated in the course of the negotiations for the Act. None of the sectors wanted to be listed as high risk. But now, now there is a simple list so you can look it up. I mean, I would say for your audience that there's quite a lot of resources out there online to help you comply with AI acts, to help you work out if what application you're developing is high risk or not. So we can certainly share some of those things. But yeah, there is a list, a simple list that has all these things like insurance, financial services that we were saying it can get a bit more complicated than that if you have a high risk component of a non high risk. So you know, it's not always as straightforward as that. But in theory that they are just listed.

Okay, that seems fairly straightforward. Hopefully fairly easy. I'm wondering whether there's any way to like argue the case if like you think your application's low risk but it's on the high risk official list or something, is there some feedback mechanism there or is it just like it's high risk? You don't.

Actually that's a very good question and nobody knows the exact answer today because also the governance of the system within the organization also the monitoring bodies are still not yet there. Like even the, you know, right now for GDPR we have like national data protection authorities who oversee everything. Now for AI act, we are still understanding who will be that person in each of these, each of the countries. And of course enforcement is one thing, but it's really again also to just quote gdpr, it will be on the proportionality. Like what's the impact? What impact do you expect this application to have? And if you can easily prove that this will actually impact fundamental rights of people, will it impact privacy? Will it impact, is it biased? So if some of that, like for instance, we had a question from an insurance company. They were, they were planning to, you know, create a behavioral policy pricing based on the, you know, data of people. So basically they take your driving behavior and give you a policy that has a lower premium compared to the other non safe drivers. And there they were asking is it high risk or is it low risk? Because I would say it's medium high. Because there is a chance of discriminating people based on you have to show that you are pricing it fairly and not because it shouldn't be based on gender, but shouldn't be based on the actual behavior. So these are some of the discussions you need to have within your company to actually. And of course it's better to err on the side of caution because anyway the requirements that AI is going to ask is actually going to make your models more robust because one of the principles is like you need to make sure that the data sets that you have trained, your models are representative of actually the people that you are going to put it out there for. And even if you don't do it for a act, your product will be a lot more robust.

Okay, yeah, so that seems like an important point that you shouldn't just go for the bare minimum of complying with the laws just in order for people to actually accept your product. And you, you're probably going to want to go a bit above and beyond and just make sure your product is generally safe, it's generally doing the right thing, it's fair and so forth. Okay, now the thing you mentioned a minute ago was generative AI and I'm curious as to whether generative AI is treated differently to more traditional machine learning. So Shalini, can you talk about, is there a difference within the regulation about this?

No, actually generative AI is considered AI. Like it's, you know, machine learning, deep learning, any of these technologies is considered AI. And the definition of AI is taken from oecd. You can look at the OECD definition of AI and any technology that falls into this is under the AI Act. It's not just generative AI. And generative AI has the systemic risk approach of the LLMs, which is, which was added recently.

Okay, yeah, I can't remember the OECD definition of the. I seem to remember it's very broad though. It's just like something that takes inputs and then machines do stuff and then you get an output. Right. So it's like, I don't know, probably even like your home, like temperature controls are technically AI. I don't know. Do either of you know the definition in more details or just going to make people look it up? I'm sure everyone can. Everyone can Google it. Right. Did you have anything to add on generative AI and how it's regulated?

Yeah, and SH is right. AI doesn't talk about generative AI as such, it's just AI. But it does have this category of so called general purpose AI systems which are treated a bit differently. And these were introduced into the regulation as a kind of response to the explosion of ChatGPT, because until ChatGPT came along, the idea was that the AI act would only regulate applications as opposed to AI itself. So this kind of threw the logic of the act on its head. But now there are some rules for these general purpose AI systems. Not only do they have to respect copyrights and publish a summary of the training data they use, so that's a big one. And then as Shaleen was mentioning, there's this special category of general purpose AI models with systemic risk, which are for the real, the biggest, most complex models. They're only the models that were trained on, I think 10 to the 25 flops of total compute. So at the moment I think only Gemini and GPT4 qualify. The idea is to capture these very highly capable foundation models and they have to implement extra obligations like on cybersecurity and red teaming evaluations, that kind of thing.

