The second instalment in our AI trilogy looked at practical advice on how organisations can approach deploying AI in their businesses, some key steps to developing an AI strategy and the major components of an AI strategy to consider in order to maximise the value that AI can bring to your organisation. Our industry-leading external panellists gave their views and experience on a number of areas including the practicalities (and challenges) relating to how organisations are looking at measures to support AI being deployed. Our external panellists were Shalini Kurapati, PhD (CEO at Clearbox AI), Andrea Renda (Senior Research Fellow and Head of Global Governance, Regulation, Innovation and the Digital Economy (GRID) at Centre for European Policy Studies (CEPS)) and Nayeem Syed, Senior Legal Director, Technology Procurement and IP at London Stock Exchange Group (LSEG). Our moderators were Simon Elliott (Partner, Dentons (UK)) and Dr Kuan Hon (Of Counsel, Dentons (UK)).

1. An AI strategy is required: An organisation's AI strategy will help it focus on its core business objectives and prioritise ways in which AI can help deliver those objectives. Organisations may be using AI in creating intelligent products and services and/or designing and improving business processes. As one panellist simply put it: "You need to know what your objective is and what your organisation's risk appetite is." Another panellist highlighted that the correct use of AI will depend on what your organisation is trying to achieve, which is why an AI strategy must be driven by the organisation's overarching business strategy, meaning it is vital that an organisation reviews its current business strategy first, after all AI replaces some current practices. Part of a review of current business strategy is using risk assessment methodology and deciding if the current risk system can absorb new risks, and what skills are required in all departments to review and control such risk. As testing of AI is iterative and collaborative, it requires buy-in from all departments and each of those departments requires the right skills to be in place.

2. Issues for organisations in setting up and pursuing an AI strategy: From one of the panellist's experience, these include breaking the silos and getting each department and discipline (including for example DPO, CEO and Chief Legal Officer) involved. The whole company's involvement is required, especially when it comes to decisions relating to use case. One panellist also raised the challenge of measuring bias and fairness, and another the issue of knowing how to engage with the right stakeholders across the business and what approach to take in the event that your organisation's planned AI activities do not fall directly within the scope of regulated AI (i.e. do not fall within a high-risk category under the draft EU AI Regulation (Regulation)).

3. Challenges and solutions relating to the use of data in AI creation: Developing AI requires large amounts of high-quality data. Data was identified as the fuel of AI. In the experience of one of the panellists, around 80% of the time spent on development of AI relates to dealing with data issues. So build this into your deployment plan. In order to test AI, real-world data is required. Collecting data can be challenging due to privacy concerns (for example, where the nature of the AI use case requires the use of sensitive customer data for machine learning). Other challenges include the issue that some data is expensive to collect, in particular where the data required is rare. Generating synthetic data (information that is artificially manufactured rather than generated by real-world events and which reflects some important statistical properties of the underlying real-world data) can solve these problems. Synthetic data is inexpensive compared to collecting large datasets of real-world data and can support AI/deep learning model development or software testing without compromising customer privacy, although it was noted that creating reliable synthetic data often involves processing personal data in the first place, with attendant compliance issues.

4. Users of AI being made aware that they are interacting with AI: The current Regulation requires that (human) users of AI are informed when they "interact with" an AI system. AI systems should not represent themselves as humans to users; humans should have the right to be informed that they are interacting with an AI system. This entails AI systems being identifiable. There are, however, many challenges and real-world circumstances to explore which are not currently covered by the Regulation, and additional guidance is likely to be required over and above current references in the Regulation. In the experience of one of our panellists, it may be difficult to codify parameters of when and how AI must identify itself to users without the guidance of a very skilled AI board or agency overseeing how real-world interactions occur and develop.

5. Instructions to users of high-risk AI: The Regulation requires users of high-risk AI systems to abide by the provider’s instructions on the use of the system, and take all technical and organisational measures indicated by the provider to address residual risks of using such high-risk AI system. One of the panellists raised the issue that there may well be challenges for providers relating to the provision of such instructions, similar to the use of, for example, medicines or dangerous equipment, which, in the case of AI, might extend to explaining how the whole AI process works and how particular AI decisions have been made. Those organisations that are not the original makers of the AI but are providers will also need to understand the process and provide the appropriate instructions to users.