Jonathan Armstrong, Partner in our Compliance Department, recently contributed an article to The European Financial Review, a trusted source for essential market insights and strategies, discussing the EU Artificial Intelligence Act. We are pleased to share the full text of the article below.
By Jonathan Armstrong
The new EU AI Act entered into force on 1 August 2024, though there is a staggered compliance timetable, and it will not be fully applicable until August 2027.
But what significance will it have for finance companies and what do they need to do to prepare?
The financial services sector is one of the areas most impacted by AI. The industry’s heavy use of data-driven models and algorithms offers rich opportunities for AI processes and systems.
A survey published by the Bank of England in 2022 isaid that over 72% of respondent firms were using or developing machine learning applications, and that trend is expected to increase. In addition, AI applications are becoming increasingly embedded in day-to-day operations and becoming more critical to various business areas in the UK financial services sector.
The EU AI Act categorises AI risk, with prohibited AI systems and high-risk AI systems at the top of the risk pyramid. The Act specifically lists as high-risk two types of AI systems of relevance to financial institutions: systems used to evaluate creditworthiness of natural persons, and systems for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Financial institutions should also be aware that the Act’s obligations fall not only on providers or developers of AI systems, but also organisations that use them, for functions such as customer service chat bots or robo-investment advisors.
Building a bespoke Action Plan will be essential. Key action points must also include training employees, raising awareness, and briefing boards on AI risks and opportunities.
Training board members will be especially important, as many current boards don’t have people with adequate AI and technology skills or knowledge. This gap needs to be addressed to properly understand the risks, and of course, opting out of AI is not an option.
Financial institutions are already heavily regulated and are expected to have robust compliance models and procedures in place, with adequate resources to meet their regulatory obligations. As such, many organisations can use existing regulatory change frameworks and governance structures to help implement the Act.
Firms will also need to take inventory of their current AI systems to identify the AI systems being used and their risk level. Keep in mind that the two types of AI systems above aren’t the only high-risk systems relevant to financial institutions. For example, AI systems intended for filtering job applications, evaluating candidates, monitoring performance, and decision making for promotions and terminations are also high-risk.
Another key concern for finance companies will be the integration between their work on implementing their AI Act obligations with their DORA (Digital Operational Resilience Act) obligations. There’s an opportunity here for efficiency as some of this work can be done in parallel. DORA seeks to address cyber and ICT related risks in financial services firms and is planned to be fully applicable in January 2025.
Naturally, as AI systems are becoming increasingly critical in an institution’s operations, so will their dependence on third party ICT service providers. In a similar vein, financial institutions should also keep in mind the MiFID II obligations on governance, knowledge and competence, conduct of business, transparency, and most importantly the overarching imperative to act in the best interests of the client.
It would also be wrong to regard this as simply an EU-focused activity. The EU AI Act has extra-territorial effect and there are equivalent rules to DORA coming in in the UK too. And we know that the new UK Government plans its own AI regulation.
There are still a number of areas of uncertainty and confusion. The EU AI Act will likely suffer from some of the same issues as GDPR. There are likely to be regulators learning their way around their new powers, patchy enforcement, and struggles to keep up with innovation both in and out of the tech industry. As we’ve said, financial services is already a significantly regulated industry, and this begs the question: will increasing its regulatory obligations discourage innovation in financial institutions?
However, like the GDPR, the EU AI Act has also raised the profile of and changed the thinking around AI on a global scale, particularly in relation to the fundamental rights of natural persons. Already one big tech company has said they won’t bring some new products to market in the EU as they seek to understand the complexities the new legislation may bring.
Finally, institutions may also want to keep an eye on the European Commission’s target consultation on AI in the financial sector, which will close on 13 September 2024.
Every organisation needs a plan to respond to the Act. They will need to start with training and awareness, since many of the AI systems being bought-in or developed now will still be in use when enforcement starts. Most financial institutions are likely to be already using or planning to use AI systems, and they need to establish the risk level of those systems and perform their initial analysis. Whilst enforcement will not start until next year the time to start a compliance program is now.
