Digital Europe Sandboxing The Ai Act - Final - Web - Spreads
Digital Europe Sandboxing The Ai Act - Final - Web - Spreads
Digital Europe Sandboxing The Ai Act - Final - Web - Spreads
THE AI ACT
Testing the AI Act proposal
with Europe’s future
unicorns
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
2 Testing the AI Act proposal with Testing the AI Act proposal with 3
Europe’s future unicorns Europe’s future unicorns
FOREWORD
understanding of risk categories. participants who contributed their
Further, liability exposure has created insights, as well as the dedicated teams
challenges and the cost of compliance involved in organising this sandboxing
remains a significant concern, but initiative. Together, we can shape a future
its full extent cannot be accurately where Europe’s digital landscape thrives,
determined at this stage. driving economic growth and societal
In our manifesto for the current legislative benefits while upholding the highest
term, A stronger digital Europe, we emphasised Another notable issue highlighted is
the lack of existing standards, and
standards of ethics and accountability.
the need for agile and mission-based policies. consequently uncertainty about what
formal harmonised standards will
We stressed the importance of clear policy ensure compliance. Participants also Cecilia Bonefeld-Dahl
show that achieving compliance will be
goals, agile policy-making processes, and a time-consuming process, which for
Director General
DIGITALEUROPE
FOREWORD 02
STUDY METHODOLOGY 05
EXECUTIVE SUMMARY 06
Study methodology
1. FAMILIARITY WITH THE AI ACT AND AI STANDARDS 09
2. COMPLIANCE IMPACT 15
3. BUSINESS IMPACT 21
ACKNOWLEDGMENTS 26 The findings in this report are based on in-depth The following topics were covered:
interviews conducted between 2 March and 20
ABOUT SAVANTA 27 April 2023 with 9 European start-ups and SMEs. Familiarity with the AI Act proposal
Familiarity with AI standards and the system
All companies were selected by DIGITALEUROPE of European harmonised standards
as nominees of the Future Unicorn Award, and Compliance impact
for being organisations that build and develop Business impact
artificial intelligence (AI). Participants were from 8 Implications of the proposed AI Act
European countries, mostly represented by CEOs. for organisations
The full list of participants is available on the The interviews were run by an experienced
acknowledgments page. Savanta moderator team, the discussion was
recorded and transcribed for analysis.
The aim of this project was to investigate
participants’ compliance and market strategies
with respect to the proposed AI Act, including its
impact on their business and the wider business
landscape more generally.
Note: T
he quantitative data presented in this report is not representative of the target population (tech sector in the EU) due to the limited size
TABLE OF
of sample (N=9), and should therefore be treated as indicative only.
CONTENTS
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
6 Testing the AI Act proposal with Testing the AI Act proposal with 7
Europe’s future unicorns Europe’s future unicorns
Executive summary
This report summarises the findings from a pre-regulatory sandbox with 9 European start-ups In light of these findings, we put forward six key recommendations to ensure the
and SMEs. upcoming AI Act and its regulatory sandboxes can create the right level of compliance
and competitiveness for European companies:
Participants in the sandbox have generally expressed cautious optimism about the need for AI
regulation. However, the sandbox has highlighted numerous areas where improvements and
further reflection are necessary in order for participants to be able to comply and measure the There should be no regulation without a plan for investment, or the EU risks
impact of the proposed AI Act on their business operations. falling behind.
Notably, our AI Act sandbox has highlighted that: The proposal needs more clarity on scope. This has only become more
important given late discussions on general-purpose systems, which
might bring more companies into scope than originally envisaged in the
Commission’s proposal.
2/3
A majority (two-thirds) The current lack of existing
12+
Half of participants expect
The existence of harmonised standards by the time the AI Act enters into
application will be key to provide companies with clarity as to their exact
obligations and implementation strategies.
of participants only have standards and resources compliance to take 6-12 months, There should be a focus on the international level to align on standards and
basic knowledge of the for many participants to get while others expect more than terminologies. For many participants the US market is key. The EU-US Trade
requirements and cannot involved in formal standardisation 12 months once all the aspects, and Technology Council is an excellent place to start.
fully understand their activities generates uncertainty including the applicable
market implications. Many as to the expected benefits that technical standards, are Gradual implementation and practical support will be key for SMEs. More
participants lament a lack harmonised standards will bring. finalised. funding and resources should come from the EU for compliance, including to
of clarity as to which risk make sandboxes easily accessible to a wide range of businesses.
category their product
falls into, the applicable The AI Act should allow for modifications down the line – there should be a
technical standards, and continuous sandboxing approach, focusing on adapting the text in the long
Participants expect compliance will be
their liability exposure. run based on practical experience rather than purely aimed at compliance.
unequally distributed across the EU,
The cost of compliance is
generating further discrepancies between
expected to be the main
Member States with strong governance and
driver of financial impact,
regulatory systems, such as Germany, the
but the full extent of this
Netherlands or Scandinavian countries, and
cost cannot at present be
the rest of Europe.
calculated.
