Latest / The In-Between Tech and Trust Podcast / Systemic Trust: How We Test, Regulate & Translate AI Compliance - EP09
Transcript
- 0:01Everything we do, we do to establish and to strengthen safe
- 0:06and trustworthy AI in Europe. What does it take to trust a
- 0:11system we can see and don't fully understand?
- 0:15Welcome to the In Between Trust Podcast.
- 0:17In the podcast at the intersection of tech and trust.
- 0:21In this episode, I speak with Andreas Luta, Head of Strategy,
- 0:25Operations and Partnerships at the TUF AI Lab.
- 0:28We explore how trust in AI is tested, regulated, and
- 0:32translated, and why trustworthiness is not just a
- 0:35feature but a design principle. In this conversation, we talk
- 0:39about accountability, certification, and the culture
- 0:43behind code. Hi Andrea, welcome to the In
- 0:47Between Trust podcast. I'm so happy to dive into the
- 0:50intersection of tech and trust with you today.
- 0:53Hi Irfa, thank you for having me.
- 0:55I'm also looking forward to it. Nice.
- 0:58And let's start with like a question that I really wanted to
- 1:02ask you in regards to your personal but also your work
- 1:07relation with trust. Do you want to like it?
- 1:10Trade a bit on what trust means to you and like also what your
- 1:14perception experience is on it? And yeah, how you perceive the.
- 1:19Topic. For me, trust is a lot about
- 1:22consistency, ongoing correlation between a claim that someone
- 1:26makes and the outcome. So from my point of view, trust
- 1:30always needs a solid base so you can give trust in advance, which
- 1:35we usually do with people and rightly so.
- 1:37But if that trust is not met with trustworthy behavior, it
- 1:41erodes quickly. And another aspect, the level of
- 1:45trust we require depends on the value that is at stake.
- 1:49So you might just trust a stranger with $0.50, but not
- 1:53with a medical operation. I at least would like to see
- 1:56some basis for this first. And I think with AI, it's the
- 1:59same. There are so enormous
- 2:01opportunities in AI. So AI can already detect cancer
- 2:05cells or read traffic signs when driving autonomous.
- 2:09But of course it could also lack trustworthiness.
- 2:12So it could give you a wrong diagnosis because it hasn't been
- 2:16trained on your skin color, or it could misread one traffic
- 2:20sign for another because it's raining.
- 2:22And in such cases, if the stakes of a failure are that high
- 2:26because it could hurt or like even kill people, we need trust
- 2:30that's verifiable and not just assumed.
- 2:33And that's why testing and certification by independent
- 2:37third parties is so powerful because it can create the
- 2:42foundation for trust. And I think this is also true
- 2:45for low risk AI. So see and Germany, the adoption
- 2:49rates for AI are still relatively low and trust from my
- 2:54point of view can be the catalyst that change that so we
- 2:58can unlock the I men's opportunities that AI holds for
- 3:02us. Yeah, with Truth's legacy as one
- 3:05of the most trusted brands in Germany, we have the opportunity
- 3:08to earn that trust in AI as well.
- 3:11Amazing. And you've already like
- 3:13mentioned some of the examples that where distrust was created
- 3:17also what harmful effects this trust can have.
- 3:20And for you personally, was there like a moment recently
- 3:23where you felt trust being formed also where was fractured
- 3:27like on intent or maybe on also unintentionally and that you
- 3:32experienced and also how you then handled?
- 3:34It yes, there was a moment where I felt trust was fractured.
- 3:41I think unfortunately, right now we can see in the US how fragile
- 3:46trust in democratic structures is.
- 3:49So one moment that really struck me recently was reading about
- 3:54Donald Trump firing the head of the US Bureau of Labor
- 3:57Statistics, accusing her of faking figures after he didn't
- 4:01like the latest numbers on new jobs created.
- 4:04And you know, that's the agency that is responsible for
- 4:07producing the countries core economic data and firing here.
- 4:11And also the way it was communicated risks eroding trust
- 4:16in something very fundamental. From my point of view, that is
- 4:20the integrity of national data. And if people stop believing
- 4:25official statistics, we lose one of the shared reference points
- 4:28that help societies make informed decisions.
