Privacy Incident Management | RadarFirst – this image contains a deep astral field full of distant stars and galaxies. RadarFirst blue sheens across the cosmos to evoke feelings of vast potential and the possibilities for growth and exploration through digital transformation.
Compliance

Third-Party Risk Management for the EU AI Act

The European Union’s AI Act is a landmark piece of legislation poised to reshape how organizations develop, deploy, and use AI systems worldwide. During the phased implementation stage, organizations must take action to meet compliance requirements.

A critical aspect of this preparation involves understanding and managing the risks associated with third-party AI systems or AI components integrated into their operations. Failure to do so can result in significant financial penalties, reaching up to EUR 35 million or 7% of global annual turnover. This blog post will guide organizations in creating a plan, internal policies, and systems to monitor and report third-party risk in compliance with the EU AI Act.

Understanding the Scope and Implications of the EU AI Act

The EU AI Act adopts a risk-based approach, categorizing AI systems into four levels: unacceptable, high, limited, and minimal risk. 

The obligations are directly proportional to the perceived risk, with high-risk AI systems (HRAIS) facing the most stringent requirements. These include AI systems used in areas like critical infrastructure, education, employment, law enforcement, and financial services. Additionally, the Act introduces specific provisions for general-purpose AI (GPAI) models, which are regulated regardless of their specific use case, with more demanding requirements for those deemed to pose a systemic risk.

For organizations engaging with third parties for AI solutions, whether as providers (developing or placing AI on the market), deployers (using AI systems), importers, or distributors, understanding their role and the risk level of the AI involved is paramount. The EU AI Act’s extraterritorial influence means that even organizations located outside the EU but placing AI systems on the EU market are subject to its regulations.

Crafting a Comprehensive Compliance Plan for Third-Party AI Risk

Developing a robust plan is the first step towards managing third-party AI risk under the EU AI Act. This plan should include the following key stages:

  • Identify Your Role(s) and Obligations: Determine whether your organization acts as a provider, deployer, importer, or distributor in relation to the third-party AI systems you use or offer. Each role carries specific obligations.
  • Map and Classify Third-Party AI Systems: Conduct a thorough inventory of all AI systems or components procured from or provided to third parties. Subsequently, assess the risk level associated with each system based on its intended use, aligning with the act’s risk categories. Pay close attention to whether these systems qualify as HRAIS or GPAI.
  • Establish Due Diligence Processes: Implement rigorous due diligence procedures for evaluating potential third-party AI providers and their systems before adoption. This should include assessing the provider’s understanding of and adherence to the EU AI Act requirements, their data governance practices, technical documentation, and risk management frameworks.
  • Incorporate EU AI Act Requirements into Contracts: Ensure that contracts with third-party AI providers clearly define responsibilities regarding EU AI Act compliance. This should cover aspects such as data governance, transparency obligations, technical documentation, incident reporting, and adherence to human oversight requirements for HRAIS.
  • Conduct Risk Assessments for Third-Party AI: Perform thorough risk assessments specifically focusing on the integration and use of third-party AI systems. This should identify potential risks to fundamental rights, safety, and other areas covered by the EU AI Act. For HRAIS deployed by your organization, you may need to complete fundamental rights impact assessments.
  • Develop a Compliance Timeline: Align your plan with the EU AI Act’s implementation timelines. Be aware that the prohibitions on certain AI systems and AI literacy requirements will apply from 1 February 2025, while GPAI requirements will apply from 1 August 2025, with most provisions applicable from 1 August 2026 and full enforcement by 1 August 2027.

Developing Internal Policies for Managing Third-Party AI Risk

Well-defined internal policies are crucial for translating the compliance plan into actionable practices across the organization. These policies should address:

  • Third-Party Vendor Management: Outline the procedures for selecting, onboarding, and continuously monitoring third-party AI providers. This should include criteria for assessing their compliance capabilities and ongoing performance.
  • Acceptable Use of Third-Party AI: Define guidelines for how employees can appropriately and securely utilize third-party AI systems, considering data privacy and security requirements.
  • Data Governance for Third-Party AI: Establish clear rules for managing data shared with or processed by third-party AI systems, ensuring compliance with the EU AI Act’s data and data governance measures for HRAIS. This includes requirements for training and testing data.
  • Incident Response for Third-Party AI: Develop specific procedures for identifying, managing, and reporting incidents related to third-party AI systems, including potential breaches of the EU AI Act. Ensure alignment with the 15-day reporting obligation for serious incidents involving HRAIS.
  • AI Literacy and Training: Implement training programs to ensure that staff involved in the procurement, deployment, and oversight of third-party AI systems have sufficient AI literacy to understand the risks and requirements associated with their use. The appropriate level of AI literacy depends on the staff’s roles and the context of AI system usage.

Establishing Systems for Monitoring and Reporting Third-Party AI Risk

To ensure ongoing compliance and effectively manage risks associated with third-party AI, organizations need to establish robust monitoring and reporting systems:

  • Regular Audits and Assessments: Conduct periodic audits of third-party AI systems and their providers to verify continued compliance with contractual obligations and the EU AI Act’s requirements. This should include reviewing technical documentation, data processing practices, and adherence to risk management protocols.
  • Performance Monitoring of HRAIS: For third-party-provided HRAIS, establish mechanisms to monitor their performance, accuracy metrics, robustness, and cybersecurity resilience, as mandated by the EU AI Act.
  • Incident Logging and Reporting: Implement a system for logging all incidents, malfunctions, or potential non-compliance issues related to third-party AI systems. Ensure a clear process for escalating serious incidents to the relevant internal teams and, where required for HRAIS, to the relevant authorities within 15 days.
  • Record-Keeping: Maintain comprehensive records related to the assessment, deployment, and monitoring of third-party AI systems, including technical documentation, risk assessments, audit logs, and incident reports, as required for HRAIS.
  • Transparency and Information Sharing: Foster open communication channels with third-party providers regarding their compliance efforts and any potential risks identified. For HRAIS, ensure that the necessary instructions for use, including details on characteristics, capabilities, and limitations, are available. If your organization deploys a HRAIS, ensure you use it in accordance with these instructions.
  • Establish a Feedback Mechanism: Create a process for internal stakeholders to report concerns or issues related to the use of third-party AI systems.

A Proactive Approach to Third-Party AI Risk

Navigating the complexities of the EU AI Act requires a proactive and comprehensive approach to managing third-party risks. Organizations can mitigate the risks associated with using AI systems from external providers by developing a detailed compliance plan, implementing robust internal policies, and establishing effective monitoring and reporting systems. 

Early preparation is crucial. Identifying your role, assessing your AI systems, and developing a robust compliance strategy now will not only help avoid potentially significant penalties but also foster trust and responsible innovation in the age of artificial intelligence. Remember to stay informed about further guidance and standards that will be published during the two-year implementation period. Organizations should consider seeking expert support to ensure comprehensive compliance.

EU AI Act Compliance Made Easy

Jumpstart your risk management for EU AI Act reporting with Radar Compliance. Accelerate your compliance program maturity with a documented risk decision-making process that automates assessment and escalations to ensure compliance.