#5: The EU AI Act Is Here: What Should Businesses Do Now?

Denis Jastrzebski (00:30)
Hello and welcome to the Digital and AI Decoded Podcast presented by the Content Plan team. My name is Denis, I’ll be your host, and I’m here with Alan Thornton today. We’re going to have a really interesting conversation about the EU AI Act. And specifically, it’s been coming through in phases over the last couple of months and over the last two years. And now August 2026 being a key month where a new phase has come in.

And as of the date of this recording, which is in the latter part of August 2026, there’s a lot of new information and a lot of great questions that are being asked across the board by businesses and organizations. So we want to really decode that today, make it really simple to see what the AI Act is about, what we have to do to be compliant, and how can we future proof ourselves for the next phases that are coming in as well.

so Alan is the founder of AI Compliance app and he works in the AI governance and compliance space and he particularly is has a focus on accountability, human oversight, and the evidence organizations need to demonstrate on using AI responsibly. So, Alan, how are you doing? It’s nice to have you on today.

Alan Thornton (01:39)
I’m really good and I appreciate the invite, Denis. I’m looking forward to this conversation.

Denis Jastrzebski (01:43)
Yeah, absolutely. So what we’re gonna focus on, just I’d like to ask you, Alan, high level, really simply. The obvious question being what exactly is the EU AI Act? How would you put that simply for us?

Alan Thornton (01:54)
Yeah, no problem. So I’ll try and keep it to one sentence. and it’s essentially a safety framework designed to protect, you know, human safety and fundamental rights without stalling commercial innovation. So that’s essentially what the act is about and it’s the first kind of far reaching, I suppose, piece of law and regulation around AI on the planet.

Denis Jastrzebski (02:17)
Yeah, absolutely. No, that’s that’s a great description of it. and we have a kind of a a small definition that the Irish government uses, and we they’ve assessed it as a risk based framework. so it’s not necessarily just a set of rules around AI systems. We know we know that AI is moving so quickly, it wouldn’t really make sense to have a a number of very, very strict rules about how the technology is to be used, because by the time they’re even put into legislation, they’re already going to be out of date. So

It’s based on a slightly different approach and this kind of a risk based framework. So Alan, when it comes to that risk based framework, what what does that actually mean? what does that mean in practice?

Alan Thornton (02:54)
Yeah, so the Act itself breaks it down into four categories. So there’s unacceptable category category, which is kind of the very top of the pyramid. This would be banned AI use cases. and that has been in place since February twenty twenty five. So anything that, you know, falls into the unacceptable kind of top level prohibited risk categorization cannot operate inside the EU markets as of February twenty twenty five. So

Some people may need to check their use cases and see do they have any still running inside of their businesses. Then we’ve got the next step down. The ladder is high risk systems, which is heavily regulated. So that would be things like HR, finance, credit scoring, insurance, AI tools and products. Step down again, we have limited risk, which is kind of specific transparency, things like GPAIs, yeah, you know, chatbots, deep fates,

Gemini Claude, depending on how you use them. And then the very bottom of the pyramids is minimal risk. So things like spam filters, AI and video games, stuff like that. So it’s kind of creating four clear buckets that you can fall into and then the compliance requirements and that applies will be relevant to the category you fall into.

Denis Jastrzebski (04:07)
Okay, okay, yeah, that that makes sense. So those four categories obviously are there for a reason, and obviously being the the risk is at the very, very top. We can imagine some of the issues that that might come up with using an AI system for some of those things. So a big example has been for example, in the recruitment process, right? If if you’re using AI to assess applicants, there’s so many different possible ways it could go wrong, different biases that could be introduced into that whole process.

or or just if you’re using that to to assess whether somebody is is a good or or a bad fit. we we can’t always rely on AI to be kind of 100% consistent. That’s that’s unfortunately the nature of it at the moment. So it makes sense that things like that would would immediately be a high risk type of tool. So that’s that’s really interesting. And I suppose in connection with that, if you think about a simple chat GPT user, so you know you have a a business

business owner and they’re using Chat GPT or even like Microsoft Copilot as part of the Office three six five suite. where does that fall into the the whole risk categories?

Alan Thornton (05:06)
Yeah, so you know, off the shelf tools like Copilot, Chat GPT, they aren’t automatic compliance traps. That’s probably how I would describe it. but mandatory transparency requirements do apply to them, if they are customer facing kind of in in any way. So if you use those tools and they have outputs that, you know, go out to the public, there will be transparency requirement there. as we go through today’s talk, we kind of learn

where that piece falls in in your overall AI governance kind of framework and setup. But but that’s essentially it. So, you know, off off the shelf tools like that, they don’t have, you know, an instant compliance trap associated to them, but they may have a a transparency piece required depending on the output.

Denis Jastrzebski (05:49)
Yeah. And obviously we’ve seen like with all the different AI models and the companies offering them, so whether it’s Claude, ChatGPT as OpenAI, Google, they have different tiers for, you know, you let’s say your pro subscription in a lot of cases on on Open AI. Then you’ve got business licenses and and they’ve got obviously the enterprise side of things. So does the AI Act kind of affect any any of those things? So if you’re a business owner, does it make a difference if you’re using the free or the paid version of ChatGPT?

Or is there a particular reason why you might want to opt in for the business version just in the context of the EU AI Act?