Yeah. Just to add to that, they actually remove the flops in the latest draft because it's hard to keep up with the, it's changing so rapidly that in the, in the approved draft they actually remove the flops requirements, which is actually a good thing because otherwise, you know, in a couple of months there will be even more, you know, less, less flopped models which would be more powerful. But so they actually removed it as of as we speak.

All right, up to the date. Up to date news. That's, that's fascinating. Okay, so I'm curious as to what happens if an organization fails to comply with the regulations. What's the penalty here? Go on. Oh, Nick, you answer this one first.

Yeah, it varies. So if you violate the prohibitions chapter. So if you, if you market one of these prohibited AI systems that tells you to commit self harm or what have you, then the penalties are pretty severe. 7% of total revenue for the high risk for violating the high risk rules. It's only 3% of total annual revenue. So still pretty, or I think 35 million euros. So it's still quite severe and worth taking seriously.

Yeah, that's enough to make a big difference in a company's fortunes I think, especially if you fall off the sort of thing repeatedly. Shalini, is there anything you want to add on that? On like what, what the consequences are?

No, no, no. Actually it's, it's the financial penalty. They can bite. It's like gdpr.

Okay, all right, so worth making sure you comply I think is the, is the takeaway from this. All right, so let's go beyond the, the EU stuff and talk about the rest of the world. So maybe we'll begin with the usa. What's happening in the world of regulations there? I don't know who wants to take this?

Maybe I can start and of course Nick will be happy to compliment me. Like I already said, in, in the US there is already a state level legislation with a PC like New York and there are some executive orders on safe AI practices and ethical AI and trustworthy AI. And especially the executive order was very similar to the EU AI act as well. Like it has a lot of parallels and there are some regulations on the use of AI in governance and something on how public officials should be actually trained in AI. But there's nothing very comprehensive on the federal level and there are still some drops that are being discussed. But I think outside the U.S. i think China has already implemented a few of these regulations. However, it's not much more on the fundamental rights of the citizens, but it's mostly for the, the country, the, you know, the betterment of the country itself. So that's also the two different things that we see geopolitically on the Western Hemisphere. Sorry, hemisphere. On the Western part of the world, we see much more on the fundamental rights, whereas on the countries like China, it's much more on, you know, the development of the country rather than the citizens itself. So these are the two things that we. We see outside the eu.

Okay, so with the us, it's kind of. It sounds like it's broadly following the EU approach, but China is a little bit different. Nick, do you want to go into more depth on, like, how China is different from the EU regulations?

Yeah, briefly. On the. On the US before, before I get into China, I think just to note that there is kind of. There is quite a lively debate taking place in Congress about how to regulate AI. And AI regulation has become more likely than perhaps it seems just a few months ago, even though under the current Congress, it's not very likely, given it's so divided. But Senate Majority Leader Chuck Schumer has led quite an intense bipartisan process to look at AI regulation. And just yesterday he published a roadmap towards AI regulation. So that's worth checking out. So there's a really interesting debate going on there. And as you say, it does take some inspiration from what the EU is doing. And so there's a certain amount of. Well, I wouldn't want to exaggerate the extent of convergence, but there is some convergence taking place, which is helped by processes like the G7 Hiroshima process led by Japan last year, which aligned on certain principles of generative AI. So we're seeing a certain amount of convergence. But as we know, it's never easy to pass any legislation in the us, at least at the federal level. So in the meantime, actually insert the actions at the state level. So that's the US when it comes to China, they are a leader in many ways in terms of AI regulation, not so much in this horizontal, comprehensive way like the eu, but they were among the first to adopt vertical sectoral AI regulation, looking at, for example, recommendation algorithms or deep fakes, this kind of thing. And more recently, in terms of AI, I think most people know that China's priority when it comes to AI is making sure that chatbots don't spew out things that go against the party line. But it is a bit more nuanced than that. And I think what's not always fully appreciated is that even though there's very strict rules for consumer or citizen facing AI applications, when it comes to B2B, it's really quite lightly regulated and businesses have A lot more freedom there, which perhaps gives Chinese B2B AI companies an advantage.