When it comes to third countries, some participants expect the AI Act to give
them a competitive advantage compared to non-European providers, whilst
others think this won’t be the case. For them, implementation of the AI Act is
likely to make it more difficult to begin working with high-risk AI models in
Europe. These participants are particularly worried international investors will
shy away from funding high-risk European AI companies, and would consider
moving to other geographies where they currently operate in this scenario.
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
8 Testing the AI Act proposal with Testing the AI Act proposal with 9
Europe’s future unicorns Europe’s future unicorns
FAMILIARITY WITH
THE AI ACT AND
AI STANDARDS
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
10 Testing the AI Act proposal with Testing the AI Act proposal with 11
Europe’s future unicorns Europe’s future unicorns
1.1. F
amiliarity with the AI Act and its provisions for the development and 1.2. Initial perceptions about the AI Act
use of AI
A key aspect mentioned by many participants
A majority of participants interviewed have is that there is a lot of uncertainty and lack of
only basic knowledge about the proposed clarity, namely with respect to the definition of AI
AI Act. The majority – around two-thirds – sit and classification of risk:
between ‘unfamiliar’ and ‘somewhat familiar.’ There seems to be, to me, a lot of
Whilst they know the AI Act is being set out in The definition of AI is extensive and vague. uncertainty and unclarity about what is
time, they will have to work closely to ensure This is due to the AI Act being a general the right tool, and how we should proceed
compliance. They display a rough understanding regulation, and not case specific as other to, in the future, identify what is potentially
of the direction the AI Act is likely to take them in. instances. It is not clear how and to what high risk or low risk, and what actually AI in
However, there is more that needs to be done It’s people looking idealistically at extent different use cases can adapt to and the end is.
to ensure all businesses are fully aware of the outcomes and saying: “Somebody is comply with it.
potential impacts the final text may have on their responsible and we’re going to put a
operations once implemented. blanket legislation in place.” And they don’t Several participants are unclear on some of Martin Canter
actually know how they’re going to enforce the thresholds between the different levels of Omina Technologies
it or how it will impact onto industry or the
risk, and are unsure what this classification
economic impact of what they’re doing.
means for the variety of AI-fuelled products
they develop and use.
Nigel Toon
Graphcore Some participants stress the possible negative
impact of the AI Act on innovation within
the EU, which can be serious given that AI is
Few participants have a more detailed the technology the next industrial revolution
knowledge of the AI Act. They place themselves will be built upon. Given the current industry
somewhere between ‘very familiar’ and aggregation movement and concerns about
‘extremely familiar.’ This is driven by the nature monopolisation of AI, they feel that the EU is Europe is still very focused on
There is a need for further clarification. of their AI systems and by their own evaluation at risk of missing out on AI R&D, with the result regulations, and is not putting the
Legislation typically wants to be of their level of compliance with the proposal. of not being able to compete and becoming right investments into AI. This is very
sustainable through time, so a lot of completely dependent on other geopolitical concerning because we’re going to
A minority are already trying to design with
the discussions are about: “What is AI, continue to deepen the gap and be
the AI Act in mind to mitigate future disruption entities.
actually?” At this moment it seems like completely dependent on US technology
to their operations and clients. In contrast, the or Chinese technology in Europe.
a lot classifies as AI when you read the majority are waiting for the final legal text
AI Act. before assessing the full extent to which they will
have to comply and alter operations. There is a Daniela Braga
consensus that making changes too prematurely Defined.ai
Anna-Greta Tsahkna
Timbeter may result in duplication of efforts and costs.
In addition, some participants mention Participants appreciate the fact this horizontal
uncertainty around the enforcement of the rules, legislation will reduce fragmentation within
as well as about how they will be integrated individual Member States, setting a level playing
into current risk-management processes of field within Europe and avoiding uncertainty which
AI solutions under different EU legislations. In can be detrimental to business and investment.
addition, some participants operating globally
are worried that complying with the AI Act, in Generally, participants are supportive of sandbox
addition to other AI-related regulations, will exercises and think there is a clear need to use
pose a challenge when deploying technology them to ensure everyone interprets the AI Act in the
applications across various regions worldwide. same way.