Alan Thornton (06:21)
Yeah, for sure. So it doesn’t really matter which version that you use, but there is definitely an upside to not using the free kind of open versions. If you are an organization and a business that relies on AI for anything, you would want business accounts that everybody across the organization can use, or if you’re a large scale enterprise, you would want maybe specific deployments built out for your organization and what you need to do. The reason why is in the context of the EU AI Act.

it’s a severe, you know, breach when you open yourself up to large scale fines if data, you know, leaks out in any way whatsoever. So when people are not on an enterprise account or a business account, they they could be using, you know, what’s kind of classified as the shadow AI setup, where they maybe take some documents from work and they pump them into their own chat GPT at home, just do some edits, bring it back into work or whatever it may be.

Things like this happening, if there’s a data leak associated to that around your organization, that information, you’re completely at risk of falling foul with the regulators and obviously open yourselves up to compliance fines and brand issues.

Denis Jastrzebski (07:26)
Yeah, it makes a lot of sense. And and the fact is, like at this stage, AI has been around for a couple of years. We’ve seen that and in in the different training workshops that we’ve delivered, and I’m sure you’ve seen it too, one of the most common things is you know, everyone’s using it to some extent. employees within companies are using it even without kind of governance of that internally. and yeah, you you can imagine the amount of issues that can cause, right, with uploading, let’s say, a confidential meeting report or

There’s been lots of horror stories even for for massive multinationals, especially when when AI first kind of came in into the limelight in in kind of twenty twenty-one, where employees were that were a bit more tech savvy, were kind of jumping on the trend a little bit too quickly, using it for different things without realizing we’re actually uploading like proprietary information into a chat bot that’s also has servers that are based in the US. so you know, aside from GDPR or there’s all sorts of issues that can pop up with that.

so it it is a really good point and and I like that term shadow AI that that you use. It’s it’s a great way of describing it because it that’s probably the majority of people these days, especially if you’re working within a company or organization. So that’s really, really good. and I suppose w with the next thing that we want to talk about is is now that we know generally what it’s about, we have that kind of framework that that’s been described.

How can we apply that practically? So, what do organizations kind of really have to know or prepare as part of the act? so up until let’s say this month, organizations would have had quite a lot of time to kind of make plans and implement different I suppose, precautions

Alan Thornton (08:55)
Mm-hmm.

Denis Jastrzebski (08:56)
and and and workflows to make sure that they’re compliant as this new phase has come in this month in August 2026. So, really, what’s changed since let’s say last month with everything from the the beginning of the AI Act?

what’s like a high level overview that you can give us, Alan?

Alan Thornton (09:09)
Yeah, no problem. So with the August second, twenty twenty six deadline passing around enforcement for Article fifty and and transparency related kind of work in this space, what’s what’s really changed is there has to be kind of a clear oversight disclosure and staff literacy piece in place for organizations, no matter what the use case is. So whether it’s, you know, a load of limited risk systems

a mixture of limited and high risk, whatever it may be, you need to have that kind of oversight, disclosure, and staff literacy piece in place because that’s what the enforcement deadline is coming to kind of check on. If a regulator was to come and ask, they want to see do you have your evidence in place? Potentially they want to backdate it to August second. So anybody who has that work done, fantastic. They can relax, they can move forwards, potentially tweak it, enhance it, whatever they may need.

Anybody who doesn’t have it in place is is gonna get caught out eventually because it’s not the regulator you really have to worry about first. It will be a procurement team, you know, from a partner, it will be somebody in a supply chain, it will be a tender document or something like that that’s gonna ask for insights into your governance framework, can you prove you know the evidence around the use cases that you have and your general human oversight governance policy piece? So what’s really changed is

The European Union has said they’re going to start reaching out and have conversations with businesses and that’s essentially around technical documentation, which can cover an oversight piece, disclosure piece, literacy piece, because all of these things are mandatory parts of the EU AI Act. And if you can produce them, it’s a relaxed conversation. If you can’t, it kind of triggers the next step for them to go heavier on you and again, as I said, bringing you to kind of position of a fine eventually. so

What’s really changed is you need to be serious about building the oversight piece, getting your staff trained up and getting those describes in place. They need to be there now.

Denis Jastrzebski (11:06)
Yeah, right. So the time is now. And what’s that technical documentation piece? What would be like an example of that? Is that like a document? What what would it usually look like?

Alan Thornton (11:15)
Yeah, so it it can be a series of documents around kind of policy and procedure for the AI systems that you use. So for example, if you have limited use cases around GPAIs like Gemini produces sales graphics for your product or whatever it may be, you would want to have that use case logged, you would want to have a human assigned to its use case and its outputs as kind of that accountability piece.

and have dates and logs in place for this is the system we use, this is how we use it, and then it goes out to the public. So we have transparency obligations on that. This is how we’re gonna put our labels on there, this is how we’re not gonna put our labels on there. If it’s if if there’s an exemption, for example. So you want to be able to produce that information in a machine readable or human readable format. So JSON, HTML or a PDF. And it would be beneficial to organizations to be able to produce something like that.

in thirty minutes. You know, it’s not a requirement, but if you can do that within thirty minutes, you have a a rock solid kind of framework in place that allows you to just pull that information out quick and you can stand over it. So that’s that’s what it looks like. you need to be able to produce evidence around the use cases, the oversight piece, the governance piece, and present it in the formats that are required. So a machine can read it or a human can read it.

