The EU AI Act is a groundbreaking regulation – the first global AI policy of this kind – designed to oversee how companies develop, use, and implement AI technologies. The act is built to ensure that the use of AI technologies is both safe and ethical, and it’s built on a “risk-based” approach, meaning that the rules are designed to manage the risks associated with various business use cases associated with AI.

Companies leveraging AI will have to meet compliance obligations in risk management, data governance, transparency, and IT security.

TL;DR: The higher the risk associated with an AI application (and the data it uses), the stricter the rules governing its use.

Where to Start for the EU AI Act: Follow the Data

According to Gartner, the key to managing these risks is to “follow the data.” Many of the risks outlined in the regulations stem from the processing of special categories of personal data. 

The AI EU Act defines several risk categories – and it’s the first two that matter most:

  • Unacceptable Risk: Anything that’s rated unacceptable risk is outright banned. This includes data and processing like real-time biometric identification or any data or activity that’s used to manipulate human behavior and emotions. 
  • High Risk: This is the most critical area – data and processes like financial and insurance data (pricing, creditworthiness, risk analysis) and employee and educational data (performance, recruitment, traits).
  • Limited Risk: This is subject to lighter transparency – more about making sure users are aware that they’re engaging with AI (think: chatbots)
  • Minimal Risk: Currently unregulated – an AI-enabled spam filter, for instance.

Therefore, organizations should:

  1. Catalog AI Use Cases: Document the AI systems, the data processed by these systems, the purposes of processing, and the business processes involved.
  2. Categorize AI Systems: Inventory your AI systems and understand what you have, what data it’s accessing, and what access rights it’s got.
  3. Classify Data that AI Uses: Classify your data and put controls around it based on risk, context, content, and type – so that you can easily manage, track, and report on what data AI has used for training, what data it’s able to access, and how sensitive and high-risk that data is.

Data at the Core of Risk

The classification of these risk categories begins with the data. The type of data that AI systems are trained on, can access, and can monitor determines the level of risk. Therefore, understanding and controlling your data is crucial. 

Organizations need to:

  • Identify what data is safe for AI use.
  • Determine which data falls under specific risk policies.
  • Classify data to ensure compliance with confidentiality and regulatory requirements.

Ensuring Data Visibility and Control

To comply with the new regulations, organizations must have visibility and control on both AI systems and the data accessed by AI systems. This involves:

  • Inventorying both AI models and data across the organization 
  • Maintaining clear records of what data AI systems can access and have accessed.
  • Monitoring what data AI systems have accessed to ensure compliance and security – what the sensitivity is, what policies it falls under, and what risk it represents.
  • Implementing security controls around both data and models, including the ability to:
    • Alert on high risk data or unusual access
    • Revoke permissions and access
    • Remediate high risk data 

How BigID Helps with the EU AI Act

BigID’s data-centric approach enables companies to proactively manage regulatory compliance – from automated discovery of data and systems, to comprehensive (and accurate) classification of data and systems, to remediation of data, systems, and users.  With BigID, organizations can improve their security posture, enable proactive privacy and risk mitigation, and implement risk-based controls. 

The EU AI Act is a landmark initiative – and likely only the tip of the iceberg in terms of AI regulation.  Get ahead of the AI Act and compliance with the evolving AI regulatory landscape with BigID: talk to our AI experts, take a tour, and see BigID helps organizations of all types know and control their data – for AI regulation, innovation, and beyond.