AI Act

In depth

The risk scale

The text rests on a simple idea: the requirement grows with what a use can do to a person. From this follows a scale, from a handful of practices held to be unacceptable up to a vast set of uses left free, by way of a regulated category that holds the uses deciding access to a right, to a job, to a service or to safety. Between the two sits a cross cutting transparency requirement, meant to ensure that a person knows when they are speaking to a machine or looking at content produced by a machine. The scope follows the use on the European market rather than the nationality of whoever supplies the system: it is the destination that governs, not the address of the head office.

The division of roles

The second mechanism of the text is the distribution of roles along the chain. Whoever designs a system and makes it available does not answer for the same things as whoever uses it. To the first belongs what concerns the product and its documentation. To the second belongs what concerns real use: informing people, human oversight and monitoring over time. This division explains why compliance announced by a supplier never closes the question for the organisation that deploys. A contract can organise remedies between the parties, it does not move a responsibility that the text attaches to a role. That role can, moreover, change: putting a system out under one’s own name or modifying it substantially shifts a party from one position to the other.

What the text seeks

It is more useful to read what the text is trying to obtain than to look for a list of actions to perform. It seeks three things: that an organisation be able to explain how a system behaves and what it was built on, that it remain possible to reconstruct what happened when a decision is contested, and that a person equipped to understand be able to step in where the stakes justify it. The traps come most often from three confusions. The first is to believe compliance acquired once and for all, when a use drifts and a system changes. The second is to believe that a strictly internal use escapes the framework, when the uses that affect employees are among the most heavily regulated. The third is to believe that a compliant tool makes the use one makes of it compliant. The last is the most costly, because it gives the feeling that the question has been dealt with.