Denis Jastrzebski (12:34)
Yeah, so that makes sense. It it kind of quite neatly fits fits into other policies and procedures and kind of SOPs that you might have for other compliance reasons, right? and I suppose for me the EU AI act has always kind of resembled GDPR in terms of well in in a number of different ways. So like it coming in initially, it’s a massive piece of legislation and like technical, and there’s a lot of parts in it. so one, it’s difficult.

To actually wrap your head around all the different requirements that are there. and then kind of similarly, because it’s so big and it’s so daunting, and then you know, you might kind of hear some high level notes from it in social media and you’re hearing about these massive fines and all this stuff, and it kind of almost paralyzes a lot of people to even look at it altogether and they’re like, it’s you it hasn’t come in yet, it’s it’s a while away. And that tends to happen up until the very point that that it actually, you know, fully went live with all the different requirements that are there.

And I think the AI Act is is a little bit similar. you know, once again there’s fines in there, like like you would expect. And it might be a bit daunting to actually approach that whole topic. But it sounds like the the general principle or the high level of it is that it’s it’s just about accountability and pretty much documenting how you’re using AI within your organization. Would that be kind of a a broad generalization? But would that be fairly accurate?

Alan Thornton (13:51)
It would be, yes. and another kind of core component of it is literacy. So making sure staff in organizations have the kind of relevant training to the AI that they use inside of the organization. So a receptionist, you know, using Chat GPT will need a certain level of literacy training, whereas your HR team will need a higher level and then leadership teams will need probably indeed the top tier training. so really the the best way to think about it,

from a from a core perspective in relation to the act on literacy and how important it is is how can board members make decisions on the deployment of any AI at any level inside their organization if they don’t have literacy training on how it works at all.

Denis Jastrzebski (14:31)
Yeah.

Alan Thornton (14:32)
So so you know it’s it’s it’s training it’s training first, inventory, evidence trail. Once you get those three bits in place, you have a really solid foundation. And there’s obviously

Without going into detail, ISO forty two thousand and one, which is the AI management system standard, that’s been around for a year now. And there’s a little bit of kind of a whisper through the grapevine that it will become the kind of required standard to meet in the enterprise for contracts in twenty twenty seven. So we’ll see if that comes to bear. But yeah, I suppose without without getting too into it, that’s let’s play around in a little bit

Denis Jastrzebski (15:06)
Yeah, yeah. No, but that that’s great. So that’s

like a possible link, like you said, it not not it’s not confirmed. but that’s a good thing to keep on on your radar and it’ll tie into what we’re going to be talking about next, which is kind of the next year, let’s say the next twelve months, what what can organizations do? but before we move into that, I I just wanted to kind of ask you so if you compare two organizations and one is let’s say an SME and and let’s say like a a smallish one, so like maybe five employees, including the owner.

maybe some of them are part time staff, maybe some full time, maybe there’s some contractors in there. Would that kind of an organization have a very kind of different requirement in in compliance under the Act as opposed to an organization with, you know, a hundred or two hundred employees, still based in Ireland, but but just obviously with a very different volume of of people, probably different departments and and boards of directors and so on.

So are the requirements very different or does it kind of just pretty much scale with the size of the organization?

Alan Thornton (16:02)
Yeah, so it’s actually not the the size of the organization doesn’t matter. So the regulation itself is about use cases. So it’s more so about the AI that you’re using and how you use it, what categories it falls into, and then the compliance requirements around those categories. So somebody using, as I said, you know, Gemini for marketing outputs in a small business, an FME or a large corporation, has the same compliance requirements.

placed upon them at all levels because it’s about that use case as opposed to the size of their organization. Now, what matters as organizations scale is the cost or the compliance burden around potentially getting yourself backdated to August 2nd and then also training the the relevant staff members or named individuals who would be responsible for AI deployments across an organization because a small business might have

you know, the CTO looking after something, whereas a larger enterprise with multiple locations operating in multiple jurisdictions that all trail into Europe, you know, they’re gonna have a much larger literacy kind of training compliance requirement. and that’s where costs come in. But in terms of the law and what you need to do around use cases, it’s the same no matter what size your business is.

Denis Jastrzebski (17:17)
Okay. That’s really good to know. So we kind of have those kind of main principles that govern the act. And no, it’s good it’s good to know that they they scale with the size of the organization. For the most part, obviously, like you said, costs differ, which which isn’t natural. but that that’s really good to know. And I suppose something that we’ve seen as well, that on that point of AI literacy, I think that’s a massive thing. And we’ve seen that this the the government have launched some AI literacy kind of basic courses and and kind of modules that you can do.

that are available. We’ll we’ll link those in the episode notes as well. but it is a big topic and the fact is even though AI is is there and statistically Ireland is is pretty good at adopting AI compared to maybe other EU countries as well. Obviously we’re smaller, but there’s been a massive push for it and and the the the numbers look pretty good. So with AI literature literacy being such a a big part of it we found that yes it’s it’s it’s things that people are interested in

