The European Union is poised to introduce a groundbreaking legislation that will govern artificial intelligence (AI) across its member states. The impending Artificial Intelligence Act (AI Act) is expected to be in force by late 2026 or early 2027, signaling a significant shift in AI regulation. For UK-based companies with operations or clientele in the EU, understanding and preparing for this legislation is paramount.

The AI Act seeks to strike a delicate balance between fostering innovation and safeguarding fundamental rights, as well as ensuring consumer safety. Its implications for businesses, both within and outside the EU, are substantial. Here’s what UK companies need to know and do to navigate the complexities of the AI Act:

Understanding Key Points of the AI Act

• The AI Act applies to both providers (developers) and deployers (users) of AI systems within the EU, as well as companies outside the EU whose AI systems are used in the EU market.
• AI systems are categorized based on risk levels: unacceptable, high, limited, and minimal. Each category entails different regulatory requirements.
• Providers of high-risk AI systems bear significant responsibilities, including compliance with risk management, data governance, transparency, and cybersecurity standards.
• Users of high-risk AI systems must ensure compliance with usage instructions, monitor system operations, and maintain detailed logs.
• Providers of GPAI models must adhere to documentation requirements, copyright laws, and transparency standards. Those posing systemic risks have additional obligations, such as cybersecurity evaluations.
• Violations of the AI Act can result in substantial fines, reaching up to €30 million or 6% of global annual turnover.

Preparing for Compliance: A Roadmap for UK Companies

Given the significance and breadth of the AI Act, UK companies should initiate preparations well in advance. Here’s a comprehensive roadmap for the next 18 months:

Establish an AI Governance Framework (March 2024 – June 2024)

• Appoint an AI Ethics Officer or Committee.
• Define roles and responsibilities for AI development, deployment, and monitoring.
• Create a risk assessment methodology.

Conduct an AI Audit (July 2024 – September 2024)

• Audit current AI systems and practices.
• Identify gaps and areas for improvement.

Develop an AI Training Program (October 2024 – December 2024)

• Train team on AI Act fundamentals, ethical AI practices, risk management, data governance, and transparency.
• Tailor training to specific roles.

Implement Technical and Organizational Measures (January 2025 – June 2025)

• Update AI development processes.
• Implement human oversight mechanisms and enhance cybersecurity measures.
• Establish documentation and record-keeping processes.

Engage with Stakeholders (July 2025 – September 2025)

• Communicate compliance efforts to customers, partners, and clients.
• Collaborate with industry associations and standards bodies.
• Partner with legal and compliance experts.

Conduct Continuous Monitoring and Improvement (October 2025 – December 2025)

• Regularly audit AI systems and practices.
• Monitor AI system performance and impact on fundamental rights.
• Update policies, procedures, and training programs.
• Encourage a culture of transparency, accountability, and ethical AI development.

Keep a Buffer period for any unforeseen changes before the Act comes into force (Jan 2025-mid 2026)

• Review actions 1-6 above for any gaps
• Use external “fresh pair of eyes” to ensure all key points are covered

By following this roadmap and investing in necessary resources, UK companies can navigate the complexities of the AI Act and ensure compliance with its provisions. For additional support and expertise in AI talent, governance, risk management, and training, companies can leverage services like those offered by Stack Digital. Their Principal Consultants are available for consultation to enhance internal review team efforts. Reach out to hello@GoStack.co.uk for more information.

In conclusion, proactive preparation for the AI Act is not just about avoiding financial penalties; it’s about safeguarding reputation, retaining customers, and staying ahead in an increasingly regulated AI landscape. UK companies must act swiftly to adapt and thrive in the evolving regulatory environment.