Okay, that is interesting that there's a slight difference in approach. So it's less about protecting individuals and more about, I guess, aligning with. With countries, the country's political goals there in China. But also, like your point about how it's very difficult to pass federal laws in the us it always amazes me, like, how much sort of talking through things have, like, it takes months or years to get alignment between things before things fast. So we'll probably get there eventually in the us, but yeah, gonna be a while. All right, so we've talked about the eu, we've talked about the us, talked about China. Are there any other sort of notable regulations coming along in the rest of the world? Shalini, do you want to talk about this? Oh, hang on.

No, no, nothing. I mean, uk, of course, even though it's not in the eu, UK is also doing a lot of work in legislating. And of course there are many points of convergence with the EU AI act. And like I said, Japan is working on it, Canada as well, and countries also in Latin America. Argentina is also leading. So I think India also has a, you know, publish their first strategy and also, you know, aims to regulate. But the difference we have to see is some countries also do it not just to regulate AI, but also to kind of promote AI. Like to say that you're investing in AI, it's more of a strategy rather than a regulation, but with some requirements on regulating. So, yeah, so AI regulation is not just, you know, concentrated on a few countries. It's. It's worldwide, definitely.

Okay. We're covering a lot more of the globe. You've got Japan, India, South America, Canada, the UK as well. Nick, did Julian miss anything? Are there any other bits going around.

The world that was pretty good. I would highlight Brazil. They have a very EU AI ACT style bill going through their congress, so watch out for that one. But, yeah, lots going on. Okay.

Yeah, that's. That's pretty exciting that a lot of the world's getting at this. All right, so let's talk a bit about how you go about actually complying with all this stuff. So I'd like to start by talking about who needs to be involved in any given organization. So which sort of teams or roles within a company need to care about the AI regulations. Shirley, need this microphone for you.

Yeah, definitely. Again, I'm just going to refer to EU AI act because that's like the most detailed and the one that gives the Most information about who should be involved in the sense that they describe people as deployers, kind of model producers. I have to look at the right name somebody who importers. So basically if you're in the EU and if you kind of get the technology from the US so each of you have different, different obligations. So basically if you are a developer of an AI system and you want to put it in the market, you have a certain level of obligations. If you're just taking a product and developing it and putting it into the market, you have a different obligations. However, the kind of people that would be involved are definitely technical people. Data scientists, AI engineers who set up these, you know, build these models. At the same time, there will be a lot of involvement also from the legal side. So I would say it's a very legal tech issue. And also of course it's multidisciplinary. You have business use cases coming in and seeing what's useful, what's not. So I would see a very multidisciplinary roles in this. And there's, with a lot of, you know, even though it's, it's a legal text, data scientists and machine learning engineers will have a lot of things to do, especially in terms of conformity assessment and technical documentation.

Okay, so this isn't just me, like throw this to the legal team and say, you've got to comply with this. Anyone who's building stuff is going to need to have some kind of broad understanding of the regulations. And so I'm curious, are there any particular things that you think data practitioners or AI practitioners need to know? I mean, I guess you're not gonna have like memorize the whole text of the EU AI Act.

No, definitely. One of the things that we have to be, you know, we have to understand that in the AI Act, a large chunk of it is about data, about how do we collect data, how do we process it, and is the data representative enough for the models that we're building? And how robust is our model? Is it fair? All this have to be performed by data scientists and the conformity assessment goes through all of this. And there is also a technical annex where there is a list of things that you have to make sure or record and prove that your model is actually as robust as what you say that you are. So yeah, there is even a technical documentation. However, even though it looks technical for somebody who's building models, it still seems a bit high level. So there are a lot of standards bodies like IEEE and NIST that are working on what does fairness metrics mean what does robustness mean for my processes? So you have to also there's a lot of learning also to be involved among, among practitioners.

Okay, so a lot of what you're saying is that you need to be able to prove that what you've done is fair or unsafe and things like that. So you just need to be able to write down what you've done and make sure everything is reproducible and clear to someone else reading it. Nick, is there anything you want to add on, like maybe, I don't know whether you want to talk about like how this is going to affect like what leaders need to do or how organizations might go about complying.

