Prepare For The New Wave Of Digital Regulation

• Published date: 13 November 2023
• Subject Matter: Privacy, Technology, Data Protection, New Technology
• Law Firm: Castren & Snellman Attorneys
• Author: Mr Kim Parviainen, Eija Warma-Lehtinen and Sakari Salonen

Artificial intelligence is currently a leading topic in the business world. Many companies are intensively trying to understand the significance of AI for their businesses - both as a risk and an enabler. Legislators have not been idle either. In Finland, the new national legislation on automated decision-making by public authorities entered into force this year already, and in the EU, the AI Act will likely soon follow suit.

Many companies are still trying to figure out what AI means exactly. Legislators have had the same problem: the definition of AI and, consequently, the AI Act's scope of application have raised a great deal of debate. Under the broadest interpretation, many common present-day software solutions could be labelled'artificial intelligence'. At the moment, however, it seems that the definition included in the Act will be somewhat narrower than the wording in the first draft. Even though the AI Act is not yet in force, every company that produces and uses technology should already find out the extent to which the new regulation could apply to it since the proposal includes obligations to both producers and users of AI solutions.

The AI Act introduces new regulatory techniques

The AI Act introduces regulatory techniques that are somewhat new to the general IT industry.The exact obligations imposed by the Act depend on the risk rating the Act gives to a particular AI solution, and the specific content of the obligations is also determined by standards separate from legislation in the same way as, for example, in product safety legislation. Even though the Act does include a set of obligations, many of them are relatively generally formulated in the Act itself. The idea is that the obligations will be specified in more detail in technical standards, and compliance with these standards creates the presumption of compliance with legislation. Even though it is only a presumption, we have long since learned from product safety legislation that in practice the standards form an integral part of the regulatory framework.

The supervision of AI solutions raises questions

The supervisory solutions related to the Act have also raised a lot of discussion. Since many AI solutions are, in practice, based on the processing of personal data, many issues related to AI, such as the use of customer data to improve the service itself and the transfer of...