{"id":7125,"date":"2023-02-21T19:44:38","date_gmt":"2023-02-21T18:44:38","guid":{"rendered":"https:\/\/ethicstech.eu\/?p=7125"},"modified":"2023-02-21T19:57:31","modified_gmt":"2023-02-21T18:57:31","slug":"david-wright-i-am-optimistic-about-ai-standards-integration","status":"publish","type":"post","link":"https:\/\/ethicstech.eu\/en\/david-wright-i-am-optimistic-about-ai-standards-integration\/","title":{"rendered":"David Wright: I am optimistic about AI standards integration"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

David Wright:
I am optimistic about
AI standards integration<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
21 February, 2023
agagaj<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

I hope the AI Act reaches a workable consensus between the European Council, the Parliament and the Commission and that it is generally welcomed by stakeholders. I think that with its adoption there will be greater harmonization of AI risk assessments as well. The Commission did give greater guidance to data protection impact assessments with the GDPR and they may well do the same thing with the AI Act, says David Wright in conversation with Maciej Chojnowski.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Maciej Chojnowski: In a report \u201cA survey of artificial intelligence risk assessment methodologies\u201d<\/a> co-produced by Trilateral Research and EY, you refer to risk assessment, impact assessment and risk management as similar but separate approaches. One could also add conformity assessment here. All these terms have something in common but do not cover exactly the same issues. Can you explain the relations between them?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

David Wright<\/strong>*: \u00a0Impact assessment as a general term is the broadest, of course. And there are different types of impact assessment: privacy, ethical, surveillance, security, and environmental impact assessments. They usually follow a structured approach. However, there are quite a few differences in those approaches even so.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Risk management is a kind of different term although it\u2019s certainly associated with risk assessment. Because in order to manage risks you need to assess them and decide which risks you should prioritize, where you should focus your attention etc.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Conformity assessment on the other hand is something totally different. In the case of Europe, it has to do with meeting EU standards. In order to get a CE mark, you have to conform with certain regulatory requirements. The European Commission is quite advanced in its thinking in terms of developing a cybersecurity seal that would be used for certifying software products and services.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Let\u2019s take a look at today\u2019s AI risk assessment landscape. What has already been done, and what is still to come in terms of effective tools or governance procedures?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Working on the survey for EY, we looked at different types of artificial intelligence risk assessments (or approaches that were very close to what we might term an AI risk assessment). And there are lots of organisations, including lots of companies, who are thinking about these issues already. Artificial intelligence has benefits but it also has risks. And those risks have been well publicized in the media. So companies are certainly aware that they should take them into account or otherwise they might suffer something unpleasant to their reputation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

So in terms of context, it\u2019s very favourable towards the introduction of artificial intelligence risk assessment. I think in 2023 we\u2019re likely to see agreement between the European Council, the Parliament and the Commission in regard to the AI Act. And the adoption of the AI Act will be quite an important factor in the expanded use of AI risk assessments.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the report, you name two general types of AI risk assessment: identification of specific risks and classification of an overall level of risk. Should the latter be the first step in evaluating AI systems (with the former being the consecutive step), or maybe you can\u2019t determine the overall level of risk without identifying the specific risks first? Is there one right order here, or maybe it all depends on the situation? <\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

I would say certainly the first step should be the identification of specific risks. No question about it. Having identified those specific risks, one could refer back to the AI Act and see whether it falls in one of the four categories of different types of risk, including prohibited activities and high-risk activities. Most likely it will.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

So definitely the first step is identification of the risks before seeing how it might be categorized and what steps you need to take in regard to which category it falls into.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Your report contains an overview of different AI risk assessment standards. Do you think that once the AI Act becomes law there will be one right European standard developed (e.g. by CEN), or maybe we should expect a coexistence of a number of them (by ISO and IEEE), including the solutions developed in a research project like SIENNA? <\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

That\u2019s a very good question but answering it would require a little bit of crystal ball gazing, and I am not sure I am the best futurist. But certainly the ISO and in particular Special Committee 42 and Working Group 3 have been looking at these kinds of issues and identified principles that AI systems should comply with. So I think that will have quite a big impact. And CEN is following very closely what ISO is doing.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

However while the AI Act is an actual regulation, the ISO standards are voluntary standards. But I am pretty sure as a minimum we are going to have the AI Act and some ISO standards, probably more than one.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In addition to those it\u2019s likely that individual companies or industry associations might also adopt some codes of practice or principles that would be part of that same \u201ccluster\u201d as the AI Act and the ISO standards. So if you take those kinds of activities into account, most likely we will see various types of standards anyway.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Let me continue this thread for a while. I would like to refer to a recent report by the European Commission\u2019s Joint Research Centre on AI standardisation landscape where it reads: \u201cWe see standardisation work at the European level as an instrument for integration and supplementation of valuable content from ISO\/IEC and IEEE, preventing fragmentation when it comes to standards on AI risk management, hence facilitating the work of AI providers to achieve compliance.\u201d Do you think that this sort of integration will be the result of the CEN work?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

I definitely think so. All of those organisations talk to each other. Often it\u2019s the same people going to CEN and ISO meetings and responding to the various consultations that the EC has had in regard to the AI Act. So I would be very optimistic that that will happen definitely.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t