Legal Guidelines for AI Development

"This white paper offers a comprehensive overview of how to responsibly govern AI systems, with particular emphasis on compliance with the EU Artificial Intelligence Act (AI Act), the world’s first comprehensive legal framework for AI. It also outlines the evolving risk landscape that organizations must navigate as they scale their use of AI. These risks include: ▪ Ethical, social, and environmental risks – such as algorithmic bias, lack of transparency, insufficient human oversight, and the growing environmental footprint of generative AI systems. ▪ Operational risks – including unpredictable model behavior, hallucinations, data quality issues, and ineffective integration into business processes. ▪ Reputational risks – resulting from stakeholder distrust due to errors, discrimination, or mismanaged AI deployment. ▪ Security and privacy risks – encompassing cyber threats, data breaches, and unintended information disclosure. To mitigate these risks and ensure AI is used responsibly, in this white paper we propose a set of governance recommendations, including: ▪ Ensuring transparency through clear communication about AI systems’ purpose, capabilities, and limitations. ▪ Promoting AI literacy via targeted training and well-defined responsibilities across functions. ▪ Strengthening security and resilience by implementing monitoring processes, incident response protocols, and robust technical safeguards. ▪ Maintaining meaningful human oversight, particularly for high-impact decisions. ▪ Appointing an AI Champion to lead responsible deployment, oversee risk assessments, and foster a safe environment for experimentation. Lastly, this white paper acknowledges the key implementation challenges facing organizations: overcoming internal resistance, balancing innovation with regulatory compliance, managing technical complexity (such as explainability and auditability), and navigating a rapidly evolving and often fragmented regulatory landscape" Agata Szeliga, Anna Tujakowska, and Sylwia Macura-Targosz Sołtysiński Kawecki & Szlęzak

If you are an organisation using AI or you are an AI developer, the Australian privacy regulator has just published some vital information about AI and your privacy obligations. Here is a summary of the new guides for businesses published today by the Office of the Australian Information Commissioner which articulate how Australian privacy law applies to AI and set out the regulator’s expectations. The first guide is aimed to help businesses comply with their privacy obligations when using commercially available AI products and help them to select an appropriate product. The second provides privacy guidance to developers using personal information to train generative AI models. GUIDE ONE: Guidance on privacy and the use of commercially available AI products Top five takeaways * Privacy obligations will apply to any personal information input into an AI system, as well as the output data generated by AI (where it contains personal information).  * Businesses should update their privacy policies and notifications with clear and transparent information about their use of AI * If AI systems are used to generate or infer personal information, including images, this is a collection of personal information and must comply with APP 3 (which deals with collection of personal info). * If personal information is being input into an AI system, APP 6 requires entities to only use or disclose the information for the primary purpose for which it was collected. * As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. GUIDE 2: Guidance on privacy and developing and training generative AI models Top five takeaways * Developers must take reasonable steps to ensure accuracy in generative AI models. * Just because data is publicly available or otherwise accessible does not mean it can legally be used to train or fine-tune generative AI models or systems.. * Developers must take particular care with sensitive information, which generally requires consent to be collected. * Where developers are seeking to use personal information that they already hold for the purpose of training an AI model, and this was not a primary purpose of collection, they need to carefully consider their privacy obligations. * Where a developer cannot clearly establish that a secondary use for an AI-related purpose was within reasonable expectations and related to a primary purpose, to avoid regulatory risk they should seek consent for that use and/or offer individuals a meaningful and informed ability to opt-out of such a use. https://lnkd.in/gX_FrtS9