People want to learn about how to use AI, but it’s moving so quickly, it’s kind of hard to keep up. people find it daunting to to, you know, be on a on a training course in August and in September or October, if they’re to train attend that same course, it’s probably changed quite a lot. So keeping up with all the news is quite difficult. and we see like lots of things on social media about it being able to replace, you know, your entire marketing department or it can

give you legal advice and all that stuff. Like we can see all the different pitfalls that those are probably not good things. So it’s kind of important from an AI literacy point of view is is to to probably do proper training. That’s an important part. So you know you can do some of those basic training courses with the government. We’ve designed and and ran a number of different programs around AI literacy and specifically one recently for HR personnel because really

If you’re kind of working on any internal AI policies to do with the act or kind of overall rollout, it’s usually people in the IT department, probably HR, sometimes marketing. So kind of people that know generally how how the AI Act might work a little bit more, they’re they’re kind of in tune with it. but the AI literacy applies to all employees, which is a really interesting thing. So it kind of at the same time encourages companies to adopt AI, but not with a a kind of

lax attitude, right? That they’re supposed to to train their employees so that they actually understand the benefits of the AI and and hopefully kinda have a good return on the investment they make into those AI processes. So I I found that really interesting and I like that about the EU AI Act that it it really focuses on each individual as well as opposed to just as an organization you have to tick these boxes. It actually makes everyone’s kind of life and and from an employment perspective, it helps everyone keep up

And encourages organizations to invest in into their staff, right? So that’s that’s a good thing. have you seen that as as a benefit through any of the organizations you’ve worked with? Or has it been something that’s been difficult from your experience that some companies are struggling to actually maybe even have the the capital to to run all these different training sessions or or resources or workshops for their staff? What what does that look like?

Alan Thornton (20:18)
Yeah.

So so I suppose to to just give the honest feedback from what I’ve seen over the last year and especially the last two months with with the deadline actually you know passing for transparency. the the literacy best effort training piece from article four, that’s just where it’s covered in the act, has actually been around since February twenty twenty five. So it has the same kind of enforcement

Deadline on it as the prohibited systems did. So a lot of people don’t know that the EU AI Act has been around since August 2024. They’ve just been kind of making tweaks to it and then pushing out when the enforcement deadlines would actually land. But the literacy piece is really important because it applies to any individual who uses AI or is responsible for deploying it inside your organization. So if there’s people who don’t use it, they don’t need literacy training. And when

organizations come to, you know, that question of training, they generally think it is a better idea to just blanket train everybody. So they are looking for that kind of solution to but within that then obviously your leadership team might need like a diploma standard of training around AI, whereas the receptionist doesn’t. They just need to know what the EU AI Act is and

basic kind of understanding of how models function from like a biased perspective so that you can understand when it might be giving a a negative output or something like that. So that can obviously be tracked and not pumped out to the public. And then how the EU AI Act and AI use cases, you know, kind of come together to support you know, fundamental rights of individuals. So that’s kind of the baseline level that everybody needs. And that’s easily achievable. There are resources.

Through the European Commission’s website and the AI office in Brussels. So people can access them there. They’re kind of low cost. But if you need more targeted or kind of intensive training for different department heads or leadership, you will probably need a specialized partner to deliver that training for you. But to be honest, what I’ve seen is people are building out their compliance framework around inventory evidence and being able to

you know, get that evidence out to anybody who requests it and kind of push in training to the sideline. And I don’t support that approach. the the literacy piece and the

Denis Jastrzebski (22:34)
And just in in this concept

in terms of in in this context, sorry, with inventory, what what does that refer to with in the act?

Alan Thornton (22:40)
Yeah, so that is building out the AI systems and use cases that you have. So understanding, you know, we use this HR tool, we use this finance AI tool, we use these two GP AIs. So having that inventory is specifically what they’re gonna be used for inside your organization, who’s responsible for them, and then having that evidence piece associated to it. So that’s what I mean by inventory.

Denis Jastrzebski (23:02)
Yeah, okay, that makes sense. Yeah. So that inventory piece is really just all the systems that you use and how you’re going to use them. so that that’s the terminology used in the act. Okay, so that’s really interesting to to know that. Okay, cool. So I suppose when we’re we’re talking about everything that’s that’s been the case, and like you said, it’s being phased in over time. So since twenty twenty four, a few phases have have come in. They all have certain requirements that organizations have to meet and they’re kind of kind of preparing you for the next phase.

and as we mentioned in the opening of the episode, one phase has come in this month. so between now and and the next phase, what are things looking like for the future? So what should kind of organizations be preparing for? is it going to be a pretty major phase or which which of the phases so far do you think have had the biggest potential requirements or kind of let’s call them reforms within the organization that were required after they’ve come in?

Alan Thornton (23:51)
Yeah, so the August second one that that that you highlighted, I know we speak about it a lot, but it’s it’s very relevant. what’s happening right now is is a big deal. So on August second, this is a a great piece of information and shout out to the CEO who supported me on this, you know who you are, I won’t name drops. But on August second I received a kind of panic LinkedIn DM from an SME CEO who

Previous to the weekends, didn’t see the email because it was a long weekend or whatever, but they had a request from a key account overseas in the European Union for transparency-related documentation around AI and what was happening inside their organization. because the deadline had passed and they were updating their kind of vendor supply piece to understand if they had risk exposure or what they need to track on their side. So this person was like, wow.

