Artificial intelligence (AI) has taken the business landscape by storm. If AI’s ability to infer, adapt and act autonomously has already shaken up corporate operations as we know them, how might it shape — and threaten — the future? The EU AI Act risk categories attempt to answer that question.

AI’s aptitude for self-learning and borderless nature challenge governments, businesses and regulators to contain it. In March 2024, the European Union agreed to the 

 to regulate different AI systems according to their risks. Understanding the risk classifications and who they apply to is now a mandate for any company that wants to operate compliantly in the EU, including:

Details of the EU AI Act high-risk categories

The distinction between AI systems deployers and providers

Tools to help you comply with the new act

At its core, the EU AI Act is a risk-based approach to categorise AI systems based on the harm they may cause. It passed in early 2024 and 

, making the fourth quarter of 2024 a high-stakes quarter for those who provide and deploy AI.

This applies to many different entities but is of particular concern for:

Also called developers, these entities place AI systems or general-purpose AI models on the EU market, whether the provider is based in the EU or elsewhere.

Also called users, these are entities located or operating in the EU that utilize AI systems as part of their business offering.

For a succinct overview of the EU AI Act, 

The legislation classifies AI systems into four risk levels based on their intended purpose. Understanding what each level entails and which systems it applies to is essential to compliance:

 AI systems like social scoring and biometric categorisation pose a clear threat to people’s safety, livelihoods and rights. To curb their use, the Act prohibits such systems, including systems that attempt to subliminally influence human behaviour through emotional recognition.

AI is also used in critical infrastructure, such as transport, educational/vocational training, safety applications, worker management and more. Systems in this category have the highest potential for good — and significant risk for misuse. The Act mandates the most rigorous rules for high-risk systems. (Read more about these systems below.)

 Many AI systems interact with individuals or generate content that can be deceptive without context or appropriate notice of AI system involvement. Considered low-risk, these systems are subject to information and transparency requirements to ensure that people know when they are interacting with AI. Providers must enable the marking and detection of the system’s output, while deployers must disclose content that has been artificially generated or manipulated.

This EU AI Act risk category encompasses AI-enabled video games or spam filters, considered risk-free. Providers and deployers can use them freely but are advised to adopt a voluntary code of conduct. However, existing data protection regulations still apply.

Tools like ChatGPT are among the best-known AI tools on the market. Which risk category applies to these systems, considered general-purpose AI (GPAI)?

The Act recognises that GPAI operates more broadly and isn’t designed for the specific purposes outlined in each risk category. This makes them applicable to various use cases, but it also makes them hard to classify.

Instead of pinning them to a risk category, the Act emphasises that GPAI carries systemic risk, meaning that there are far-reaching risks inherent in the use of these tools. The Act mandates transparency requirements, risk management, reporting and surveillance related to GPAI. It is worth noting that GPAI providers could be subject to some of the same obligations as high-risk systems if their models are used in high-risk applications.

Key obligations of the EU AI Act high-risk category

High-risk is the most heavily regulated of the EU AI Act risk categories. As such, providers and deployers specifically handling high-risks systems must understand and comply with the requirements of the Act, specifically those detailed in Chapter III, Section 2.

Download our guide for a deeper dive into EU AI Act compliance

Providers must establish, document and maintain a continuous risk management system. The system must identify the risks of using the AI systems as intended, develop and test risk mitigation measures and ensure that any remaining risk is acceptable. These approaches should pay particular attention to the impact of the AI system on persons under 18 or other vulnerable groups.

AI systems cannot exist without data, so data protection and management integration are essential to avoiding risk. Entities developing high-risk AI systems must implement data governance practices that include system design, data collection and preparation, data suitability, measures to prevent bias and data gap analysis, and to ensure data privacy.

National authorities need specific documentation to evaluate a system’s compliance with the Act. Providers should create and continuously update technical documentation that details the elements and development process, insight into training data sets used, information about the monitoring and control of the system and what cybersecurity measures exist.

 Providers should design high-risk AI systems with automated recording of events — also called logs — throughout their lifecycle to enable post-market surveillance.

The Act requires that providers avoid the black box of AI and instead be able to interpret the system’s outputs and use. This includes providing detailed instructions about the system’s intended use, accuracy and any known or anticipated risks to human health or safety.

Mandating human oversight is central to the regulation. Providers must design high-risk systems to permit human intervention while minimizing risks to health and safety. The level of intervention should match the risk level of the system’s autonomy and context of use. The more risky it is for the system to act on its own, the more human oversight it should require.

Deployers’ obligations under the Act are tied to the instructions of providers. The provider of an AI system must equip deployers with comprehensive instructions for using the system safely and responsibly. Deployers must adopt appropriate measures following those instructions — a burden 

Any deployer that deviates from the providers’ instructions with a new use case or a change to the system can then be classified as a provider, which comes with steeper regulatory requirements.

Under the Act, deployers are responsible for:

Performing a fundamental rights impact assessment (FRIA)

Ensuring compliance and surveillance according to the provider’s instructions

While using AI systems, deployers must still comply with existing member state laws, like 

. This includes completing a GDPR data protection impact assessment (DPIA), recognising that AI can involve automated decision making, and high volumes of personal data.