If you use GenAI… I want to hold you… accountable. As AI becomes a key tool in legal practice, ensuring ethical use is critical. This condensed framework is based on ABA guidelines and other regulatory standards, balancing efficiency with accountability. 1. Competence Lawyers must understand AI’s capabilities and risks, such as inaccuracies or biases. Regular training is crucial for staying updated. 2. Confidentiality Client data must be protected when using AI tools. Anonymize sensitive data and ensure AI systems are secure. 3. Transparency Lawyers must inform clients about AI use, particularly when it impacts legal services or fees, fostering transparency and trust. 4. Verification of Outputs AI-generated outputs must be reviewed for accuracy to avoid errors like false citations, ensuring the integrity of legal work. 5. Reasonable Fees Fees must be reasonable and reflect the actual work performed. When using AI, this means that lawyers can charge for tasks like inputting data into AI tools and verifying the AI-generated results. However, lawyers should not bill clients for time saved due to AI’s efficiency, unless the client has specifically agreed to this arrangement in advance. This ensures transparency and fairness in billing practices. 6. Addressing Bias Firms should actively mitigate AI biases that could lead to unfair outcomes, particularly in sensitive legal areas . 7. Supervision Supervisory lawyers must ensure that AI use complies with ethical standards, implementing policies and training to manage AI responsibly.

U.S. state lawmakers are increasingly addressing AI's impact through legislation, focusing on its use in consequential decisions affecting livelihoods, like healthcare and employment. A new report by the Future of Privacy Forum, published 13 Sept 2024, highlights key trends in AI regulation. U.S. state legislation regularly follows a "Governance of AI in Consequential Decisions" approach, regulating AI systems involved in decisions that have a material, legal, or similarly significant impact on an individual’s life, particularly in areas such as education, employment, healthcare, housing, financial services, and government services. These high-stakes decisions are subject to stricter oversight to prevent harm, ensuring fairness, transparency, and accountability by setting responsibilities for developers and deployers, granting consumers rights, and mandating transparency and ongoing risk assessments for systems affecting life opportunities. Examples of key laws regulating AI in consequential decisions include Colorado SB 24-205 (will enter into force in Feb 2026), California AB 2930, Connecticut SB 2, and Virginia HB 747 (all proposed). * * * This approach typically defines responsibilities for developers and deployers: Developer: A developer is an individual or organization that creates or builds the AI system. They are responsible for tasks such as: - Determining the purpose of the AI, - Gathering and preprocessing data, - Selecting algorithms, training models, and evaluating performance. - Ensuring the AI system is transparent, fair, and safe during the design phase. - Providing documentation about the system’s capabilities, limitations, and risks. - Supporting deployers in integrating and using the AI system responsibly. Deployer: A deployer is an individual or organization that uses the AI system in real-world applications. Their obligations typically include: - Providing notice to affected individuals when AI is involved in decision-making. - Conducting post-deployment monitoring to ensure the system operates as expected and does not cause harm. - Maintaining a risk management program and testing the AI system regularly to ensure it aligns with legal and ethical standards. * * * U.S. State AI regulations often grant consumers rights when AI affects their lives, including: 1. Notice: Consumers must be informed when AI is used in decisions like employment or credit.    2. Explanation and Appeal: Individuals can request an explanation and challenge unfair outcomes. 3. Transparency: AI decision-making must be clear and accountable. 4. Ongoing Risk Assessments: Regular reviews are required to monitor AI for biases or risks. Exceptions for certain technologies, small businesses, or public interest activities are also common to reduce regulatory burdens. by Tatiana Rice, Jordan Francis, Keir Lamont