- 4:31And for me, this is a powerful reminder that trust can be
- 4:36fractured in a single moment, and it takes years or even
- 4:39decades to build. And I know there's not so much
- 4:43sexiness and statistics or in bureaucracy or regulation, but I
- 4:47personally value very much that we in Europe still have
- 4:51independent democratic structures that got credibility
- 4:55and trustworthiness fiercely. And I mean also within like your
- 4:59role in the tooth and specifically with the eyelet.
- 5:02This is something that you like strive for, but this is also
- 5:05something that you like enable and collaborate with, right?
- 5:08And I want to dive a bit more into the creation of the lab
- 5:11because I do think it's also quite special living between the
- 5:15different kind of TIFF structures.
- 5:17And so maybe you can share like the background on the creation
- 5:20path and also what you and your teams are exactly trying to
- 5:24shift within the ecosystem itself.
- 5:26Yes, thank you for the question. Yes, the Turfway I Love was
- 5:30founded in 2023, so relatively young, as an independent joint
- 5:36venture by TUF companies, TUFSU to Fineland, TUF N to Fasen and
- 5:41TUF Turing. And many people in Germany think
- 5:45that there's only one TUF, but they are separate companies that
- 5:49compete with each other. And nonetheless, it became
- 5:52evident that AI certification as a cent for a future topic that
- 5:57is becoming highly relevant for all of them.
- 5:59And therefore they decided to found the TIF AI lab together.
- 6:04You know, the TIF companies are already certifying many products
- 6:08also with AI components such as AI based medical products or
- 6:13industrial machinery using AI. And with the AIA coming in,
- 6:18there was a necessity to have certification for AI and
- 6:22compliance. And therefore we were founded.
- 6:25And the Tough AI Lab aims to translate these regulatory
- 6:28requirements for AI into practice.
- 6:31And our main goal is to make Europe a hotspot for safe and
- 6:36trustworthy AI. Yeah, the AI is a high level
- 6:41regulatory text. And you know, like even the
- 6:43upcoming standards would just give you a direction, not
- 6:47exactly specify how AI can be assessed in the testing and
- 6:51certification practice. And what we do in the Tof AI lab
- 6:54is to develop conformity criteria that are actually
- 6:58quantifiable and suitable test methods for AI assessment.
- 7:02And we're building the two AI assessment framework that is
- 7:07consisting of modular components and that can be used by our
- 7:11shareholders. And some parts of it are also
- 7:14openly published, such as our AI at Risk Navigator, which is
- 7:18published as a free online tool to assess one's risk according
- 7:21to the AI Act. You already mentioned, we are
- 7:24contributing also in the ecosystem.
- 7:26We have several research projects on AI assessments.
- 7:30So we're part of the, we are part of the German Lighthouse
- 7:33project, Miss Yong Kai, and part of the EU project TAFLS that is
- 7:39working on agile certification processes.
- 7:41And then we have projects on automotive perception and one on
- 7:46regulatory sandboxes. And then we are supporting the
- 7:49development of standards and norms for AI systems.
- 7:52And everything we do, we do to establish and to strengthen safe
- 7:57and trustworthy AI in Europe. And I do think like within your
- 8:01role and what you just described, it's like a role that
- 8:04you see across sectors, across cultures, and also across silos.
- 8:09And then again, it's also like a friction point being not only in
- 8:14your role within your organization, but being at the
- 8:16centre part of exactly this ecosystem is something that is
- 8:20super interesting, but definitely also super like
- 8:24ambitious to dive into. How do you see it from your
- 8:28person and also from your organization being part of that
- 8:32ecosystem? Yeah, that's true.
- 8:34Like we're often wondering how ambitious it really is.
- 8:38I personally believe we are working on one of the most
- 8:41exciting but also most complex fields at present, because the
- 8:47AI Act is is the first horizontal regulation of AI and
- 8:51it regulates AI systems across several industries.
- 8:54Yeah, let's just look at what I just said.
