Making the AI Act work for SMEs: The EU tries to square the circle

The EU has a first-mover advantage in advancing the first set of rules on Artificial Intelligence in the world. But without appropriate measures, this emerging market might be left in the hands of big players.

The AI Act regulates Artificial Intelligence based on its potential to cause harm following the new legislative framework, a legislative approach designed for product legislation. For AI systems considered high-risk, the regulation introduces stricter requirements.

Still, ex-ante checks are typically used to assess the conformity of a product that will not mutate throughout its lifecycle. By contrast, AI, by definition, can evolve as it receives more data and the system ‘improves’ itself via machine learning.

For MEP Josianne Cutajar, who followed the file for the European Parliament’s transport committee, the upcoming regulation will not be the end of the story. Since AI is continuously evolving, policymakers should monitor the market and ensure smaller players are put in a position to reap its benefits, she said at a EURACTIV-hosted event last week.

The Commission estimates that only up to 15% of the total AI systems in the market will fall under this category, meaning that the high compliance costs would follow just a specific sector of the market.

“The impact assessment that was done by the Commission has largely underestimated the potential compliance costs,” said Sebastiano Toffaletti, secretary-general of the European DIGITAL SME Alliance, at the same event.

The trade association formed a focus group on AI to discuss with 150 top small and medium-sized enterprises (SMEs) in the field the potential effects of the new policy legislation. According to Toffaletti, the EU is running the risk of dropping legislation that, without even realising it, could hand the market to the most prominent players.

However, approaching the issue differently might be problematic from a regulatory perspective. While the administrative burden weights differently according to the size of the AI provider, the risk remains the same, rebutted Kilian Gross, head of the European Commission’s AI unit.

For Toffaletti, however, the approach followed by the AI Act might lead to an inflation of costs since, once the new rules are set in place, SMEs will only be able to discuss how to comply with them with conformity assessment bodies, which are private entities with interest in raising the costs.

Moreover, another fundamental criticism is the fact that ex-ante conformity assessment tends to be efficient when there are economies of scale. By contrast, Toffaletti underlined that AI systems are mostly highly customised products, often business-to-business.

“The question is always: what is the alternative? If we’re not going to do a market conformity test or a certification before having these products enter the market, how are we going to secure safety and trust in these products?” questioned Miriam Buiten, assistant professor at the University of St. Gallen.

While the overall architecture of the AI Act is unlikely to change at this stage of the legislative process, Intellera Consulting, a consultancy specialised in providing technical support to EU institutions, presented at the same event a self-financed study on how to optimise compliance costs with SMEs.

Massimo Pellegrino, one of the paper’s authors, proposed to introduce a differentiation between SMEs that embed AI in their end products and those that integrate AI systems in their internal products. In the latter case, they should merely be understood as users, which would contribute to alleviating the administrative burden and avoid regulatory bottlenecks.

Another way to reduce compliance costs is to use technical standards, which are by design based on the EU rules. However, also in this case, SMEs deserve special consideration, as the standard-setting process is usually driven by large companies that have deeper pockets.

Finally, Pellegrino also proposed giving more power to the European Digital Innovation hubs to become testing and experimentation facilities or even take on the role of conformity assessment bodies.

This article follows the EURACTIV-organised policy debate “The AI Act – What costs for SMEs?” supported by Intellera Consulting .

[Edited by Nathalie Weatherald]

Read more with Euractiv

EU Council mulls broad national security carveouts in IoT cybersecurity law

The Czech presidency of the EU Council has circulated the first compromise on the Cyber Resilience Act, dated 18 November and obtained by EURACTIV, making hefty editing to the proposal’s scope and free movement clause.