The EDPS - European Data Protection Supervisor has issued a new "Guidance for Risk Management of Artificial Intelligence Systems." The document provides a framework for EU institutions acting as data controllers to identify and mitigate data protection risks arising from the development, procurement, and deployment of AI systems that process personal data, focusing on fairness, accuracy, data minimization, security and data subjects’ rights. Based on ISO 31000:2018, the guidance structures the process into risk identification, analysis, evaluation, and treatment — emphasizing tailored assessments for each AI use case. Some highlights and recommendations include: - Accountability: AI systems must be designed with clear documentation of risk decisions, technical justifications, and evidence of compliance across all lifecycle phases. Controllers are responsible for demonstrating that AI risks are identified, monitored, and mitigated. - Explainability: Models must be interpretable by design, with outputs traceable to underlying logic and datasets. Explainability is essential for individuals to understand AI-assisted decisions and for authorities to assess compliance. - Fairness and bias control: Organizations should identify and address risks of discrimination or unfair treatment in model training, testing, and deployment. This includes curating balanced datasets, defining fairness metrics, and auditing results regularly. - Accuracy and data quality: AI must rely on trustworthy, updated, and relevant data.  - Data minimization: The use of personal data in AI should be limited to what is strictly necessary. Synthetic, anonymized, or aggregated data should be preferred wherever feasible. - Security and resilience: AI systems should be secured against data leakage, model inversion, prompt injection, and other attacks that could compromise personal data. Regular testing and red teaming are recommended. - Human oversight: Meaningful human involvement must be ensured in decision-making processes, especially where AI systems may significantly affect individuals’ rights. Oversight mechanisms should be explicit, documented, and operational. - Continuous monitoring: Risk management is a recurring obligation — institutions must review, test, and update controls to address changes in system performance, data quality, or threat exposure. - Procurement and third-party management: Contracts involving AI tools or services should include explicit privacy and security obligations, audit rights, and evidence of upstream data protection compliance. The guidance establishes a practical benchmark for embedding data protection into AI governance — emphasizing transparency, proportionality, and accountability as the foundation of lawful and trustworthy AI systems. 

AI + Privacy New Consumer Report titled "Artificial Intelligence Policy Recommendations" Key Recommendations: Transparency 🔍 Companies must disclose when algorithms are used for important decisions like loans, rentals, promotions, or rate changes. 📝 Companies must explain adverse algorithmic decisions clearly, including how to improve outcomes. Complex unexplainable tools shouldn't be used. 🔬 Algorithm developers must provide access to vetted researchers to understand how tools work and their limitations. ⚖️ Companies must substantiate claims made when marketing their AI products. Fairness 🚫 Algorithmic discrimination should be prohibited, with clarification on how civil rights laws apply to AI development and deployment. 🧪 Independent testing for bias and accuracy should be required before and after deployment of consequential decision-making tools. 🏆 Big Tech shouldn't use AI to unfairly preference their own products when it harms competition. Privacy 📊 Companies should minimize data collection to only what's necessary for requested services. 🔒 Personal data collected by generative AI tools shouldn't be sold or shared with third parties. 👁️ Remote biometric tracking in public spaces should be banned with limited exceptions. Safety 📋 Companies creating consequential or risky tools must conduct risk assessments and make necessary changes. 🗣️ Whistleblower protections are needed for those exposing AI problems that companies won't disclose. ⚠️ Clarify liability for developers who fail to prevent harmful AI uses and unintended consequences. Enforcement + Government Capacity 💰 The FTC and state regulators need additional resources to oversee companies effectively. ⚡ Create legal pathways for individuals harmed by biased algorithms to seek justice when enforcement agencies lack capacity. https://lnkd.in/eHfnJn2C

