Responsibilities

Clearly defined responsibilities are essential, alongside attention to data protection, data security, copyright, licensing, contractual regulations and compliance (see Which regulations, aside from the AI Act, need to be considered?). Many companies address this by assembling AI boards or task forces comprising multidisciplinary members. However, statutory duties of company management remain unaffected by the delegation of responsibilities.

Establishing Guidelines

Drafting and implementing AI guidelines in a company clarify legal and ethical demands associated with AI use. Ethical opportunities also support embedding the company’s individual values. For example, decisions can be made on whether convincingly realistic deepfake images and videos may be used publicly or internally for training purposes.

AI guidelines also outline accountability, tackling questions like "Who approves AI systems?", "Who must grant prior consent?", or "Who evaluates if a use case justifies investment?" Moreover, AI-related incidents require mandatory reporting pathways similar to data protection legislation.

Building Competence

The AI Act mandates competence-building on AI use as a legal company obligation. Leadership must ensure employees possess adequate legal, ethical, and technical understanding to use authorised AI systems effectively. Since content and knowledge transfer methods are not strictly defined, leveraging internal resources might also be a feasible strategy.

AI use in companies is often sensitive amongst employees. In organisations with works councils, adopting an AI usage agreement is customary. Thus, open communication and realistic project timelines are critical to effective execution. Even without works councils, timely and transparent communication supports successful AI implementation.

Top Tips