I am following the updates on the AI Act with great interest, whether they concern the recent decision to postpone certain deadlines set out in the regulation or what companies have been doing in the meantime.
The change to the deadlines may give some people the false impression that they have time to wait and see what happens, to see if anything else will be postponed, to “drag their feet”, to wait…
If I were to say that I’m astonished when I hear from people working in the field (for example, lawyers in firms whose clients include large companies) that people still aren’t “taking action” to start complying with the obligations set out in the AI Act, I’d be lying. It’s that meme: “disappointed, but not surprised”.
Hearing this recently from a lawyer gave me a huge flashback, transporting me back to mid-2019 and early 2020, when the LGPD wasn’t yet in force, but lots of people (companies, clients) were just standing there, watching… some were sceptical, wanting to see if it was “for real” and whether the law “would have teeth”. Others were completely lost, without even knowing what it was all about… A few were a bit daunted by the figures for potential fines, but were also at a loss and unsure of what to do.
The current situation bears some resemblance to what I saw a few years ago, in the sense of “let’s wait and see what to do”. But what honestly unsettles me is that, although the deadlines have been slightly postponed, I’m a bit shocked by the lack of urgency shown by many companies. Look, there’s no point talking about AI governance if there isn’t even an understanding of WHAT needs to be governed.
This ties in with another point that also did not surprise me when hearing from professionals on the front line of AI governance: there is still, amongst people in companies, a lack of knowledge on the subject (for this and other reasons, AI literacy is essential. Perhaps a topic for another time). There is also that “fear” many employees have of reporting to the responsible teams that they are indeed using some form of AI (this immediately reminded me of how important it was to establish a connection with people right from the start, regardless of their job title, and to build a safe environment so that they could share what was happening in the workplace… the phrase I must have repeated most often over the years was “this isn’t an audit… we’re here to try to understand the situation and help make things safer for everyone”)
One thought that comes from the bottom of my heart at this time of widespread market anxiety is this: I think practically everyone agrees that (whether you love it or hate it, use it or not) artificial intelligence is a reality, and I find it practically impossible to “go back” to a scenario where it isn’t such a constant presence. That said, we have to face up to what lies ahead. It’s going to be hard work, for sure. At times it’ll be “ugly”, but there’s no other way forward than to roll up our sleeves, grit our teeth and get on with it. Let’s map out the use of AI, identify risks, record what needs to be done, assess those risks and address them.
We need to find out how it’s been applied within the corporate environment, and analyse whether these applications are compatible with our risk appetite. Manage all vendors of these technologies and everything that entails, from contract analysis to the implementation of safeguards. The deadlines have been postponed, but even so, a thorough job of assessment and governance, as well as all the work relating to raising awareness, takes time, a looooot of time.
We have more than enough clues to show where the lines will be drawn: “nudifier” apps have already been banned, and the problems caused by this type of technology were piling up, whilst it is clear that progress in terms of regulatory infrastructure is proceeding at different speeds. We’re witnessing an AI race between major powers, with the EU seeking ways to achieve greater independence from the US, and AI-focused bills popping up all over the world. It’s the hot topic of the moment, and will remain so for a long time to come. I’m reminded of a conclusion I reached in 2020, amidst all the discussion about “when” the LGPD would come into force: the obligations ARE coming, folks. So let’s get on with it, because time is definitely running out to do even the bare minimum properly!