The EU AI Act's Article 50 transparency rules went live yesterday. A few notes for in-house: ✅ Article 50 catches "transparency-risk" systems whether or not they qualify as “high-risk.” ✅ It reaches non-EU companies. If the output of your system is used in the EU, you are in scope regardless of where you sit. ✅ The obligations turn on whether you are a provider or a deployer. If you build a wrapper, an agent, or a RAG model around someone else's model and put it into service under your own name, you may be the provider of a new system. ✅ Keep in mind that a contract can allocate work between the parties but it can’t reassign the legal role. If you meet the provider definition, you are the provider and the obligations attach. ✅ "Putting into service" covers rolling a tool out to your own employees; you do not need an external customer to fall within scope. What legal teams should consider: 🔸 Build an Article 50 inventory. Identify internal and external use of chatbots, agents, synthetic-media tools, emotion recognition, biometric categorization, and public-interest content workflows. 🔸 Assign the role for each system. Determine whether you are the provider or deployer.  🔸 Map the obligations to each system. Before you design any disclosure, confirm the use case is permitted, and then what notice/disclosure is required based on the system. 🔸 Where disclosure is needed, test the disclosure in its interface. Confirm where the notice(s) appear, and make sure they work across mobile and web interfaces and meet accessibility standards.  🔸 Talk to engineering. Ask which outputs carry marks, what the technique is (C2PA metadata, watermarking), and whether the marks survive a re-encode, a crop or a screenshot. 🔸 Push the requirements upstream in your vendor contracts. Ask for EU AI Act compliance, documentation, logging, change notices, audit support, and cooperation on transparency obligations, and mirror what you promise your customers.  🔸 Document your exceptions contemporaneously. Record why an interaction is “obviously AI” and may not need notice, why an edit is purely assistive or does not substantially alter the input, and why a piece of public-interest text has editorial responsibility. 🔸 Coordinate with adjacent regimes. Emotion recognition and biometric categorization may pull in GDPR requirements as well, so consider building for both. Just a few things 🫠

#AIAct: The European Commission has published guidelines providing essential context and clarity on the prohibited practices under Article 5 of the AI Act, which took effect on 2 February 2025. These guidelines go beyond just listing prohibitions—they offer detailed interpretations, explanations, and practical insights into how these rules interact with the broader legal framework. Key takeaways: • Proportionality - The prohibitions should interpreted in a proportionate manner. • Overlap with other laws – Even if an AI system isn't explicitly prohibited under the AI Act, its use may still be unlawful under other EU laws. • Exclusions – The guidelines contain helpful guidance on the key exclusions under the AI Act, including areas such as national security, scientific research and development, and open-source (under Article 2). • Prohibited vs high-risk – The use of certain high-risk AI systems may be prohibited if the conditions under Article 5 are satisfied. Conversely, most AI systems that benefit from an exception under Article 5 will still be considered high-risk. • Provider responsibilities – Most of the prohibitions apply to the way that AI is used. However, providers also have a responsibility not to place AI systems on the market if they are reasonably likely to be used in a prohibited manner. Providers are also expected to exclude the use of their AI for prohibited practices in their contracts and take action if they become aware of misuse by deployers. • Enforcement – While fine won’t apply until 2 August 2025, the prohibitions themselves are fully applicable from February 2025. What’s next? These guidelines will be formally adopted once all language versions are available. Until then, they serve as an important reference for businesses preparing for compliance. #ArtificialIntelligence #AIRegulation #TrustworthyAI #Compliance #EUAIAct

The AI Policy Guide and Template, published by the Australian Government (industry.gov.au/NAIC), provides a practical framework for organizations to design, implement, and maintain effective AI governance. It serves as both a policy model and an operational guide to ensure that AI systems are developed and deployed responsibly, transparently, and in alignment with ethical and legal expectations. What the guide outlines • Every organization using AI should have a clear, written AI policy that defines how AI is adopted, managed, and governed. • It aligns with Australia’s AI Ethics Principles and the Voluntary AI Safety Standard to ensure responsible, human-centered use of AI across all sectors. • The policy template includes model statements that organizations can adapt to their own values, risks, and operating structures. Why this matters • AI is becoming central to business and public sector operations, but without policy, even well-intentioned systems can cause unintended harm. • A documented AI policy protects stakeholders, supports ethical decision-making, and demonstrates readiness for emerging regulation. • Building trust in AI requires consistent governance, transparency, and accountability at every stage of the AI lifecycle. There’s a saying in governance: “Policy before practice.” In AI, this means setting expectations and accountability before algorithms start making decisions. Key principles and practices • Risk and impact assessment: Systems must undergo structured risk and impact evaluations before deployment, especially where they may affect vulnerable groups. • Quality, reliability, and security: AI must be rigorously tested before release and continuously monitored for performance, bias, and emerging risks. • Fairness and inclusion: Systems should reinforce diversity and inclusion, avoiding bias or discrimination in decision-making. • Transparency and contestability: AI use must be transparent, with mechanisms allowing individuals to understand or challenge outcomes. All deployed systems should be logged in an AI register. • Human oversight and control: Humans must always have the ability to intervene, pause, or deactivate systems. Manual fallback processes should be maintained for critical operations. Who should act • AI policy owner: A senior leader responsible for championing responsible AI use and ensuring ongoing compliance. • Policy approvers: Executives or boards formally approving and updating the AI policy. • Compliance monitors: Teams that audit AI documentation, verify risk assessments, and report on policy adherence. Action items • Maintain a comprehensive AI register to track deployed systems and their oversight requirements. • Review and update the AI policy annually, or after any significant incident, regulatory change, or new AI capability. • Provide regular staff training on responsible AI use, transparency, and risk reporting.

