AI Act from 2025: Act NOW!

The EU AI Act, which will come into force in 2025, is a milestone in the regulation of artificial intelligence. It aims to harmonize the development and use of AI systems within the European Union and to ensure that these are ethical, safe, and transparent. For companies, this means a profound examination of their AI-based processes and products to ensure compliance and minimize potential risks. The time for waiting is over; companies must act now to prepare for the new requirements.

The CISA Scandal as a Wake-Up Call

The recent CISA scandal (Cybersecurity and Infrastructure Security Agency) has clearly highlighted the potential risks and consequences of AI systems, particularly in the field of cybersecurity. The incident, in which an AI-driven application falsely identified and blocked legitimate network traffic as malicious, led to significant disruptions and underscored the need for robust control mechanisms and human oversight. This case is a wake-up call for all companies using AI technologies and emphasizes the importance of risk management and continuous monitoring.

The CISA scandal exemplifies that:

• AI systems are prone to errors: Even highly sophisticated AI systems can make mistakes that can have significant negative impacts.
• Human oversight is essential: AI systems should never be used without human oversight.
• Risk management is crucial: Companies must carefully assess the risks associated with the use of AI systems and take appropriate measures to mitigate risks.
• Compliance is not optional: Adhering to regulations like the EU AI Act is essential to avoid legal consequences and reputational damage.

The Impact on Your Business

The implications of the EU AI Act and the CISA scandal are far-reaching. Companies must prepare for the following:

• Increased Compliance Requirements: The EU AI Act will impose strict requirements on the development, deployment, and monitoring of AI systems.
• Enhanced Data Protection: The protection of personal data will play a central role. Companies must ensure that their AI systems are GDPR-compliant.
• Increased Risk Management: Companies must carefully assess the risks associated with the use of AI systems and take appropriate measures to mitigate risks.
• Potential Liability: Companies can be held liable for damages caused by their AI systems.

Recommendations for Action: How to Prepare

Preparing for the EU AI Act is a complex process that requires a holistic view of the company's AI strategy and infrastructure. Here are some concrete recommendations for action:

1. Inventory: Identify all AI systems used in your company.
2. Risk Assessment: Evaluate the risks associated with the use of these systems.
3. Compliance Analysis: Analyze to what extent your AI systems already comply with the requirements of the EU AI Act.
4. Data Protection Audit: Conduct a data protection audit to ensure that your AI systems are GDPR-compliant.
5. Implementation of Control Mechanisms: Implement control mechanisms to minimize risks and ensure compliance with regulations.
6. Employee Training: Train your employees on how to use AI systems and the associated risks.
7. Continuous Monitoring: Continuously monitor your AI systems to ensure they are used safely and ethically.

The Role of ChatGPT and Other Generative AIs

ChatGPT and other generative AI models offer immense opportunities but also carry significant risks. Companies must ensure that they use these technologies responsibly and in compliance with applicable regulations. Transparency in the use of generative AIs is particularly important. Users should always be informed when they are interacting with an AI and how the generated content was created. Furthermore, verifying the results is essential to avoid misinformation or biases. Adherence to data protection is also of central importance, especially when personal data is entered into the AI models.

Conclusion: Proactive Action is Crucial

The EU AI Act is not a distant dream, but an impending reality. The CISA scandal has shown that the risks of AI use are real and that companies must act now to prepare for the new requirements. Proactive action in the areas of AI compliance, data protection, and risk management is not only a matter of legal obligation but also a matter of corporate responsibility and long-term success.

Frequently Asked Questions