Watch on demand:
EU AI Act Webinar - Strategies to build compliant AI systems.

If you want to monitor compliance, you need to take into account both the technical part (security measures) and the organizational part. Using tools like AWS audit manager, Azure Purview Compliance Manager and GCP Compliance Manager you can go a long way for the technical part. The organisational part (like AI supervision or having up-to-date documentation) would be hard to monitor to use tooling and would require procedures mostly.

The EU AI Act is applicable to countries within the EU. So initially it is not applicable to UK companies operating in the UK. However: the scope of the EU AI Act includes AI systems on the EU market. So if you are a UK company operating within the EU market, for that scope, you need to comply with the EU AI Act. And there are some additions and special cases, for example when EU data is collected, processed by AI outside EU and used within EU (to prevent circumventing the AII Act in that way). 

There are many General Purpose AI systems on the market beyond ChatGPT. Google Gemini and Microsoft Copilot as some examples that you probably know. Taking ChatGPT as an example, OpenAI as developer of ChatGPT must ensure that the Provider requirements are implemented. If you are an integrator using ChatGPT, you need to apply the requirements applicable to your AI Act role. For example: if you are using ChatGPT as part of a high risk AI system you develop (e.g. screening CVs in an app you developed) you must implement the Provider requirements associated to high risk AI systems, including implementing a risk management system and having documentation in place for your AI system, but also making sure to transfer the ChatGPT context to your AI system.

There are similarities in the risk based approach, transparency requirements and ethical principles.  However, UK does not (yet) have a single, unified AI law or regulation, and is regulating AI through the existing supervisory bodies (like the Competition and Markets Authority or the Financial Conduct Authority). Overall, UK seems to be taking a more innovation driven direction, whilst EU AI Act focuses on protecting fundamental rights first and aims to create a level playing field for AI innovators.

Frankly we have no direct view on that. But considering the EU AI Act being strict but fair, it would not be a major barrier to keep or start service the EU market with AI services. Especially the bigger player you expect to have done their homework, and they should not have major difficulties showcasing EU AI Act compliance. But overall that would be a business decision balancing out EU market potential and EU AI Act compliance costs.

Bafain actually published principles for using Big Data and AI (BDAI) with major overlap to the EU AI Act regarding risk management, fairness, documentation and outsourcing for example. In addition. Gematik is more technically focuses and has similar goals as EU AI Act regarding (technical implementation of) information security.

We see that EU regulations (like DORA, NIS2 or AI Act) are all developing in a similar direction of being risk based and having similar requirements for higher risk context (for example security incident management and security incident reporting). We recommend taking data protection, your applicable legislation and business continuity as foundation. And it is important to make sure you align your internal policy making teams (like privacy, security, compliance, risk, outsourcing, architects) on the AI topic, to prevent them setting independent and potentially conflicting controls on the topic.

In the most situations, this is quite clear: if you develop an AI system (build it yourself) you are a Provider. And if you are using an AI system, you are a Deployer. And if you are developing and using an AI system, you have both roles. And if you integrate an existing AI system in a new service, like in question #3, you can also be both a Deployer and a Provider.

If we consider this specific example of CV screening, you should consider the AI system a high risk system. The Provider (developer) of the AI system must ensure that the AI system is trained in a fair way to prevent bias. And the Deployer (user) of the AI system must implement human supervision, to ensure that decisions based on AI system outcomes are made in a fair way. So it is a split responsibility. And you measure through checks performed by humans (and never have the AI system hold accountability).