Most participants do not use any standards research into all sources available to build internal
specifically for the development and use of AI. standards within their company.
They stress there is currently no comprehensive
The EU from the outside is often seen as a single market, but actually source to consult in relation to development and Four participants mention specific standards and/
we’re still looking at the 27 independent states often with very use of AI, at EU or international level. or information sources they use in relation to R&D
fragmented laws. It still is often the case that there are some bits and of AI such as the ALTAI assessment, the AI HLEG
pieces here and there that you have to consider when doing business This highlights challenges particularly for smaller ethics guidelines for trustworthy AI, standards for
locally. So, from our side, from a business that is operating globally, we companies due to lack of resources associated responsible AI issued by specific countries, private
do appreciate first and foremost less fragmentation. Having as uniform with building internal standards or certifications. companies or local regulatory authorities. In
a rule as possible is good. addition, compliance with specific ISO standards
Many mention there are a plethora of guidelines around information security is mentioned by a few
Aleksander Tsuiman and practices, and those interested need to do participants.
Veriff
1.4. F
amiliarity with the system of harmonised standards and their
application to the use of AI
The majority of participants interviewed Those who are aware of harmonised standards
are unfamiliar with the system of European are either heavily involved in this sector, e.g. by
harmonised standards and how it applies to being part of specific industry committees or
the use of AI. interest/working groups who share knowledge on
standards, or have a solid understanding of the
legislative acts thanks to their background in law
or regulation.
1.5. F
amiliarity with the system of harmonised standards and their
application to the use of AI
Participants display interest in taking part in on standards, and lower capacity to influence
European standards organisations to develop this area as opposed to larger companies. There
harmonised standards for AI. However, most is work to be done to ensure participation is
participants have no or little experience of user-friendly and open to all.
industry committees or interest/working groups
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
14 Testing the AI Act proposal with Testing the AI Act proposal with 15
Europe’s future unicorns Europe’s future unicorns
COMPLIANCE
IMPACT
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
16 Testing the AI Act proposal with Testing the AI Act proposal with 17
Europe’s future unicorns Europe’s future unicorns
2.1. R
eadiness to comply with the AI Act
The sandbox was not able to provide definitive However, views on compliance depend on the
answers as to whether participants are ready perceived level of risk companies think they would
to conform with the AI Act requirements, given fit into. Those who consider their AI solutions to be
that the text is still not finalised. As mentioned minimal or limited risk have no particular fears
previously, the proposal is considered vague in regards to compliance, whilst those probably
and uncertain by some participants. It will take classified as high risk are particularly nervous
some time to translate the requirements of the about this subject. One participant had to reassess
final AI Act into specific actions and understand its previous opinion that its AI solutions would not
what processes, tools and solutions need to be classify as high risk.
implemented.
Two participants pointed out that whilst AI solutions
Some areas related to compliance that lack can be designed to keep human oversight to
clarity are: be able to intervene, the unpredictability of AI
systems will probably lead to unexpected results
Who is responsible to be compliant with what and/or errors. This particular rule combined with
and to what extent? Namely what response is regulatory uncertainty and the risk of not being
expected from companies with different roles, compliant might lead to a delay in AI innovation
e.g. platform supplier vs. platform builder, and projects in Europe. One suggests it would be more
whether there will be joint responsibilities in the suitable to focus on the companies being able to
AI creation process. explain the results of AI models.
Where liability lies.
What specific requirements regarding societal
and environmental impact? The current
requirements are are seen as vague and in part
driven by how customers deploy AI solutions.
How to measure bias and what data quality
requirements are.
2.3. Cost expectations for compliance with the AI Act and relevant
standards
2.4. T ime required for compliance with legal requirements of the AI Act
The timeframe needed to ensure compliance exact legal requirements and finalised technical
with the AI Act’s legal requirements is difficult standards will be. Nevertheless, some expect the
to assess as it is not clear exactly what the time needed to be at least 12 months by the time
requirements in the final text will be and what they will have put in place all of the changes and
they will entail. As seen above, most businesses support that might be required.
only have a basic understanding of what is
included in the AI Act, and there is a lack of clarity Companies hope there to be a lead time before
about key points. The expected timeframe also the AI Act becomes fully enforced to reflect the
changes based on the perceived risk category. requirements in algorithm-building processes
and future developments.