The deadline has passed. I didn’t know about it and I need a solution now. So that’s why it’s really, really important. That’s anybody who has been keeping up with it, if you’ve got something in place, fantastic. If you’re only hearing about it now, look into it next week. You know, go get on that as as soon as possible because it’s affecting businesses in the real world right now. And I suppose one of the big key pieces outside of obviously just being able to supply, you know, evidence around use cases and tracking, you know.

oversight and inventory or whatever is transparency putting labels on things that may require them, you know saying something is AI generated, supported by AI, whatever it may be. and then obviously you’ve got watermarking which on the digital side has it didn’t come into enforcement on August 2nd, it was pushed to December 2026. So there’s a bit of time there, five months for people to get the digital water marking in place. But then you can see large

GPAI models like Claude, for example, embedding the watermark into the text now. You can see Gemini puts a tiny little star on the corner of all its visual outputs. you can see Meta assigns an AI info piece to anything that goes out across their suite of platforms that was made on the meta AI. so you can’t really get away from this. There are obviously scrubbers as well, which is really funny. you

know, tools

Denis Jastrzebski (25:58)
Yeah.

Alan Thornton (25:59)
out there that are removing the watermarks. But

That’s that’s gonna be a short lived thing because after December, you know, twenty twenty six, you will need to have that in there. So scrubbing it is only an a massive risk to to what you do and and what your organization does. So yeah, so like everything I mentioned there is kind of key to to what’s happening at the back end of twenty twenty six and then I don’t know how much more you wanna talk about going into to twenty twenty seven and and twenty twenty eight.

Denis Jastrzebski (26:24)
Yeah, I think I think we’ll we’ll definitely cover more on on the future parts of it, but the watermark especially I found has has is one component of it that’s gotten a lot of online attention. So for anyone that hasn’t, you know, seen anything about what what we mean by watermark is whether it’s an image or whether it’s text that’s generated by any of the AI models, so whether you use you know ChatGPT or Gemini, Claude, Copilot with the new legislation.

there’s a watermark not only in images, like Alan mentioned in the bottom right corner, there might be a little icon. So with Google Gemini specifically, they put that in. Not all models do. there’s kind of other more technical mathematical ways that they can leave a watermark on an image. So if you’ve ever one wondered, like, you know, if you you’re on Facebook, maybe scrolling through things and you see an an image that’s very clearly AI and it has kind of a story attached to it. Facebook is a little bit notorious for that at the moment with people

I suppose using AI to to fabricate information. But if you’re in the space a little bit, you know, you you pick up on AI images pretty easily. But on on the top of of Meta or or Facebook images you’ll see there’s a little AI notch that Alan mentioned as well. So that’s saying this image was either created or modified using AI. So all those things you you can’t necessarily see with with with the naked eye let’s say we can tell it’s AI but at some stage in the future

The technology is going to get so good that it’ll be very, very difficult to tell whether an image or a video has AI. So the the legislation has has forced all tech companies really that are creating these models to put these watermarks and in ways that are going to be difficult to, like you said, scrub. and you know, the the legislation kind of comes in on August 2nd, and on August 3rd, we probably have a flurry of of different platforms that have just been launched to get rid of all these watermarks.

so we don’t know exactly how that’ll play out over the coming months. The companies themselves that are developing these models will have to to kind of keep up with with the requirements. So interestingly, like you mentioned with Claude, for example, they’ve announced early that they’re gonna be adding these watermarks into text. And you might think, well, how can you add a watermark into text? Or is it some embedded somewhere in the formatting? But no, it’s actually they have a pretty clever method.

That uses, I suppose, the the a few mathematical equations, whichever way they’ve developed the system where just by the way the text is is written, there are cues for these systems to know that that that it’s AI written. So a lot of people are not happy about that at the moment because a ton of companies use AI for marketing. and if suddenly everything is being flagged that this is written by AI, it can be pretty off-putting. But I’ve seen the kind of other side of too. I’m not sure if you’ve seen this, Alan, but I’ve seen people that

Are probably really good writers, and they are artists in a lot of cases, or maybe creative writers, and they write everything using their own brain, they’re they’re writing a story or they’re writing content. But oftentimes we use AI to proofread or maybe adjust our grammar. So if we have written something that’s, you know, let’s say 2,000 words long, a blog post or a newsletter, something like that, and we put that into AI.

To check it for any grammar mistakes and it picks up, you know, two little sentences that have to be adjusted, and you’re like, it didn’t catch those. You copy it from the platform, you upload that to LinkedIn or any social media platform, and suddenly that’s flagged that that’s AI written content or AI adjusted content. so there’s kind of a gap, I think, at the moment, between something that’s completely AI written or somebody that that used it for something as simple as checking spelling or grammar.

so I’ve seen kind of the the issues that have popped up on that, especially in in on social media. I’m not sure, has there been anything else like that that you’ve seen, Alan?

Alan Thornton (30:01)
What’s interesting in terms of where essentially, you know, an AI touches your content for, you know, split seconds, whether it’s, you know, to make very minute changes or or whatever it may be, especially to text. Like Anthropic’s approach is very interesting because it’s a kind of a blanket solution to you know, it just covers all bases, but it creates these problems like you’re saying, that if someone used it to tweak two sentences out of, you know, two thousand words, it’s not exactly, you know, an AI adjusted piece.

There are actually and I don’t know how the the main providers are gonna do this, but there are exemptions in the transparency piece of the act itself around putting labels on things, especially if a human had like final editorial control over the output and then they were listed as the the overseer on that inventory use case inside of your governance framework. So you can actually do that with with your AIs and make those tweaks and stuff and pump it out. Now obviously.

