AI legislation at least as far-reaching as European privacy rules

Walters' extensive analysis of 15 large and small companies, and additional literature review, shows that many organisations' preparation for the AI Act is far from optimal. Training on the risks of 'bias' in data collection and A.I. models is often still lacking. There are also often still no guidelines for technical documentation, while the AI Act identifies specific points that such documentation must meet'.

Walters observes that it is not surprising that companies are not yet sufficiently prepared, as much is still unclear around the European regulations, which are worded quite generally. "Companies have been working on this for two years, as the basis for the AI Act was already established in 2021. On certain points, the Act is very specific though; especially when it comes to very risky A.I., such as models that determine what benefits someone is entitled to. But on other points, the Act is quite unclear; such as that it is high risk if you have incorporated A.I. into your 'critical infrastructure'. On those points, it is still ambiguous what the law will soon mean in practice." 

Nevertheless, preparation is essential because the regulations are going to have far-reaching consequences, Walters believes. "The impact for companies is going to be at least as big as with the AVG. Most companies are already using A.I. by now; sometimes they don't even know where or how it is used. If you run a webshop yourself, you might even realise that this is in a recommendation system, for example."