Exactly one year ago (give or take a day or two!), we shared an update on where we were with the EU’s AI Act.

While no AI Act appeared under our Christmas tree last year, the new year is getting off to a strong start, with a provisional political agreement on the AI Act and a leaked text of the close-to-final version of the AI Act.

While there still seems to be a fair amount of work to be done at the institutional level to finalize the AI Act, does this mean that businesses can continue hitting snooze on the start of their AI compliance journey? For the European Commission, the answer is no.

On January 24, 2024, the European Commission decided to break the deadlock and launched its AI innovation package to support AI startups and SMEs, as well as a Communication (AI@EC Communication) outlining its own strategic approach to the use of AI.

With the AI@EC Communication, the European Commission has started preparing itself by putting in place the first measures for the operationalization of the AI Act once it is adopted and enters into force. These measures build on its internal experience with AI and the existing legal and policy framework, and take into account the main areas where AI can be most beneficial to the European Commission and its staff.

The explicit aim of the European Commission is to set a positive example by anticipating the AI Act and working on implementing its requirements way ahead of the legal deadline, as recommended in the AI Pact.

So if you were still in doubt about whether you need an AI governance strategy, the answer is: “Start developing your strategy now!” If you are unsure on how to start, be inspired by the European Commission’s strategy!

To help you on your way, here are three main lessons (to be) learned from the European Commission’s AI governance strategy. If you want to find out more about how to best structure your AI governance, check out our webinar on AI governance here and explore our AI Hub!

1. An effective AI governance strategy should include both operational and organizational actions, which take into account both the legal framework and industry best practices.

An AI governance strategy shall consider:

1. Planned EU political and legislative initiatives 
2. All applicable existing legislation including on non-discrimination, accessibility, information security, and data protection
3. Best practices and examples from industry, and at both the national and international levels 

Among such best practices, the European Commission mentioned the Hiroshima Process International Guiding Principles for Advanced AI system and the Hiroshima Process International Code of Conduct for Advanced AI Systems, as well as the Ethics guidelines for trustworthy AI.

In the European Commission’s view, the main pillars of an effective AI governance strategy are the following:

• Implementing internal operational guidelines for users, developers, and procurers of AI systems, describing in clear and pragmatic terms how to put such systems in operation;
• Classifying AI systems in (current and/or future) use based on a risk-based approach and on the operational guidelines mentioned above;
• Refraining from using AI systems that are considered incompatible with European values or that represent a threat to the security, safety, health, and fundamental rights of people;
• Putting in place adequate organizational structures to ensure the fulfilment of the relevant obligations in relation to AI.

The organizational structures shall be responsible for assessing AI aspects of new IT investments (together with the existing corporate IT governance); supporting and monitoring legal, ethical and regulatory compliance, as well as adherence to internal operational guidelines; and creating a broad network of interested colleagues to share knowledge, raise awareness, and identify AI opportunities and use cases.

2. An AI governance strategy should identify priorities, but remain a living document, which requires regular reviews and updates.

The European Commission has already started the implementation of its AI governance strategy and expects it to be fully in force by October 2024.  Given the short timeline, the EC has set clear priorities for implementation.

Among the various operational actions included in the European Commission’s AI governance strategy, the following have been given priority and scheduled for Q2/2024:

• Establish and maintain an up-to-date register of AI systems in use, assessed against corporate guidelines and legal requirements;
• Establish and maintain a list of existing AI initiatives and propose their prioritization in view of the creation of corporate AI services;
• Develop, with a risk-based approach, concrete operational guidelines for staff, to be applied for the selection, acquisition, development, testing and deployment of AI solutions (at corporate and policy level), including general and specific AI cybersecurity related topics;
• Draw up guidelines on the use of specific AI systems (e.g. internal guidelines for the use of third-party online generative AI tools);
• Develop a change management and communication framework to accompany staff. This includes raising awareness amongst staff about AI and its potential impacts, sharing testimonies from the first teams to adopt AI, and involving “champions” to share the benefits and the good practices to use AI effectively and responsibly;
• Build on and further strengthen actions supporting the data maturity of the European Commission. In this respect, developing a frictionless internal data ecosystem will help to introduce AI systems more quickly and more easily;
• Build an agile and flexible approach to the development and use of AI systems by (i) using specific infrastructure and platforms, (ii) making the most of the existing expertise and other special resources and data, (iii) paying attention to commitments on the carbon and energy footprint and to the security of the data.

The following operational actions have instead been scheduled by the European Commission for Q3/2024:

• Develop a policy to build and maintain an AI-skilled workforce, training staff to know how to prompt AI systems to get the most useful results and how to critically assess outputs also through the development of a dedicated learning offering, with practical, easy-to-use advice for staff at all levels;
• Define and recruit the specialist profiles needed to develop AI tools internally;
• Map the possible upskilling/reskilling needs of different job groups, engaging with staff to identify current and future needs in terms of skills linked to the performance of specific tasks (e.g.: document drafting, formatting and editing; multilingual language assistance such as spell check, transcripts and translation; diary management and automation of related recurring activities; etc.);
• Develop a framework to reuse (and contribute to) open-source AI;
• Foster knowledge sharing and seek cooperation opportunities with stakeholders.

For each action, the European Commission has identified a responsible entity/body and a timing for the review and update of each deliverable (which, for certain tasks, is continuous: e.g. for the register of AI systems).

This is because an AI governance strategy is a living document: it must be reviewed and updated regularly to reflect not only changes in the applicable regulatory and political framework, but also the dynamic nature of AI technologies as well as the lessons learned.

3. Prioritize use cases which will make a positive impact on employees’ daily work, and investments in tools that can be used or applied across various policy areas and use cases.

In defining an AI governance strategy, it is important to identify the relevant use cases. As noted by the European Commission: “The adoption of AI, achieved through the identification of use cases, as well as the development and deployment of AI systems, is crucial for realizing the AI corporate vision”.

In the European Commission’s experience, “Exploration and development of AI use cases has so far been ‘opportunistic’ or needs driven”. The focus was on helping staff to gain efficiency by automating repetitive and time-consuming tasks and supporting analysis, compilation and drafting. This frees them up to concentrate on more strategic, creative, and value-added assignments that require critical thinking, problem solving and relationship building.

It therefore comes as no surprise that the European Commission will prioritize the implementation of AI in those areas where it will make the most positive impact on its employees and productivity. Moving forward, it will also focus on developing reusable processes and IT capacities, such as generative AI tools for integrated internal data sources.

As the European Commission charts its course for its AI journey ahead, its proactive and practical approach sets a clear precedent for responsible and impactful AI implementation, and can be a source of inspiration for both the public and private sector.

This article is based on the Communication to the Commission “Artificial Intelligence in the European Commission (AI@EC) – A strategic vision to foster the development and use of lawful, safe and trustworthy Artificial Intelligence systems in the European Commission” dated January 24, 2024 (available here) and it is updated as of January 28, 2024.