Partner
Jonathan is an experienced lawyer based in London with a concentration on compliance & technology. He is also a Professor at Fordham Law School teaching a new post-graduate course on international compliance.
Jonathan’s professional practice includes advising multinational companies on risk and compliance across Europe. Jonathan gives legal and compliance advice to household name corporations on:
Jonathan has handled legal matters in more than 60 countries covering a wide range of compliance issues. He made one of the first GDPR data breach reports on behalf of a lawyer who had compromised sensitive personal data and he has been particularly active in advising clients on their response to GDPR. He has conducted a wide range of investigations of various shapes and sizes (some as a result of whistleblowers), worked on data breaches (including major ransomware attacks), a request to appear before a UK Parliamentary enquiry, UK Bribery Act 2010, slavery, ESG & supply chain issues, helped businesses move sales online or enter new markets and managed ethics & compliance code implementation. Clients include Fortune 250 organisations & household names in manufacturing, technology, healthcare, luxury goods, automotive, construction & financial services. Jonathan is also regarded as an acknowledged expert in AI and he currently serves on the New York State Bar Association’s AI Task Force looking at the impact of AI on law and regulation. Jonathan also sits on the Law Society AI Group.
Jonathan is a co-author of LexisNexis’ definitive work on technology law, “Managing Risk: Technology & Communications”. He is a frequent broadcaster for the BBC and appeared on BBC News 24 as the studio guest on the Walport Review. He is also a regular contributor to the Everything Compliance & Life with GDPR podcasts. In addition to being a lawyer, Jonathan is a Fellow of The Chartered Institute of Marketing. He has spoken at conferences in the US, Japan, Canada, China, Brazil, Singapore, Vietnam, Mexico, the Middle East & across Europe.
Jonathan qualified as a lawyer in the UK in 1991 and has focused on technology and risk and governance matters for more than 25 years. He is regarded as a leading expert in compliance matters. Jonathan has been selected as one of the Thomson Reuters stand-out lawyers for 2024 – an honour bestowed on him every year since the survey began. In April 2017 Thomson Reuters listed Jonathan as the 6th most influential figure in risk, compliance and fintech in the UK. In 2016 Jonathan was ranked as the 14th most influential figure in data security worldwide by Onalytica. In 2019 Jonathan was the recipient of a Security Serious Unsung Heroes Award for his work in Information Security. Jonathan is listed as a Super Lawyer and has been listed in Legal Experts from 2002 to date.
Jonathan is the former trustee of a children’s music charity and the longstanding Co-Chair of the New York State Bar Association’s Rapid Response Taskforce which has led the response to world events in a number of countries including Afghanistan, France, Pakistan, Poland & Ukraine.
Some of Jonathan’s recent projects (including projects he worked on prior to joining Punter Southall) are:
This article was first published in The European Financial Review on 6th October 2024. You can view the original article at The European Financial Review: What are the Implications of the EU AI Act?
Everything Compliance: Jonathan Armstrong on the impact President Trump might have on compliance in Europe
In this episode of the Everything Compliance podcast, Jonathan Armstrong takes a look at what the election of President Trump might mean for compliance across Europe. He focuses on a...
2 Min Read
Read More Everything Compliance: Jonathan Armstrong on the impact President Trump might have on compliance in EuropeUK Home Office Guidance: Failure to Prevent Fraud
The much-anticipated guidance regarding the new UK corporate offence of Failure to Prevent Fraud (FTPF Offence) was published on 6 November 2024. This FTPF Offence is part of the Economic...
6 Min Read
Read More UK Home Office Guidance: Failure to Prevent FraudILTA Voices: Jonathan Armstrong discusses DORA
Jonathan Armstrong of Punter Southall Law joined Leigh Zidwick, Sr Director Info Governance, DLA Piper LLP (US) to discuss DORA. The conversation was facilitated by ILTA Voices, a podcast series by...
2 Min Read
Read More ILTA Voices: Jonathan Armstrong discusses DORA
