Latest / MBA Training AI / The EU AI Act for non-lawyers: a practical compliance playbook

Transcript

The EU AI Act for non-lawyers: a practical compliance playbook · MBA Training AI

• 0:00
  Welcome to the Leaders' Insights podcast.
• 0:08
  Today's episode, the EUAI Act for Non-Lawyers, a practical compliance playbook.
• 0:13
  Everyone's panicking about the EUAI Act, the European Union's law on artificial intelligence.
• 0:19
  You're telling me most of that panic is aimed at the wrong thing?
• 0:22
  Completely wrong.
• 0:24
  Companies are throwing money at model audits and ethics boards when the thing that'll
• 0:27
  actually bite them is far more boring.
• 0:31
  They don't know which AI systems they're even running.
• 0:33
  That sounds like an excuse to avoid the hard stuff.
• 0:36
  It's the opposite.
• 0:37
  The hard stuff is the inventory.
• 0:40
  I've sat in rooms with a bank's compliance team who genuinely could not tell me whether
• 0:44
  their fraud-scoring tool was built in-house or bought from a vendor.
• 0:49
  If you don't know that, you can't classify it.
• 0:52
  And classification is the whole game.
• 0:54
  Break that down.
• 0:55
  Why is classification the game?
• 0:57
  Because the Act is risk-tiered.
• 0:59
  Four buckets, prohibited high risk, limited risk, and minimal risk.
• 1:05
  Prohibited stuff like social scoring, ranking citizens by behavior, has been banned since
• 1:09
  February 2025.
• 1:12
  But the tier that eats budgets is high risk—things like AI used in hiring, credit decisions,
• 1:18
  or medical devices.
• 1:21
  Most of those obligations phase in through August 2026 and 2027.
• 1:26
  So a company's first move isn't lawyers.
• 1:28
  It's a spreadsheet?
• 1:29
  A spreadsheet you'll hate.
• 1:31
  List every AI system who owns it, what it decides, and whether a human can overrule
• 1:36
  it.
• 1:37
  90% of firms skip this because it's tedious.
• 1:41
  Then they hire a magic circle law firm at 900 euros an hour to tell them something
• 1:45
  an intern with a checklist could have found.
• 1:47
  You're being cocky.
• 1:49
  Give me a real number that backs the wrong panic claim.
• 1:52
  Fine.
• 1:53
  A 2025 survey from IBM—and yes, they sell governance tooling, so grain of salt, swite—found
• 2:00
  80% of businesses cited explainability as a top concern, but only about a quarter had
• 2:06
  a complete register of their AI use.
• 2:08
  They're worried about the philosophy and ignoring the plumbing.
• 2:12
  What happens to the firm that gets the plumbing wrong?
• 2:15
  Fines up to 35 million euros or 7% of global annual turnover for the prohibited stuff.
• 2:21
  That's higher than the data protection fines everyone got scared of in 2018.
• 2:26
  But here's the part boards don't grasp.
• 2:28
  The regulator doesn't need to prove your model is biased.
• 2:31
  They just need to prove you had no process to check.
• 2:34
  Absence of documentation is the offense.
• 2:37
  So documentation theater gets rewarded?
• 2:39
  To a point, yes.
• 2:41
  And that's the uncomfortable truth.
• 2:44
  A well-documented mediocre system will survive an audit better than a brilliant undocumented
• 2:49
  one.
• 2:50
  The act regulates your paperwork trail as much as your algorithm.
• 2:53
  It's basically GDPR with a maths degree.
• 2:57
  Who inside the company actually owns this?
• 3:00
  Everyone points at legal.
• 3:01
  And legal points back.
• 3:03
  That's the failure mode.
• 3:05
  My role?
• 3:06
  Whoever deploys the system owns the risk.
• 3:08
  If your HR director rolled out a CV screening tool, that's a high-risk deployment, and
• 3:13
  it's hers, not the general counsel's.
• 3:16
  Legal advises?
• 3:17
  The business owner is accountable?
• 3:19
  Name that person in writing or nothing gets done.
• 3:22
  Let's talk about companies buying AI rather than building it.
• 3:25
  Off the hook?
• 3:26
  No.
• 3:27
  And this is where people get burned.
• 3:29
  If you deploy a high-risk system, you carry deployer obligations even if a vendor built
• 3:34
  it.
• 3:35
  Human oversight, monitoring, keeping logs.
• 3:38
  When Workday got sued in the U.S. over hiring algorithm bias, the vendor made it wasn't
• 3:43
  a shield.
• 3:44
  Same logic here.
• 3:46
  Get contractual guarantees from your supplier that they'll hand over the technical documentation,
• 3:51
  or you're holding the bag alone.
• 3:53
  Give me the sequence a non-lawyer can start Monday.
• 3:56
  Four steps.
• 3:57
  One, inventory every AI system.
• 3:59
  Two, classify each into the risk tiers.
• 4:03
  Most sit in minimal risk, and you can relax.
• 4:06
  Three, for anything high-risk, name a human owner and demand the vendor's documentation.
• 4:12
  Four, write down your oversight process, even if it's imperfect.
• 4:17
  Imperfect and written beats perfect and verbal every time.
• 4:20
  One thing they do today?
• 4:22
  Open a spreadsheet and list every AI tool your company touches.
• 4:26
  Not the fancy models.
• 4:27
  All of them, including the chatbot marketing bot without telling anyone.
• 4:32
  You can't govern what you can't see.
• 4:34
  And right now, most of you are flying blind.
• 4:36
  That's your five.
• 4:37
  The full AI track, structure, no fluff, is at MBA-training.com.