- 8:57So we have a fresh new regulation with a very high
- 9:00dynamic because as I already mentioned, standards and norms
- 9:04in the field are still evolving and the harmonized standards
- 9:07have still to be published. And at the same time, we're
- 9:10already experiencing a strong push back because the
- 9:14geopolitical mood has shifted. And then we have the rapid
- 9:17technological progress of the subject.
- 9:21So AI has such fast and frequent iteration cycles and these bring
- 9:26possibly significant changes. And also AI systems may continue
- 9:30to learn even after deployment. And all of this has somehow to
- 9:34be integrated into certification processes because no one wants
- 9:38to recertify their product every few weeks, of course.
- 9:41And then I said, yes, the AI regulates AI systems, but what
- 9:46exactly is the AI system? So even with the guidelines
- 9:50published by the EU, the term AI system covers completely
- 9:55different areas of application and of technical implementation.
- 9:59There's a world of a difference between a rule based expert
- 10:02system and a deep learning model.
- 10:04And and then we have two different industries.
- 10:06So a medical AI system for tumor detection has completely
- 10:10different requirements and it's testing and assessment than an
- 10:14assistant system in a car or a like cross sectoral language
- 10:17models such as TCPT. And very often the testing
- 10:21criteria such as robustness of bias demand the involvement of
- 10:26the main experts from the respective area in the testing
- 10:29procedure. So we are currently seeing and
- 10:32that's like my perspective and my role that even absolute
- 10:36experts in the field are still discovering how big the
- 10:39challenge ahead of us is. And for me, it's absolutely
- 10:42amazing to be able to contribute to such an important task for
- 10:47our society. And I guess it's not only
- 10:49important, but it's also shedding light on things that
- 10:52are potentially not even explored.
- 10:54And when you just like described in regards of like the different
- 10:59areas of also usage and so on, like the one hand side and in
- 11:03particular to AI, right? But then again, compared to
- 11:06technologies in general, I do think that there are like those
- 11:10differences as well. And if we now come back to like
- 11:14the common denominator trust, why is it different for AI
- 11:19systems than other technologies, in particular from your point of
- 11:23view? Yeah, I think that any
- 11:26technology is usually first met with skepticism and needs some
- 11:32time to establish trust. And, and I recently learned on
- 11:35our panel that it took about 10 years for ultrasound technology
- 11:41to gain the necessary acceptance for its widespread use and
- 11:44prenatal diagnostics because before that, the trust and the
- 11:48technology just wasn't there. And if we take these 10 years as
- 11:52a comparison, then trust and chat, CPT and the likes evolve
- 11:56very fast. But why is trust and AI
- 11:59different? Traditional technologies are
- 12:01usually deterministic. So if you push the same button
- 12:04under the same conditions, you will get the same result.
- 12:08And you also know why you are getting this result.
- 12:10And with a, in particular modern machine learning models, we're
- 12:14dealing with systems that are probabilistic, adaptive, and
- 12:18often a pack. And that means we often do not
- 12:21know why a certain input leads to a certain output.
- 12:26And the behavior of continuously learning systems even can change
- 12:30over time, sometimes in ways that we don't fully anticipate
- 12:34or understand. And you just can't test them
- 12:37once and declare them safe forever.
- 12:39So trust in AI has to be continuously earned through
- 12:43ongoing testing, ongoing monitoring and transparency.
- 12:47I can see that as like a quite the challenge for a lot of
- 12:51organizations of how to follow through on that, right.
- 12:54And I think that then again, on the one hand side, there is like
- 12:58this tension between exactly like having this capability of
- 13:02seeing AI incorporated into the processes and then again, in
- 13:08comparison to that, the societal comprehension on it of how they
- 13:13also perceive it. Do you also experience or from
- 13:16your point of view see this tension between the capability
- 13:21and the comprehension of it? How do you like experience it
- 13:24currently? Yeah.
- 13:26From my point of view, that is mainly a speed gap.
- 13:30So AI capability is advancing at an exponential speed, while the
- 13:35societal comprehension, so how well the general public
- 13:38understands AI in general and its capability and its risk
- 13:42moves much more slowly. So I can already today do things
- 13:47that most people don't fully grasp.