Claude are anthropic with their deployments of watermarks inside text are removing your ability to take the exemption basically i if you use their system at at the moment. So they’ll obviously tweak it. Like it is until December twenty twenty six. So whatever way it’s going to be managed will will change o over the coming kind of weeks and months. So whatever you see now, I wouldn’t be stressing out about it. It’ll be a a very good, strong solution from all

primary LLM providers as as to how they’re gonna manage this. But not only that, it’s it’s not really the AI, it’s not on them to put the watermarks in there. You know what I mean? There can be some instances where you do a lot of work and an image pops up and you need to put a transparency label on that from a kind of digital perspective, not just AI generated in the corner or

Denis Jastrzebski (31:41)
Yeah.

Alan Thornton (31:41)
whatever it may be. So in case people weren’t aware, there is standards that already exist, like C2PA for example, which is like a technical

blueprints that companies like Adobe, Microsoft, Intel, Twitter, you know, they kind of it embeds like digital nutrition labels, so to speak, into content. And that’s essentially how digital watermarks are gonna work. The Act kind of talks about C2PA as the standard, so I’d expect something like that to come along. And you can’t just rely on OpenAI, Anthropic, Google to be the people who put that into things for you. So that’s just something to be very aware of.

Denis Jastrzebski (32:18)
it’s a great point. So and I’m just gonna echo what you’re saying. We don’t have to really panic about old content suddenly having kind of a blanket approach. like you said, it is in development and in December that’s when things are are fully going to come into place. But obviously, if if suddenly all the AI companies did that, they’d probably lose quite a lot of of users and reputation. And I’ve seen people talking about moving just now because they’re panicked about this whole situation, moving to using

you know, Chinese LLMs and and running stuff locally, which is all, you know, interesting and good good for experimenting and testing things out, but it it in involves a lot of other risks that, you know, the EU AI AI Act is trying to kind of avoid and all sorts of other issues that can come along with that. So it’s it’s a really good point that you’ve made there. there is time right yeah.

Alan Thornton (33:02)
Well, like it just just just

to to add to that then is what what you mentioned there about people stepping away from the kind of recognized systems and then going to, you know, something from China or wherever it may be, whatever the outputs are from those use cases, you still have to log within your organization that you’ve moved to this system. And then if you deploy those outputs to the public, you still have to put the digital watermark on that. So whether Claude has done it for you or

Denis Jastrzebski (33:25)
Yeah, exactly.

Alan Thornton (33:26)
not, you still you still have to do it. So so

Everybody is like

Denis Jastrzebski (33:29)
That’s it.

Alan Thornton (33:30)
panicking in the quest to hide their AI use essentially because you may notice that you log on to YouTube now, I watch a couple of channels and they love telling me as soon as as as the video starts, all graphics made by humans, but nobody likes telling me that we used AI. you know?

Denis Jastrzebski (33:44)
Yeah.

Alan Thornton (33:45)
and I I don’t see the negative to it to be honest, because AI is a tool that is super powerful and if you are an organisation or an individual professional who uses it for your work

Put the labels on the things that need them, leave the labels off the things that are human supported, your brand will grow, your trust will grow, and people won’t penalize you for using the support of the most powerful tool that we’ve essentially ever experienced. So I I think that would be my message. you know, don’t be worried if people know you use AI.

Denis Jastrzebski (34:12)
No, that’s exactly it. and you make a fantastic point, really. Like even if you find ways to circumvent these watermarks like people are with these other platforms, you still as an organization, as a person, even if you’re like a sole trader running a business, you still have the same I suppose requirement under the act to to make sure that that watermark is there. So th the companies are actually

Alan Thornton (34:31)
Yeah.

Denis Jastrzebski (34:31)
doing you a favor. Sure, they haven’t fully perfected the whole process, but they’re doing you a favor to help you along with that. so by going around it, you’re actually potentially exposing yourself to more.

issues and and some of those fines that we’ll talk about right we don’t want to maybe focus on on the fines you can look those up but but the reality is that the AI Act is is in place now and these things whatever way you try to go around them it’ll still be applicable you’ll still at the end of the day be responsible for that. So I I like your point overall transparency is a huge part of the EU AI Act but I think as a business kind of as a ethical business practice

Transparency has always been a big thing. So like a lot of these components of the Act aren’t necessarily rocket science. They’re they’re pretty common sense and generally good business practice. You know, if you’re hiding stuff from your customers, whether it’s AI or if it’s anything else, you know, or we’re actually using on let’s say under GDPR, we’re using a tool that doesn’t have any sort of data protection agreements under it. And your data is being sent to servers outside of the EU that aren’t documented. We don’t actually know even what the servers are, like all those things.

they might be saving a couple of hundred thousand a year on using a platform that doesn’t have that compliance, but suddenly the fines that that can come into place or the issues that you might expose your customers or client data to will be just astronomical. so even if the fine is minimal it to to your profit, the the reputation and the trust is going to be just destroyed. So it’s the same thing here. Trying to circumvent all these things just doesn’t really make sense, does it?

Alan Thornton (35:59)
Yeah. Not perfect.