Compliance of AI Systems — Julius Schöning & Niklas Kruse, Osnabrück University (AI Act & XAI Best Practices) Quotations 📚 “The world doesn’t need more AI—it needs more trustworthy AI.” 📚 “You can’t retrofit compliance after development—it must be embedded from step one.” 📚 “An AI system trained on biased or illegal data is untrustworthy by default.” 📚 “The more decentralized the AI system, the harder it becomes to verify compliance at the edge.” 📚 “Simulation and regulation must evolve in sync—one without the other leads to failure or delay.” Key Points 📚 AI Compliance is Lifecycle-Embedded: From data collection to deployment, compliance needs to be integrated across all six AI pipeline steps. 📚 XAI Is a Trust Engine: Explainability methods (ex-ante, ex-nunc, ex-post) enable accountability and legal defensibility—especially under the EU AI Act. 📚 Data Is a Legal Liability: Datasets must be verified for fairness, bias, and legality—flawed data can render entire systems noncompliant. 📚 Edge AI Is a Special Risk Zone: Low compute + local data = high exposure to attacks and audit complexity. 📚 Expert Systems > LLMs for Legal Checklists: Traditional logic-based systems are better suited to track fast-changing laws and avoid AI Act high-risk status. Headlines 📚 “Compliance by Design: Why Trustworthy AI Starts Before the First Line of Code” 📚 “Data Is the Achilles’ Heel of AI—Train on It, Own the Risk” Action Items 📚 Build a Compliance-by-Design Playbook: Start with the six AI pipeline stages—identify legal touchpoints early (data, training, deployment). 📚 Implement Automated Dataset Audits: Use tools to scan for bias, copyright risks, and legal violations pre-training. 📚 Adopt Explainability Standards: Formalize XAI practices across teams—clarify how decisions are made and visualized at each step. 📚 Deploy Legal Expert Systems: Integrate non-autonomous expert logic systems (not LLMs) for real-time regulatory alignment. 📚 Prepare for High-Risk Use Case Reviews: Assess whether your AI applications fall under AI Act Article 6 or Annex III triggers (e.g., employee task allocation). Risks 📚 Post-Hoc Legal Reviews: Discovering legal flaws after training may require complete redevelopment—especially for high-risk applications. 📚 LLM Legal Tools Under Reg Watch: Generative legal advisors may themselves become regulated as “high-risk” under the AI Act. 📚 Noncompliant Dataset Structure: Data tied to biometric rights or discriminatory outcomes may violate Art. 10 of the AI Act. 📚 Blind Deployment on Edge Devices: Without a clear Operational Design Domain (ODD), edge AI systems face reliability and legal ambiguity. 📚 One-Size-Fits-All Explainability: Stakeholders (regulators vs. users) need tailored proofs of trustworthiness—tech alone can’t solve it. #AICompliance #XAI #EUAIAct #TrustworthyAI #RegulatoryStrategy #AIProductLeadership #ResponsibleAI #EdgeAI #DataGovernance