- 13:50And when that understanding of a technology lags too far behind,
- 13:54it can create anxiety and sometimes even mistrust against
- 14:00technology. And others totally underestimate
- 14:03the technology and think it will not become relevant for their
- 14:06field. And in this case, we're missing
- 14:09out on important innovation. And then at the same time, of
- 14:12course, there's a lot of hype and some people think that AI
- 14:15can magically do everything perfectly right now.
- 14:19And I don't see any need for regulation or control.
- 14:22And of course, reality falls short.
- 14:24And for me, a closing that gap means making AI not only
- 14:29technically more reliable, but also being transparent about its
- 14:32limits and its risks and balance, balancing
- 14:36trustworthiness and innovation. Overall, certifying for trust is
- 14:41something that's super relevant, but again, it can also be like
- 14:46quite complex. And what does it actually mean
- 14:50according to you and like your experience in your role?
- 14:53And how can testing be also more than just like being perceived
- 14:58as compliance? Yes, AI systems are very
- 15:01complex, but the good good thing is they can be assessed and
- 15:06certified by the two companies if they use the right
- 15:09requirements and tools and processes which we are
- 15:12developing. AI assessment is not based
- 15:16solely on the output of a model of system, but rather on a
- 15:20structured analysis of the entire development and life
- 15:23cycle. So how was the system trained,
- 15:26what data was used and also what control mechanisms are in place
- 15:31during its operation? And as I mentioned before, we
- 15:34have built that modular TIF AI assessment framework.
- 15:38It's a very comprehensive framework for AI assessment and
- 15:41our opinion so far unparalleled in terms of its completeness and
- 15:46systematic approach. And we are currently validating
- 15:49it in practical use cases. So we cannot certified trust in
- 15:55itself, but we can certify compliance with the law and if
- 15:59we have solid laws that should be enough to establish the trust
- 16:04needed. Also for the company side, it
- 16:06wants to mitigate regulatory and reputational risks.
- 16:09And you just also ask how testing can be more than
- 16:13compliance. And 1st, I have to say on that
- 16:16compliance is also much more than just testing because
- 16:19there's a lot of AI testing ongoing out there, but very few
- 16:24companies do the full link to the exact requirements of the
- 16:28regulation. So in particular of the AI Act
- 16:31and sector regulation and the respective norms and standards
- 16:34for all the different AI systems.
- 16:36Therefore, I, I personally think that not too many companies on
- 16:40the market can already offer full AIA compliance, at least
- 16:44for high risk AI systems. And yeah, back to the to the
- 16:49original question, how can testing be more than compliance?
- 16:55There is already very strong demand for certification from
- 16:59the industry because many companies have recognized that
- 17:03certification can strengthen trust in their products.
- 17:06And there are a lot of companies that see a that see a
- 17:09competitive advantage in developing or deploying
- 17:13trustworthy applications. And beside of that, I think that
- 17:19testing and certification are really amazing runways for
- 17:25higher quality. So from my point of view, any
- 17:28company should benefit from AI systems that are robust and
- 17:33cybersecure and perform their task the way intended.
- 17:37And for this station is key. And you just touched upon like
- 17:41the technological infrastructure and like the build up of the
- 17:45systems. And you also showcased some
- 17:48examples of how these are being built or perceived.
- 17:51But what I would be curious about is your point of view on
- 17:55how trust can also be built in culture and not just in code.
- 18:00What is your opinion on that? Yeah, I'm not a developer myself
- 18:05or and we are also not developing AI, but I of course
- 18:09have like a personal opinion on that because I think that trust
- 18:15in AI is not exactly a matter of clean code or accurate models.
- 18:20But it's like really about the culture in which AI systems are
- 18:24conceived, built and maintained. So the keyword here is
- 18:28trustworthiness by design. So you can have the most
- 18:31technically sound AI, but if you have a culture that ignores
- 18:36ethical concerns and transparency or inclusivity,
- 18:40then it will be highly unlikely that the eye turns up
- 18:43trustworthy. And for me, building trust and
- 18:46culture means that you make responsibility part of the
- 18:51everyday decision making so that you train your team to spot
- 18:57potential risks on their own, which is also true for any
- 19:01company, not only AI company very helpful and that leaders
- 19:05encourage questioning their assumptions.