You cut out just at the wrong moment there for me on my signal. But I would just add that, you know, there are a lot of third party startups and companies that are springing up to help with compliance process. So you're not on your own and they can help you to test and evaluate your models and certify your compliance with the AI act or any other kind of regulation. I'm not sure if that was related to your question.

It's close enough. Yeah. All right, excellent. So Shalini, you mentioned that data is always gonna be a big part of this. So it seems like this is gonna have an effect on how you do data governance. So do you want to talk us through how do these AI regulations affect data governance?

No, fundamentally, if you're already dealing with personal data, you have to comp comply with personal data protection regulations. I mean that just because you have AI act doesn't mean that you should stop, you know, complying with gdpr, for example. So that still remains one of the important things is also to prove that where your data sources to be transparent about where you're getting your DARES resources, have you infringed upon any copyright. So the current foundational models might not comply to the AI act as it is written right now because the data sources are hard to, you know, you know, publish. So these are some of the elements. And of course, one more, another thing is the data quality checks. You have to prove that your data is of good quality and you're able to again, fairness, representativeness, completeness of your data. All this will be part of your data documentation procedures. And of course synthetic data also is one of the three things that they have mentioned. Instead of using normal data, use synthetic data to train your models, for instance.

Okay, yeah, so if you've got personal data, then obviously you can't just be throwing that out. It's Got to be a lot more secure so you can use synthetic data instead, which is sort of representative but not going to cause those privacy problems. All right, just maybe to continue this, are there any common mistakes that organizations are going to make or, you think, any pitfalls when they're trying to comply with the regulations from a data point of view?

Now, in terms of data, I mean, just to start with it, like, I think like, you know, GDPR was there since 2016 and only now we see that many organizations are in the data culture of, you know, governance and stuff. And I think it'll take some time before companies will fully be in compliance with AI acquisition because there's a lot of unknowns as well in terms of technology and implementation. But the mistake that they might make is to wait until it's actually fully in rigor because it'll take two years for it to be actually in force. I think the biggest mistake is they might be reactive. They should be proactive.

Okay. So being proactive. So probably start now. Nick, I don't know whether you have any advice on what you need to do in order to get started with complying with the regulations.

Yeah, I think Shaleen sort of covered this already. But use the resources that are out there, like the NIST risk Management framework, for example. Don't confine compliance to the public affairs team or the regulatory. Make sure it's a whole company effort and then you get the other silos of the company on board. That's really important. We often see companies internally siloed. That can be an issue. And don't leave it too late because even though two years can seem like a long time, it's really not when it comes to compliance with things like these.

Okay. Yeah, I'm sure if you this governance is messed and it and all your different teams are doing different things, then it's going to cause a problem. Particularly you, I presume. If one part of the company is complying with the regulations but another part isn't, that's still going to be a problem. So it's going to have to be everyone who. Everyone in your company who's on board with all this. All right. So, Chalene, you bet. Earlier you mentioned the idea of like, fairness and dealing with buyers, things like that. Is there like a checklist of things that you like, properties your model needs to have in order to comply? Yeah. Charlene, do you want to go into more depth on, like, what's involved?

No, actually, in terms of, you know, very specific metrics, AI act doesn't give you, this is exactly the fairness metrics you need to do. But there's a lot of research that's happening in terms of what fairness means. So basically you have things like fairness metrics, like equalized odds and equalized opportunities, and based on the application, you can actually, you know, apply them. Like I said, there's a lot of research going on, standards going on, also on fairness, also on data governance for AI. And we need to keep up and keep learning about this because, you know, the implementation, nobody has implemented anything yet. And there are a lot of checklists, of course, but I think the devil lies in how we are going to implement that in a pipeline. Make sure it works and is compliant and we monitor that.

Okay, so that last point seems important. Like when in the development process do you need to start caring about stuff? Is this like, I've got an idea for an AI project, I need to start thinking about compliance right now? Or is it more like, I've built this thing, let's see how to make it comply. When do you start caring?

