Privacy Law

The Impact of the EU AI Act on International Businesses

Author: Israel Vargas

Emily Barwell, a leader in data privacy, AI, and an expert in EU digital regulations has experience with guiding global companies through EU digital regulations as a Senior Associate at Osborne Clarke. She will be discussing what the AI Act means for Global companies offering AI services that are, either directly or indirectly, interacting with EU consumers.

In April, Israel Vargas, a member of the California Lawyers Association’s Privacy Law Section, interviewed Emily Barwell to better understand the implications of the EU AI Act on international companies operating here in the U.S.

Emily Barwell
Emily Barwell

How will the AI Act affect development and deployment for businesses that interact with the EU?

A lot of technology companies using AI have to manage a whole range of digital regulations. I think companies in the EU have had the AI Act on their radar for a good while now. I speak to a lot of companies that are developing some kind of risk framework and lots of companies already have forms of risk frameworks such as; the legitimate interest test or data protection impact assessment. The AI Act requires a similar risk framework, especially when it comes to high-risk AI or general-purpose AI.

Outside the EU, I’m also starting to see companies have risk frameworks in place, because the AI act has what we call ‘extraterritorial scope’. If their international business AI tool is going to be used in the EU, or the output of their AI product will be used in the EU, they still need to comply with the AI Act. You’ve also got to think then about the supply chain. If you’re a big company like Microsoft or Google, you know your products are going to be used in the EU. But even a business-to-business company, might be thinking, okay, well, maybe I’m going to sell my product to other companies, who are then going to use it with consumers or make predictions about everyday people in the EU, possibly causing some risks there. We’re recommending that companies budget and take the time to make sure that they comply with the AI Act as they’re developing their AI, because it’s often more expensive to change things down the road.

What are some compliance issues that companies might face under the AI Act within the UK, EU, and globally?

Transparency is going to be one of the toughest challenges, AI itself is a big umbrella term for a whole range of technologies. There is often a level of opaqueness, sometimes called a black box in terms of how the AI is actually making decisions about things. The AI Act asks for quite specific information to be disclosed, e.g. how is the data managed, audited, accurate, or not leading to biases?

In terms of outside the EU, companies should be doing similar things. UK companies have to think about which regulators they are affected by. For example, if you’re in the workplace, you might be thinking about health and safety, or you might be thinking about unions and things like that. For people in regulatory areas (such as finance, telecoms etc.), that’s going to be really challenging, because companies in the UK have to comply with a lot of different regulators’ guidance. In addition, if a UK company’s AI tool is going to be used in the EU, they will also have to think about the AI Act.

What advice would you give to legal practitioners and businesses in navigating the AI Act?

I would say to them, get an expert, whether that’s a lawyer or someone internal on your team that’s going to read into the AI Act and related regulations. Get into the details as soon as possible, because a lot of obligations in the AI Act need to be met from the development stage onwards. They will need to implement the AI Act during product development, or any kind of procurement situation. Lastly, for companies across the globe, make sure that contracts include the right kind of flow down clauses to make sure that any distributors, further users, or third parties are still following the rules or alternatively if you are not planning your AI tool to be used in the EU, make sure to add contractual guarantees preventing your AI tool from going into the EU market. 

Will the AI Act have the same “Brussels Effect” as the GDPR did?

It definitely has that level of publicity to it. Even on this side of the pond in the United States, there’s a lot of awareness about the AI Act, companies are taking it up, and lawyers are talking about it. I think it has that kind of similar Brussels effect. I don’t necessarily think that other digital regulations are having as much effect, but the AI Act is the first of its kind so it’s definitely influential.

This article represents the laws and views as of the date of its publication and does not necessarily reflect the present state of the law or relevant regulation. In addition, no content in this article is intended to be provided as legal advice.

If you missed part 2 of this interview series, you can view here.

Forgot Password

Enter the email associated with you account. You will then receive a link in your inbox to reset your password.

Personal Information

Select Section(s)

CLA Membership is $99 and includes one section. Additional sections are $99 each.