Build a proactive EU AI Act compliance toolkit

Organisations have a relatively short runway to comply with the EU AI Act. However, the short timeline only underscores the importance of taking a proactive approach to protecting human health, safety and fundamental rights that keeps up with AI’s rapid growth.

However, complying with the EU AI Act quickly doesn’t mean cutting corners. Deployers, providers and other entities operating in the EU can both stay ahead and stay compliant — if they have the right toolkit.

CALLOUT: "Perhaps the greatest business risk around AI right now is the risk of doing nothing. You can decide how you'd like to approach it, but what I think every company needs to do is have a considered approach..." — Dale Waterman, Principle Solution Designer, Diligent

Tap into Diligent’s toolkit curated specifically for the EU AI Act

 to ease your compliance burden now and for the future.

EU AI Act risk categories: Which obligations apply to your systems? 

It's not too late to prepare a great program for Compliance and Ethics Week 2024

As the leaves begin to change color and the air turns crisp, it's a reminder that autumn is upon us. And with autumn comes the official Compliance and Ethics Week, 

, 2024. If you haven't started planning yet, don't worry — it's not too late to create a fantastic program that will engage your entire organization.

This dedicated week is an opportunity to highlight the importance of compliance and ethics, launch annual initiatives like code of conduct training or ethical culture surveys, and bring your team together for some fun and informative activities. So, let's dive in and explore how you can make this year's Compliance and Ethics Week a resounding success.

Society of Corporate Compliance and Ethics

 created Compliance and Ethics Week in 2005. Since then, many companies have celebrated this event to highlight the importance of compliance and ethics.

In addition to launching annual initiatives like Code of Conduct training or ethical culture surveys, Compliance and Ethics Week is also a chance to bring your organization together to understand the contours of compliance while 

Logistical challenges surrounding compliance week

In 2020, Compliance and Ethics Week activities went virtual. Since then, many of those activities have continued to occur online, as many people still work from home or only go into the office on a limited number of days. This can limit engagement and reach.

Many companies have to plan events in multiple time zones or in multiple languages, which can create headaches. Additionally, companies with large manufacturing floors or employees without computer access face unique challenges.

However, most of these difficulties can be overcome with a multi-pronged strategy to drive engagement.

Our top 4 strategies for a successful Compliance and Ethics Week

Here are a few tricks you can use to ensure everyone is on board for a fun and informative Compliance and Ethics Week.

Throughout Compliance and Ethics Week, put daily compliance and ethics-related posts on your company’s internal social media site. Whether it’s Yammer, Facebook for Business, or simply an internal blog, prepare your content and get set for comments.

Write the name of each commenter on a raffle ticket kept with the compliance officer. At the end of the week, pull the names of the winners. Make sure people can enter multiple times by posting throughout the week, which will keep engagement high.

Create a survey to get employee feedback on the compliance program. This doesn’t have to be a formal Ethics and Compliance survey — it’s best if you give the option to answer anonymously, but also give people the chance to leave their name if they’re open to having their quotes attributed to them.

This will give you further material for communications during and after Compliance and Ethics Week.

 Make the survey short – 5 questions or less – so that people finish it.

If you’re posting content throughout Compliance and Ethics Week on your social networks, distribute a raffle ticket each time a person shares compliance-related content or re-shares the posts by the compliance and ethics department.

Put a rule in place that tickets are assigned only for shares that include some sort of comment or question, rather than a straight share without further effort. This will extend the reach of your posts on your internal system and show employees that others are engaged.

4. Have Fun with Different Forms of Media

There’s a reason so many people watch funny videos on YouTube. Everyone enjoys being entertained, especially when it’s a quick distraction from all-day meetings. You can use this to your advantage by finding fun media to share.

Check in with your eLearning training provider to see if they have any short videos that could be sent to the company via email or posted to the internal social media sites.

You can also ask your leaders to post videos supporting Compliance and Ethics Week. In a recent Diligent webinar, Allison Riter shared how nVent did this. You can watch the webinar here.

You can also search for fun, relevant YouTube videos, if your company allows it. Try Compliance the Musical to start.

Most of us have a favorite meme (a picture with a funny or ironic statement overlayed onto it). Memes are great because they can be added to emails or posted to your internal social network.

Many companies have an internal television station that can be used to disseminate messages or other content. If your company has this, make content for Compliance and Ethics Week.

This can include a short video message from your CEO, trivia about risk and scandal, memes, or information about the speak-up hotline. The internal TV station can also play videos from outside providers. Best of all, these types of videos can be shown to your manufacturing floor employees and/or translated with subtitles.

How can we help support Compliance and Ethics Week?

Compliance and Ethics Week is an opportunity not to be missed. If you won’t be ready by November, do not worry!

Compliance and Ethics Week can be any week that makes sense for your company. So no matter what time of year you celebrate, with a little pre-planning, this single week can create a buzz for your compliance program that lasts all year.

Interested in how the Diligent Compliance and Ethics Training Library could potentially support your Compliance and Ethics Week this year? Learn more about our offerings 

Diligent

Blog

EU AI Act risk categories: Which obligations apply to your systems?

4 strategies for a successful Compliance and Ethics Week

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

EU AI Act risk categories: Which obligations apply to your systems?

4 strategies for a successful Compliance and Ethics Week

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company