The rise of artificial intelligence (AI) and data-driven technologies offers organizations enormous opportunities. On the other hand, AI also brings complex (legal) challenges. To deploy these technologies successfully and responsibly, organizations are now legally required to promote AI literacy and prepare for European legislation such as the AI Act, the Data Act, and the Cyber Resilience Act. In this blog, we discuss the preliminary impact of this legislation on your organization.
AI Literacy: A Strategic Priority
For all organizations that, under Article 4 of the AI Regulation, want to develop or deploy AI systems for their business activities, the first obligation under the AI Regulation is approaching from 2 February 2025: achieving AI literacy.
AI literacy is defined in the AI Regulation as: “the skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations under this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.”
Employees and management must understand AI systems, both in terms of how they work and their impact. This also applies to self-employed contractors you engage. AI is not only a technical topic; it also affects privacy, ethics, and liability. It is in any case necessary to understand:
- How AI systems make decisions and what data they use;
- What the risks are, such as bias in models and erroneous output;
- How legislation, such as the European AI Act, imposes obligations on AI users and developers.
A practical approach to AI literacy includes training for employees, collaboration between legal and technical teams, and drafting (or having drafted) internal policy on ethical AI use. This policy can set out how people within your organization ensure they become and remain sufficiently AI literate.
The European AI Act: What Does It Mean for Your Organization?
The AI Act, in force since 1 August 2024, introduces rules depending on the risk level of AI systems. Depending on the risk level of an AI system (for example, high risk for biometric identification), specific obligations apply, such as:
- Transparency towards users of the AI system;
- Risk assessments prior to implementation;
- Documentation on how the AI system works.
Please note: From February 2025, a ban already applies to AI systems with unacceptable risk. Under the AI Act, these systems are considered prohibited practices.
Amending Contracts and General Terms and Conditions
Organizations must also amend their general terms and business conditions to address liability when using AI. This applies in particular when AI is used to make decisions about customers or employees, such as in automated credit assessments or recruitment.
If your company supplies or deploys AI systems, it is essential to adapt your general terms and conditions to this as soon as possible. This concerns both purchasing terms as a supplier and general terms and conditions for providers of AI systems. These should address, among other things, liability for errors made by AI systems, the risks of use, the various responsibilities, mandatory transparency, and audits. It is highly relevant to prioritize drafting transparent purchasing and general terms and conditions, partly to avoid fines under the AI Act.
What can you do now?
Compliance with AI and data legislation is not only a legal obligation but also an opportunity for organizations to strengthen innovation and increase trust among customers and/or stakeholders. So make the following steps your resolution for 2025:
- Prepare employees in your organization before February 2025 to achieve AI literacy. Do this by sharing knowledge about how the AI systems your organization develops or deploys work. It is a good idea to hold a knowledge session for your employees, or to prepare an explanatory document about the AI you supply or deploy within the organization.
- Analyze the impact of AI and data legislation: Conduct an audit to understand where your organization uses AI and which data flows are important. Also check which obligations your organization falls under, e.g. under the AI Act or the CRA. See our other blogs on this topic.
- Establish AI and data policy: Develop guidelines for employees that align with the new legislation and safeguard ethical use of AI. This also helps achieve AI literacy.
- Update contracts and terms: Make sure liability and data sharing are properly regulated legally.
The Legal Company’s business lawyers combine legal expertise with knowledge of technology when it comes to the action points above. Whether you are just starting out with AI or want to analyze your existing systems, we ensure that you are not only prepared for the regulations but also benefit from them strategically.
Don’t wait until the deadlines approach. Contact us today at info@thelegalcompany.nl or call 020 345 0152.
This article was published on 10 December 2024