No, I would say if you're building it yourself right from the beginning. Because I mean, people who are building AI know about technical debt. If you make a mistake in the first process, it will continue on till the next one amplifies it. And the other thing that's important is if you're actually buying it from a vendor, you need to be sure that they are compliant as well. It's not just you, it's also dependency on the others. So AI act also, maybe if somebody says that I'm compliant with AI act and there is also a certification body to say that it's compliant, then you can be sure that, okay, I'm using something and I can build upon it. So if it's yourself, of course, from the beginning, and if you're getting it from somebody else, make sure that they are compliant as well.

Okay, so start thinking about compliance right from the beginning. That seems like really good advice. I don't know how many people are going to take up that advice. It feels like something that people probably leave until the last minute. But yeah, better to start early. Now the other thing you said was if you're buying AI as a service, so this is increasingly popular, like, so, for example, OpenAI, you can access GPT via the API and then you're buying in AI from somewhere else. So maybe let's go into a bit more detail, like what you have to do to make sure that you are buying like compliant AI. Nick, do you have any advice for how to Ensure that you're not buying sketchy AI that doesn't comply.

Yeah, that's a really good point and something to be aware of. And that's why the legislators of the AI act, for example, put in quite a lot of effort to create requirements on these general purpose models like GPT4. The developers, OpenAI in this case, have to make the information available to the downstream users, the deployers, to allow them to make sure that the models are compliant and that they can be used in a way that is compliant with AI Act. So that applies to the big general purpose models. Otherwise there are, you know, various certification models out there, like the Responsible AI Institute, for example, offers certifications. So there's some of these services that are around that are a kind of seal of approval that you know that this model has been audited and evaluated and, and is judged to be compliant.

Okay, so that's good that there are some certifications. You go to the company's website, check them out and I think a lot of certainly the biggest AI developing companies, they do have like documents on their site about, hey, this is how we deal with safety and things like that. So hopefully there is some way to tell. All right, so for everyone in the audience, I've got another, I've got some questions for the next five minutes, so we're going to go to your questions next. So if you do have any questions for Nick or you've got any questions for Shalini, please do write them in the chat and we'll get your questions soon. All right, so let's talk about what's coming soon. Are there any other regulations that are in development or they're likely to come in the near future, like what do people need to be aware of over the coming year or two? Nick, do you want to go first on this?

Yeah, I would. Flag. We've discussed various global AI regulations, but one I didn't mention before is the EU AI Liability Directive, which is separate from the AI Act. This one will probably be formally agreed in the next European Commission mandate. So, you know, maybe next year. This is significant because it will change the liability framework for AI enabled products. It will create what's called a rebuttal presumption, meaning it will be assumed that if AI was involved in an accident or collision, that the developer or deployed the AI was at fault. And the reason I'm saying this is because it's very important to keep your records, like you were saying before, because it's only by keeping your records, which is a requirement for high risk AI Developers and deployers, it's only by keeping your records that you can prove you are not at fault. So that's why it's going to be very important for developers to keep track of what they're doing. So besides the EU AI Liabilities Directive. Yeah. There's other things in the works like in Brazil, like in the uk, in the us yeah, lots of things come out.

That's interesting that if you don't have any records to prove that you are innocent, then I guess you presume to be liable in that case. That's kind of the opposite of how most laws work, right?

Exactly. Yeah. Okay.

All right, so that's another good argument for like doing proper data governance. Make sure you keep your records. Okay. Shalini, do you have anything to add to that on, like what future regulations are coming up?

Yeah, regarding that, it's also not so different from GDPR because in GDPR if you can prove that you've done everything you can to prevent a breach and if the breach does happen, then you actually get less fines than if you didn't keep any records at all. So it's not completely new the logic, but in addition to, I think we covered most of the things that are going around in the world and what's coming up, and one thing which I think it's a bit more geopolitical than technical, is that EU is also placing a big bet on regulation. So because there's a saying, right, US innovates and EU regulates. So in the sense that if EU is over regulating AI, will the innovation be stifled and if US will actually go forward. So this is also some of the things that is still a big point of discussion both in the eu, especially among companies. Like Nick was saying, many companies didn't want to be on the applications and didn't want to be in the high risk because they had more obligations. So there's this balance between innovation and regulation. Who has to do what?