- 19:08And also that organization welcome external audits instead
- 19:14of avoiding them because they might know that they can help
- 19:18them to increase their quality. And for me also trust in culture
- 19:23means bringing diverse perspectives into the room.
- 19:26So you don't have just engineers but also ethicists are the main
- 19:31experts and that you build everything with a human centric
- 19:34approach. And you've now just mentioned
- 19:36like diverse teams. And for a diverse team, you
- 19:39would need a shared language. And I assume that this is also
- 19:43one of the most complex things to establish.
- 19:47But what I would be interested in hearing is why you think a
- 19:51shared language or like a diverse setup is so vital when
- 19:56it comes to like regulations, ethics and the oversight, and
- 19:59what organizations will be benefiting from if they follow
- 20:03through on it, specifically for AI as well.
- 20:06Yeah. I think we already have a very
- 20:08diverse landscape when it comes to AI regulation and its
- 20:15implementation. So we have policymakers and we
- 20:19have the testing institutes and we of course have the
- 20:23manufacturers and deployers of the AI.
- 20:26So we already have like a super diverse landscape and I
- 20:31personally think it's super important that they have a
- 20:35common language that they aligned on because the term
- 20:40artificial intelligence is a umbrella term.
- 20:45So it covers extremely diverse areas of application and
- 20:50technical implementation. So artificial intelligence or AI
- 20:54can mean a large language model such as Cha chi PT, or it can
- 20:58mean the assistance system in the car or it can mean medical
- 21:02computer vision system. Everything is AI today.
- 21:06And you'll see that also the regulator of the AI Act subsumed
- 21:11them under the term AI systems. But there have very huge
- 21:15differences how these systems are assessed or or have to be
- 21:19assessed or have to be tested. And of course you can't start a
- 21:22new assessment process from the beginning for any single new AI
- 21:27system. And therefore we need clear
- 21:29categories that group similar application because otherwise
- 21:33without such categories we cannot systematically assess
- 21:37risks or select appropriate testing methods in a targeted
- 21:41manner. And therefore, I believe we need
- 21:43a common language among experts, experts in regulation and
- 21:47manufacturers and also in testing institutes in order to
- 21:51implement the AI effectively and scalable.
- 21:54And to fill this gap, we have developed the TIF AI system
- 21:59Taxonomy and the TIF AI Assessment metrics.
- 22:02Could you maybe briefly walk us through both just from a high
- 22:06level perspective of why you developed it and what people
- 22:11benefit from if they use it? Yes, I can.
- 22:14Do they both enable this common language of experts.
- 22:17So you could think of the TIF AI system taxonomy of a
- 22:23categorization system such as a closing sizes system.
- 22:27And then the TIF AI assessment matrix is the walk in wardrobe
- 22:32where you can find the fitting closest.
- 22:34So the assessment resources for your system.
- 22:38So I said you couldn't start from scratch anytime.
- 22:41So everybody is different, but the industry has developed some
- 22:46closing sizes so you know what to look for.
- 22:48And in in our case, if you know which exact AI system is
- 22:54assessed, then you will know which shelf of our AI assessment
- 22:58metrics you should look into. Yeah, this was like a metaphor.
- 23:03And now like I explained what what we exactly did.
- 23:07I already said that it established a common language by
- 23:11categorizing AI systems and for us the function of of the
- 23:16systems is paramount and that is why our taxonomy categorizes AI
- 23:21according to three clear criteria.
- 23:23So the first is the task, the second is the input and the
- 23:27third is implementation. And this allows us to
- 23:30distinguish between the task the system performs.
- 23:35What input format, So picture or text or voice format does it use
- 23:41and how is the task technically implemented?
- 23:44And out of these three categories or three criteria, we
- 23:50have a transparent and functional categorization system
- 23:54that places similar systems in the same category.
- 23:59In turn, this means that they can be tested in the same way.
- 24:02Let me give you an example for that.