Denis Jastrzebski (36:00)
So yeah,

I I think that that that was really, really good. so to make it really easy and accessible for people to kind of figure out what they have to do with the act, if if we were to say to somebody today, you know, these are the the four steps or these are the five steps that you should take after listening to today today’s episode to to start working through getting compliant, you know, these are the the things you have to look at, start here. What would be your your kind of recommendations, your four or five steps broadly?

Alan Thornton (36:26)
Yeah, no problem. So I’ll run through the the points and brief explanations as to what I mean. So the four key key things that you can do that are straightforward enough is you know understand what you use, get that human oversight component in there, maintain your evidence and you know try and generate tool agnostic policies. So in the first instance, know what you use. Kind of we’ve been repeating it here today, you build a simple registry or inventory.

Of every AI tool deployed across your organization and how you use it. You know, the human oversight piece enforce you know an explicit rule. I can’t be clear on that, that humans make final calls on high-stek outputs or somebody is responsible for any sort of output that had GPAI or any sort of AI involved in it, whether it’s a graphic or a decision on somebody’s CV, for example, to move them to an interview stage. Get that locked in to your use cases.

Maintain that evidence, obviously retain logs, and vendor security statements and any training records that you have, so that you kind of you meet the other elements of of the act, that literacy piece, article four, you know, retaining logs, best practice would be tamper evidence. that’s article twelve. It relates a lot to high risk systems, but I believe it’s probably the level you should operate at to really stand over defensible kind of human oversight accountability. It’s essentially blockchain.

or cryptographic hatching, that’s how your logs should be managed. And then that tool agnostic policy, you know, write governance rules around data sensitivity and decision making, not just, you know, chat GPT, Gemini, HubSpot, you know, have a kind of tool

Denis Jastrzebski (37:58)
Mm. Yeah.

Alan Thornton (38:00)
agnostic piece focused on decision making and and data sensitivity would will point you in the right direction for sure.

Denis Jastrzebski (38:06)
Okay, great. So th those are really, really good steps. And if I’m just thinking about the logs that you had mentioned, you know, the kind of ultimate way of of tracking that or making sure that that’s not corrupted in any way and and is is a reliable kind of source of information, like you said, the blockchain technology being used as part of that. If I’m let’s say just a sole trader or a kind of a small business, maybe it’s just myself even working and doing maybe a little bit of consulting, or we’re even

do little bit of manufacturing and we use AI for a few things like you know we use ChatGPT to to draft some emails and maybe use it to to kind of create some social media captions and that. is a log does the log have to be something like really, really solid with security, like using blockchain technology, or could it be something that you actually manually keep track of as well? How would that work?

Alan Thornton (38:51)
So if if if you manually keep track of your logs, they are open to scrutiny, essentially. So you can always just go in and make edits or you can say, Well, this didn’t actually happen on, you know, August third, it happened on on July thirtieth, for example. So I I would be one hundred percent recommending that you try and find a solution for

defensible evidence that that stands up to any sort of claim because there are people who are having their insurance policies void at the moment by not being able to provide solid evidence and information around decision making, use cases, how things are going to happen in an organization going forward. There’s people as early as the back end of twenty twenty five, I worked with Irish companies who lost the ability to gain tenders in France.

Spain, Germany, because the the they are well ahead of the game, but they were basically saying if you can’t provide something that you can really stand over from from an evidence use case perspective, you know, we may look elsewhere. So a lot of people found solutions to continue working with those partners. But technically you don’t need to operate to that standard, but when somebody comes calling your records will be heavily scrutinized if you can’t just point to it and say, It’s locked.

you know, it’s lock and key here. I can stand over exactly what happens and there’s been no edits, no alters. This this is clean record of everything that happens. So I just think that that’s that similar to the ISO twenty seven or forty two thousand and one piece potentially coming through for larger enterprises next year. I would implore all operators, even solo entrepreneurs, to to go for that lock and key piece. ’cause it just secures the future of your business. and you just one less headache, you know.

You don’t have to worry about it if anybody

Denis Jastrzebski (40:32)
Mm. Yeah.

Alan Thornton (40:33)
ever asks it so.

Denis Jastrzebski (40:35)
Okay, cool. Yeah. So those logs are are really kind of an integral part of it. totally get your point then. There is a very specific reason why having them use something like blockchain technology or some platform that can actually do that for you, that makes your life potentially well a lot easier and and pain free if somebody starts to to have to to go through an audit of of your processes. So that’s a really important part. Okay. So if we kind of talk about all those things,

We we’ve we’ve covered a number of different areas, you know, kind of initially just talking about the act, the different phases that have come in, some some examples and kind of how organizations maybe are struggling to adopt it. so from from your perspective, I’m gonna ask you in a second if if somebody’s already looked after all these these things, let’s say they’ve been looking after or they’re responsible for looking after the AI Act implementation and making sure everything’s is compliant within the organization.

We want to kind of see is there any other things that they can do? Are there any resources that they can look at to help prepare for that next phase? what I want to touch on before we do that is for somebody that hasn’t really touched the AI Act yet, if you’re just kind of starting out, or maybe you’re in that process, maybe you haven’t or you’re not working with any kind of provider or consulting company that might be helping you with this and you’re trying to tackle it on your own, a really good starting point has actually been set up by the EU.

commission’s AI Act Service Desk. So they have a compliance checker, which you can actually see, you know, where you’re at maybe in that whole AI Act adoption phase. So you know what things do you have to look at, it’ll ask ask you a number of different questions and help you get an assessment. So at least you’ll know where you’re at. even if if everything we’ve talked about in this episode can has given you a few different ideas and questions and you know you’re not looking after particular areas.