Okay, yeah, that always seems to be a trade off. It's like if you've got some regulations, then you can't innovate in some areas. But if you're innovating the way that breaks regulations, probably not a great idea in the first place, hopefully. Okay, so do you have any advice on what organizations can do to plan or prepare for all these upcoming regulations? We talked a bit about data governance. Is there anything beyond that that you can do to get started?

Shulemi, again, documentation, conformity assessments should be part of the pipeline. Reproducibility and all the best practices of data Science and machine learning should be put into practice also, they must be thinking about infrastructure as well. One of the things we didn't talk about is infrastructure. We talked about data, we talked about algorithms. But to make these algorithms run, you need to have sovereignty of infrastructure. Otherwise you'll end up again paying a lot of money for the cloud providers as well. So it's also to have the strategy of both data code and infrastructure for a long term future.

Okay. We might be flogging their doors at this point, but make sure you document your work, make sure you keep your records, make sure you understand how to do compliance assessments. Nick, do you have anything to add to that? Like what do you need to do to be prepared?

Yeah, I'm not sure of much to add really. Just. Yeah, you use the training and resources that are, that are out there. You're not alone.

Okay, excellent. So in terms of training resources, like where can people find out more about all these regulations? Nick, do you want to continue your thought?

The iapp, the International association of Privacy Professionals, they have a lot of good results resources on this kind of thing and I think they're setting up a AI governance training program as well to complement their privacy stuff. So that would be a good place to start.

All right, super. So the I iapp.org okay, definitely worth a visit. Shalini, is there any way you'd recommend for finding resources?

Yeah, definitely. The EU websites are information rich, but they're hard to navigate. It's hard to get the information, I mean, but they have like, if you know where to look, you can find a lot of information also in the European Commission websites. Additionally, I would like also to suggest OECD website on AI principles because the US also adheres to the OECD AI principles. So that's where the definitions, the, you know, also the trends are also constantly written in a more blog and easily to access format. So OECD is also a great place and nist, which is American national standard institution, also has a lot of resources and more on the technical side. If you are interested on the technical implementation, NIST is a great place as well.

All right, so OECD and NIST websites also good for visiting and.

Yeah.

Do either of you have any final advice before we go to audience questions?

Keep learning. This is a very dynamic field. There's no one answer that fits all. We need to constantly explore ideas and learn from each other and in a multidisciplinary format. And learning is really important here. Everybody is actually learning on the go so we have to keep up be up to date about what's happening in this field to make sure that we are using the best technologies in our. In our hand.

Keep learning. That is a message very dear to the hearts of data campers, I think. Yeah, Always more to learn in this field. So much exciting stuff going on. Nick, do you have any final advice?

No, that was too inspiring. I can't talk.

That's absolutely the best thing anyone can do. I agree. All right, so thank you both for that. Let's go to some audience questions. So this first one comes from Consentiles. So actually more of a statement than a question. So saying the UK approach is the opposite of the eu. EU approach. Do you want to tell me a bit more about what the UK approach involves and how it's different from the. Nick?

Yeah, yes, exactly. The UK is quite deliberately very different from the EU approach because the UK government wants to demonstrate that the UK is no longer tied by EU rules. So I think what's interesting about the UK approach is it essentially delegates a lot of the job of regulating AI to the sectoral regulators like OFCOM in Communications or of GEM in Energy, for example. It essentially says here are five high level principles which are themselves mostly based off the OECD 2019 AI principles and says you go off and figure out how these principles should apply to your respective sectors. So it's quite good and quite flexible in some ways. It allows the rules to be tailored to the particular use cases and sectors. On the other hand, I think it's. It's putting a big, big burden on the regulators, many of which will not have the kind of AI specialists on board to be able to carry out the work. So I have to wait and see. But businesses certainly like it better because they think that it will be more light touch. But I would agree that it's very different from the approach.

