AI Act: How to Map Your AI Flows to Anticipate Compliance Requirements

Artificial intelligence (AI) is transforming businesses, but this revolution comes with risks. To address them, the European Union has adopted the AI Act, the world’s first regulatory framework for AI. To prepare for upcoming obligations and ensure ethical use, mapping sensitive AI flows is an essential step. This article guides you through the process of creating this mapping and anticipating the regulation’s requirements.

Understanding the AI Act and Its Impact on Your Organization

Effective August 1, 2024, with a phased implementation, the AI regulation aims to ensure that AI systems used within the EU are safe, transparent, and respectful of fundamental rights.

The AI Act: An Overview of European Regulation

The AI Act is the first comprehensive legal framework for AI. Its ambition is to promote trustworthy AI while fostering innovation. The regulation adopts a risk-based approach, classifying AI systems into four levels: unacceptable risk (prohibited), high risk, limited risk, and minimal risk. The higher the risk, the stricter the obligations. Its extraterritorial scope applies to any company whose AI systems are used in the European market.

Key Obligations of the AI Act for Businesses

Obligations under the AI Act vary according to the system’s risk level.

• Unacceptable risk: These systems, such as widespread social scoring, are banned.
• High risk: This category carries the most stringent obligations, including establishing a quality management system, comprehensive technical documentation, event logging for traceability, and effective human oversight.
• Limited risk: Systems like chatbots are subject to transparency requirements, ensuring users know they are interacting with AI.
• Minimal risk: No legal obligations, though adopting codes of conduct is encouraged.

High-Risk AI Systems: Identification and Classification

Identifying an AI system as “high risk” is a crucial step. A system is classified as high risk if it serves as a safety component of an already regulated product (e.g., medical devices) or belongs to one of the critical categories listed in Annex III of the regulation. These sensitive areas include biometric identification, employment and human resource management, access to essential services such as credit, or even the administration of justice. Therefore, a detailed analysis of each AI system’s use is necessary.

Mapping Your Sensitive AI Flows: A Methodical Approach

Mapping AI flows provides a clear view of how artificial intelligence is used, identifies risks, and assesses compliance. Here is a four-step approach.

Step 1: Identify All AI Systems in Use

The first step is to create a comprehensive inventory of all AI systems. This includes currently deployed solutions (developed internally or acquired from vendors) as well as all planned AI projects. This complete and forward-looking overview is crucial to integrate compliance from the design phase of new systems (“compliance by design”).

Step 2: Classify the Data Processed by Each System

Next, analyze the data each AI system processes. Data sensitivity is a key factor in risk assessment. Determine whether the system uses personal data, especially sensitive data under GDPR (health, biometrics). Do not overlook other critical business data (trade secrets, intellectual property), where compromise could have significant impact.

Step 3: Assess the Risks Associated with Each System

This central step involves evaluating risks across multiple dimensions. The analysis should cover data-related risks (bias, privacy violations), AI model risks (opacity, lack of robustness), and risks related to system autonomy (absence of human oversight). The goal is to understand each system’s potential impact on individuals and the organization.

Step 4: Document the Flow Mapping

Finally, formalize the results of your analysis. An effective tool is the risk matrix, which ranks AI systems based on the likelihood and severity of impact, helping prioritize actions. For advanced management, AI risk governance software tools can centralize the inventory, track actions, and generate compliance reports.

Anticipating AI Act Obligations: An Action Plan

The mapping must lead to a concrete action plan to bring the organization into compliance.

Establish AI Governance

Strong governance is indispensable. It is recommended to appoint an AI Act compliance officer to lead the process. At the same time, it is crucial to train all relevant teams (technical, business, legal) on the regulation’s principles and AI’s ethical challenges.

Adapt Your Processes and AI Systems

Compliance often requires adapting systems and processes. Principles of transparency, traceability, and human control must be integrated from the design stage. For high-risk systems, clear documentation and effective human oversight are non-negotiable obligations.

Plan for Necessary Investments

Compliance comes at a cost. It is essential to anticipate and budget for required investments, whether human resources (new roles, training) or tools and technologies (governance software, infrastructure upgrades).

Resources and Concrete Examples

Examples of AI Flow Mapping

Practical guides, including those published by professional organizations, provide mapping templates that can serve as starting points.

Additional Resources and Useful Links

The European Commission and national authorities like data protection agencies publish guidelines. Specialized consulting firms and law firms are also invaluable sources of expertise.

• AI System (AIS): Software capable of generating outcomes (predictions, decisions) that influence its environment.
• Provider: Entity that develops an AI system to place it on the market.
• Deployer (User): Entity that uses an AI system under its own authority.
• High Risk: Category of AI systems subject to the strictest obligations due to their potentially significant impact.

Frequently Asked Questions

How to Identify a High-Risk AI System?

An AI system is high risk if it is a safety component of a regulated product or belongs to a critical area listed in Annex III of the AI Act (e.g., employment, justice, credit).

What Are the Sanctions for Non-Compliance?

Sanctions are severe, reaching up to €35 million or 7% of the company’s global annual turnover for the most serious violations.

Where to Find Support and Advice for Compliance?

Contact national authorities (data protection agencies), professional associations, specialized consulting firms, and explore regulatory “sandboxes” for testing your innovations.