by Laura Fannin , Denise O’Shaughnessy October-08-2024 in Commercial & Business, EU, Competition and Regulatory Law

 

 

The European Union Artificial Intelligence Act (the “AI Act”) entered into force on 1 August 2024. The AI Act is a groundbreaking act that aims to protect the fundamental rights of individuals, while also fostering innovation, growth and development.

 

Transition Period

The AI Act classifies AI according to risk – the level of regulation corresponds to the level of risk created by an AI system. High-risk AI systems will undergo stringent conformity assessments and continuous post-market monitoring, however, lower-risk AI systems will be subject to transparency and information obligations. Most obligations under the AI Act fall on developers and will take effect from 1 August 2026, however, some of the regulatory obligations concerning prohibited AI will take effect from 1 February 2025 and those relating to general purpose AI (“GPAI”) will take effect from 1 August 2025.

 

Time to prepare

As organisations continue to invest in and adopt AI systems to remain competitive and increase efficiencies, you should now take the time to consider the AI Act and implement necessary measures to ensure you are prepared and sufficiently protected.

  1. Undertake an AI audit - assess and document all AI systems used within your organisation, including generative AI such as Chat GPT. Does your organisation use an AI system to draft marketing material or social media content, to undertake market research, sales forecasting or supply chain maintenance?
  2. Conduct risk assessments, including cybersecurity assessments and data protection impact assessments. Record these risks and consider possible mitigation measures. Retain all records and decisions.
  3. Review existing agreements including those with AI developers. Ensure sufficient due diligence is taken on any future suppliers, particularly those providing high risk AI systems as they will soon be required to comply with the AI Act. Review client agreements and / or terms and conditions – do your clients know the business uses AI? Are there any data protection and / or confidentiality concerns?
  4. Introduce a clear AI policy, particularly in relation to generative AI. A survey undertaken by Trinity College Dublin’s Business School, on behalf of Microsoft Ireland entitled “Generative AI in Ireland 2024” found that almost half of organisations (49%) in public and private sectors in Ireland are using generative AI[1]. Failing to introduce an AI policy may result in employees using an AI system which they are not permitted to use and potentially exposing an organisation to a host of risks. An AI policy should inform staff what is and is not permitted, what type of data can and cannot be inputted into an AI system, explain when and if management approval is required, outline who staff can contact and outline an escalation process should staff have any concerns.
  5. Train staff. As with any workplace policy, employees must know what they can and cannot do and understand why restrictions are in place. Staff should understand the data protection, intellectual property and confidentiality concerns in using an AI tool in the workplace. Training should occur periodically and should also inform staff how to practically and responsibly use authorised AI tools in their respective roles.

Finaly all policies, procedures, and training should be frequently monitored, reviewed and updated to ensure they adequately protect the organisation, comply with the AI Act and support buy in from the organisation as a whole. Adequate records should be maintained. Decisions and assessments should be recorded. If you would like to discuss any aspect of the AI Act and its impact on your business or discuss any of the risks associated with use of AI and how you might protect your organisation, please contact Laura Fannin, partner or Denise O’Shaughnessy, associate. 

 

The content of this article is provided for information purposes only and does not constitute legal or other advice.

 

[1] https://pulse.microsoft.com/wp-content/uploads/2024/03/Generative-AI-in-Ireland-2024-Microsoft-and-Trinity-College-Dublin.pdf

Back to Full News
Share this article:

About the Authors

Laura Fannin
Laura Fannin

Laura is a partner in the Commercial & Business team at Hayes solicitors. Laura advises clients on a diverse range of corporate and commercial matters and regulatory requirements. She is an experienced adviser on terms and conditions of sale and purchase, IT issues, data protection, product liability, advertising and promotions, intellectual property and a wide range of commercial agreements.

Denise O’Shaughnessy
Denise O’Shaughnessy

Denise is an associate solicitor in the Technology and Data Protection team.  She advises clients on all data protection and privacy matters, including data sharing agreements, data processing agreements, online terms and conditions, privacy policies, cookies policies and data protection policies. She also advises clients on data subject access requests, data protection impact assessments, e-privacy and direct marketing.