Okay, so it sounds like there might be a big demand for jobs as an AI regulator in the UK then just to deal with all the demand. All right, excellent. So next question from chess fighter development. Okay, I'm not quite sure on the meaning behind this question. Do you want to talk through, like how you. We've covered this a bit, but how is the process of developing a model changing then due to regulation? Shalimi, do you want to talk through this? Do you have to do things differently beyond more documentation.

Now?

I'm not quite sure how that would change because again, it really depends whether you're developing it in house or you're actually building upon somebody else's model. And that might change the way you will document or test the model. But fundamentally, if you have to develop models, I don't see a lot of difference.

Okay, that's pretty good news. Most of it's the same. Just make sure that your model is defensible once, once it comes to someone asking about compliance. All right, so I like this question from Christian saying what skills and knowledge should data analysts acquire to stay compliant with AI regulations? So, yeah, what do you need to know?

Oh, okay. No, like I said, one of the things that you could do a fun hack is to kind of, you know, run through the, run the AI act through ChatGPT on the technical annexations and see what are the technical requirements of the AI act and go through them. And many of them are like, you know, again, going back to conformity assessments, both from the whole model development, life cycle monitoring, data governance, reproducibility, and all these skills that, I would say skills that will help you as an mlops professional will come quite in handy also for the AI act because mlops is really about monitoring models. Right. In production. And this pretty much those skills are something will come, they'll come very much in handy. And of course looking to the standards organizations, IEEE standards on, you know, conformity assessments, NIST standards on AI risk management systems, all this will give you an idea of the kind of approaches you need to practice. I think in general, if you're a good AI engineer, you know about, you know, deployment and monitoring, explainability, fairness, all the things that you learn in your machine learning courses or in your approaches will come in handy.

That's actually kind of fascinating that just being if you're doing mlops, you're putting your models into production, then that's probably enough or mostly enough to comply.

It's a very good starting point for you to have like, you know, the fact that you're able to monitor your models is a fundamental requirement.

Excellent.

Yeah.

And for anyone who's interested in that, we do have plenty of courses on that subject on data camp. All right, so next question from an anonymous LinkedIn user. So the methodology for some AI models is hard to explain, for example. Oh yeah. So if you're using deep learnings, using like deep neural networks, then it's often very difficult to like interpret what's happening inside the model. It's much more difficult to audit. How can you go about explaining or depending things like that? I think it's true for like all the generative AI models as well. They're just, they're essentially black boxes. It's difficult to know what's going on. This may be another one for you, Shalini.

Yeah, definitely. Explainability, more specifically in the AI act is on the transparency requirements for high risk systems. If you have a high risk AI systems, explainability becomes extremely important. So sometimes you might even be required to remove a black box and put a more explanation sustainable model into production if, if the risk is very high. So, yes, it might affect your choice of models if it's high risk.

Interesting. So we're back to logistic regression and decision trees then it really depends.

Or if you are able to explain your black box, there are also explainability techniques to do that. You have post hoc explanations as well. So if that's again, it's, it's again risk, how well are you dealing with that risk? For instance, if you have a mortgage and if you can actually explain, if you're using a black box model instead of saying the computer said so and you can actually give an explanation to that, it might be good enough. But if you can't explain, then it's a problem.

All right, super. Oh, there was just one more comment from Alexander saying, can you provide links to the sources mentioned? Yeah, we'll update the resources when we send out the recording to you. We'll get the resources updated to include all the different things we've just, just talked about. All right, so.

Oh, the.

I think we're about it for audience questions. So with that, we're going to wrap up a few minutes early. So. Yeah. Thank you, Nick. Thank you, Shalim. This is really interesting stuff. You know, I'm amazed at how fascinating regulations can be. So, yeah, thank you for all your answers. Uh, thank you to Isabella for moderating. Thank you to everyone who asked a question.

Thank you.

Thank you to everyone who showed up today. We've got some very exciting webinars coming up in the future. So the next one is going to be next Tuesday on how to get hired faster using a data portfolio. And then next Thursday we've got a session on how to pass the Alteryx certification. Please do come back for those. All right, thank you everyone. See you all again in future webinars. Goodbye.