The EU AI Act Is Here: High-Risk AI, Security & Human Oversight | Software Sundays #40

First up for the news for this week, Article 50 of the EU AI act has now gone into effect.

So it went into effect in August, at least article 50 went into effect in August, 2026, but the initial rule and the policies and the documentation itself have been published since around 2024, I believe.

And this.

rollout is all based on AI and how to manage the risk that AI systems present to not only countries and citizens that reside in those countries, specifically inside of the European Union, but also the systems that every institution is relying on right now.

So from healthcare to financial services and everything in between, this policy is designed to make sure that every provider of those services that support these industries are keeping in mind what type of risk that they are presenting when they create an AI system that is going to potentially affect the lives of everyone who touches it.

So this is just

one of the more recent effects, but

they are going to continue to have other rollouts as we go into the future for other high risk systems to make sure that those are also complying with the requirements of this act.

And one of the interesting things I thought about with the EU AI act is the fact that it's a very comprehensive list of requirements that companies need to meet, or they have a clear way of saying, oh, this is what we need to meet, or this is where we do not fall under those requirements, so we don't need to meet anything in here.

And that's very different than what we have in the US, where it's kind of up in the air who has to comply with these policies, because nothing has been written into law.

There is a lot of talk about regulating AI now but there's no single established rule book.

There's nothing that you can take to your board or take to your team and say, hey, these are the things that we need to follow, and this is why.

Now, there are some, I'll say frameworks that have been established by NIST, specifically the NIST AI risk management framework.

And that does, that does provide some clarity to teams and organizations on how they could look at AI and how it changes the risk landscape for their organization.

But it doesn't, have any requirements.

There's no teeth into it.

It's voluntary if your organization decides to comply with it.

And there's also been some talks about making foundation model providers go to the government first with their models to make sure that those models are safe for consumption by the public.

And again, a lot of this is voluntary.

There's no requirement that says, X company has to comply because they have this certain revenue because they're in this industry, right? That's the kind of gap that I'm seeing.

And yes, there are other requirements that you have to meet as a financial services company.

There are other requirements like HIPAA or PCI compliance that you have to meet if you're in a specific industry, but nothing that really talks to AI and the change that it kind of presents for data privacy, for cybersecurity and the things like that.

So it's very interesting from that perspective.

And of course, it's going to apply to the companies that operate, like US companies that operate inside of the EU.

So that may be That may have an effect, right? Or it's definitely, definitely going to have an effect, right? Because you might just up some of your policies and your standards internally to meet the strictest guidelines if you have to.