This checker will be a good starting point. So we’re gonna have it linked in the show notes. So for that’s that’s for anyone that really hasn’t looked at it, or if even if you’re just curious about where your organization might be, even if somebody is looking after it, it’s a great place to get a good overview. But for for organizations that are already looking at that, they’re already preparing themselves or they’ve prepared themselves for the current phase, they’re compliant, and they’re looking at 2027 and onwards.

Do you have any kind of recommendations for tools or frameworks that that we could link as well for them?

Alan Thornton (42:45)
Yeah, for sure. So I I suppose if if you’ve got your compliance pretty much set for what’s currently happening, you’re going to just build on that. if you’ve got high risk systems into twenty twenty seven with with the enforcement deadlines for those guys being December twenty twenty seven under Annex three, HR tools, finance tools, insurance related stuff, things like that. And then there’s actually a deadline push to August twenty twenty eight for Annex one systems, which are

AI and toys, medical devices, vehicles, things like that. But one thing to I kinda mentioned, you know, scrutiny and really putting your your framework to the test and understanding how your governance strategy, you know, is set up and is it really working for you inside your organization. One place I would point individuals who who are currently operating that that compliance framework for organizations would be to the EU whistleblowing directive part of the EU’s Commission.

Commission site, there are two portals on there where individuals external to your organization can make a complaint or a request. And then there’s a portal where individuals inside your organization can make a complaint or a request. So that’s kind of two avenues where people can start putting pressure on what you’re doing as an organization. So it’s not only outside, someone complains, you’re clearly using AI and all your marketing, and you’re not putting any labels on it, you know, I’m gonna put a complaint in, or a competitor can complain.

from the outside through the portal and you might have regulators come in to talk to you. And then there’s internal, you know, well I work in the HR team and I haven’t got the literacy training that I need. And I can see our outputs, you know, are affecting the rights of some of the the people who come through our hiring process. So I’m gonna go to the portal and make a complaint that way. So once individuals who oversee the compliance framework and strategy piece inside of an organization understand how those portals function.

They can kind of reverse engineer that then to put the best policies and practices in place to protect the their own governance structure. And and I think that that’s really key and something good compliance officers should endeavour to do.

Denis Jastrzebski (44:45)
Fantastic. No, that’s that’s a great idea. and it’s probably not something most people would think about. You know, we think of it as the kind of first hand resources we can get, but put a bit more effort in reverse engineer what those portals are are pretty much letting people complain about. It’ll give you probably a good good overview of of where you want to be. so that’s that’s a great resource. Really appreciate that, Alan. so like we said, everything we talked about today, I’ve I found it a really fascinating conversation and we both work in this space.

You’re working with a a lot of international organizations as well. Alan, I know you’re looking at different AI laws and legislations outside of the EU as well. so you’re kind of able to to bring a pretty unique perspective to everything we’ve talked about because you see some of the overarching principles that probably cross over between the EU, some of the the laws that have come into the US or particular states and and in in Asia as well. So that there’s a lot of interesting stuff that you’re working on. I know you provide lots of resources around.

AI governance internationally. So what’s the best place to to kind of for for people to find you, to to keep up with what you’re doing, maybe get in touch? Where are the best places to do that?

Alan Thornton (45:47)
Yeah, no problem. So LinkedIn, you’ll get me. type in Alan Thornton, I will pop up. I am wearing a cap similar to this one in the profile picture. You can’t miss me. through that page, you will find my regulated newsletter, which talks about kind of how AI regulations affect individuals across regions. We talk about all jurisdictions in there, not only the EU AI Act. I then have an additional newsletter called the AI Compliance Walkthrough, which is essentially a kind of step-by-step piece.

that brings you through setting up a governance structure for your organisation and ai dash compliance dot app is the website where you can see kind of what we’re doing and how we’re supporting teams across currently six jurisdictions from Europe to Australia now.

Denis Jastrzebski (46:31)
Fantastic. Great stuff. So lots of stuff that you’re putting out there, lots of great value. We’ll make sure that in the show notes, if anyone is listening or watching, they’ll always be included with every single episode that we do. Alan’s information will be there along with all the stuff he’s working on and a specific newsletter as well that he’s releasing in kind of in in the same topic as what we’ve been talking about today with the new phase of the AI Act coming in. So Alan, it’s been really fantastic. I’ve had a great time just talking about all this stuff and we could probably

get into so much technical parts of it. so hopefully if everyone that’s listening, if you’re interested in hearing any particular parts or or to dive deeper into any particular parts of the EU AI Act, you’d like another episode with Alan, do let us know if there’s any particular topics that you’re interested in that you’d like us to talk about. I’m sure Alan would be would be delighted to to come on again. We can have a chat about those. so very very grateful for for you coming on today Alan.

it’s been a great episode and

Gonna rephrase that last part anyway. It’s been fantastic having you all on Alan. we’re really looking forward to hopefully a future episode and looking at all the resources. And for anyone else watching, thank you again for watching the episode for tuning in today. You’ll find us on all the major podcasting platforms and of course the show notes will have all the resources that we’ve mentioned today. Thanks everyone.