- 24:05If you have an image classification, so you have an
- 24:08X-ray model that labels images either on tumor or no tumor, and
- 24:15you have on a social media AI system that gives you the
- 24:21sentiment of a social media post.
- 24:23So is it positive or is it negative or is it neutral, then
- 24:28they seem to be very different. But in fact, they both label the
- 24:33input given to them to one of certain labels.
- 24:38So both of them are labeling tasks.
- 24:40And with that, with that knowledge, we can also know that
- 24:45we can the same metrics. So in that case, amongst others,
- 24:49accuracy or precision and recall to judge their quality even
- 24:54across domains. And also our taxonomy helps us
- 24:58to make a difference between AI systems visible.
- 25:02So at the same time, their evaluation remains comparable
- 25:07across the industries, across the technologies and the areas
- 25:10of application. Combined with our TIF AI
- 25:14assessment metrics, which we already published in 2024, AI
- 25:18system taxonomy forms the basis for scalable AI assessment.
- 25:22That is fascinating in such that you've already been at the
- 25:27forefront for quite some time and labeling and also certifying
- 25:31it now. Could you it trade a bit on like
- 25:35the practical benefits that organisations have when they use
- 25:39it in terms of like the reflection aspects for
- 25:43themselves, but potentially also for like their external
- 25:47stakeholders, like clients or ecosystem partners?
- 25:50Yeah, I think we should build that common language because it
- 25:58makes it easier if you're a manufacturer or a deployer of an
- 26:02AI system to have it ready for compliance and have it ready for
- 26:08certification if that's what you wish for or you have to do.
- 26:13So I think for, for companies that develop or use AI, it's
- 26:19very helpful to use that taxonomy in their repository.
- 26:23And then they also know which category they have and can also
- 26:28hand it over to some testing institute or certification
- 26:33institute and then have the similar categories assessed in
- 26:39the way they need. So such as you would go to A to
- 26:43a shopping centre and only try the closest that you know could
- 26:47fit you. They already know what to hand
- 26:50over to have it assessed in the way that this specific AI system
- 26:56needs. Great.
- 26:57So it's really about like finding common ground and make
- 27:00information exchangeable. Amazing.
- 27:02I look forward to having you back in one of the future
- 27:05episodes to see your experiences with it.
- 27:08Definitely, that would be amazing.
- 27:10And as we come to close of our episode for today at least, I
- 27:15want to dive in some moments with you because in each like
- 27:17episode that I have with my guests, I have so-called in
- 27:21between moments. These are like moments when I
- 27:24have like a one word reflection that you would now answer like
- 27:27intuitive, personal and basically from your top of mind
- 27:31and in the moment and kind of response.
- 27:34And I ask in the first part of what trust feels to you like.
- 27:40I'd say reliability. And what does oversight feel to
- 27:44you like? Responsibility.
- 27:46And if you had to say what AI is to you, what would you say?
- 27:50A catalyst. What do you think we need more
- 27:52of? Humanity.
- 27:54Of that, what do you think we need less of?
- 27:56Excuses to innovate? OK, let's dive into that topic
- 27:59another time because I will be curious to hear your excuses
- 28:03that you received. And then lastly, one word you're
- 28:07currently in between of. Hopefully growth.
- 28:09And then I want to close with one reflective question because
- 28:13I really enjoyed our conversation.
- 28:15But I do think that our listeners would be curious to
- 28:18hear from you if you could leave them with one shift in how they
- 28:22think about AI and trust. What would that be?
- 28:25It is very important to me that innovation and trustworthiness
- 28:29are not contradictory, so the innovation that I want to see in
- 28:33Europe is trustworthy and puts people at the centre.
- 28:37What a great way to end a great episode.
- 28:39Thank you so much for all the insights that you shared, for
- 28:43the reflection part that we dove into, and for all the outlooks
- 28:47that we have to get back together and see and the
- 28:50progress that you made with your assessments, taxonomies, and
- 28:53also implementations with your team and beyond.
- 28:56Thank you so much for joining us.
- 28:58It was a pleasure having you. Yeah, thank you very much.
- 29:00I also enjoyed about it very much and also looking forward to
- 29:03the next interview or any other talk we'll have.