Half of participants expect to be compliant
within 6 and 12 months, depending on what the
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
20 Testing the AI Act proposal with Testing the AI Act proposal with 21
Europe’s future unicorns Europe’s future unicorns
BUSINESS
IMPACT
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
22 Testing the AI Act proposal with Testing the AI Act proposal with 23
Europe’s future unicorns Europe’s future unicorns
The financial impact of the AI Act on the Will the AI Act be pro-business and does it address actually the
concerns that are also there in other jurisdictions? Usually companies,
participants remains unclear. Cost of compliance
at least tech companies, want to think globally, so I think that having
is expected to be the main driver of financial
the AI Act as competitive as possible is essential.
impact, with some indirect costs potentially
affecting supply chains and overall market
distribution expected as well. Aleksander Tsuiman
Veriff
Participants anticipate different outcomes
depending on their company’s nature, perceived
level of risk, sub-sector and products, among Implementation of the AI Act is likely to make it more
other factors. For example, participants who difficult to begin working with high-risk AI models in
believe they will unlikely be classified as high risk Europe due to increased complexity and barriers.
view the AI Act as a necessary cost that may This could negatively affect new start-ups that may
even present business opportunities in the future. have otherwise established themselves in Europe,
They expect the AI Act to present a competitive as they may choose to relocate their operations
advantage when entering into international I think for companies who don’t do it, and elsewhere. If the AI Act makes the EU a less
markets. On the other hand, high-risk companies who have no skills, these kind of things tend attractive destination for high-risk AI start-ups or
foresee substantial costs that could hinder their to come as a last minute surprise, then you innovation hubs, it may put investors off as a result.
innovation potential. have more issues to worry about. If you
start early, and you have capabilities, I The decision to move away might not come from
think, then you are ready when the market companies themselves, but from their investors
What is common to all participants is the desire
is ready. as a reaction to general uncertainty around the
for the financial impact to be minimal. However,
many have said that until the text is finalised and Act and its implications for specific profiles of
operationalised, it is difficult to determine the companies – namely, high-risk. For companies I’ve had some conversations with investors
Antti Koskela
exact costs they would face. There is a view that with some operations in other geographies, those that are worried about the dampening
WithSecure
being more prepared at an early point will allow are the natural place they would relocate to in a of AI innovation on the European market,
businesses to manage any costs. However, the worst-case scenario. And whilst moving operations so investors are pushing us to focus first
majority will wait for the final legal text before to other markets is not an option for many, some and foremost on the US market. This is
say it is something they have been considering. also probably what we will do, we will not
starting full-blown compliance, which may
abandon the European market 100%, but I
otherwise result in duplication of efforts and costs
Nevertheless, the AI Act wouldn’t make well- would probably have the US market higher
if done too early. on my list than, let’s say, the Italian market
established, low or no-risk organisations move
or the Spanish market.
away as they are committed to the EU and would
still be subject to compliance with EU regulations
3.2. Impact of the AI Act on international competitiveness if they were to keep a presence in the bloc.
Jonas Andrulis
Moving business operations elsewhere isn’t seen AlephAlpha
as a practical move. However, a few companies
Whilst many participants agree that compliance pace with the rest of the EU. This is an important
would consider doing so if complying with the
with the AI Act could give European companies consideration for maintaining a competitive
AI Act negatively impacted their accuracy or
a competitive advantage, some mention this landscape across the bloc.
competitiveness, and if moving abroad provided
might be unequally distributed across the EU.
greater freedom to innovate thanks to a different
Some countries, particularly those with strong Compliance with the AI Act can also help when
regulatory landscape.
governance and regulatory systems, such as looking at business opportunities outside of the EU,
Germany, the Netherlands or Scandinavian especially if the EU becomes a role model for other
countries, tend to have stronger standards on countries.
privacy or transparency. Therefore, benefits
compared to other countries when it comes to When comparisons are drawn with specific global
the implementation of the Act will be felt there. markets such as the US, opinions are divided.
Some say compliance with the AI Act will give extra
One participant stressed the importance for points to European providers, whilst others think
smaller companies with limited resources and third countries will not take compliance with the AI
companies located in less well-prepared countries Act into account in their decision-making.
to have access to funding to ensure they can keep
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
24 Testing the AI Act proposal with Testing the AI Act proposal with 25
Europe’s future unicorns Europe’s future unicorns
Overall, there is an agreement that regulation Some participants voiced concerns about potential
is necessary to establish trust, ethical use and negative impacts of the AI Act on European
responsibility in AI development, and that the companies’ innovation and reputation, as well as
AI Act will be beneficial in achieving this. It may negative impact on the general investment climate
force companies to optimise, adopt a better if regulations are perceived as holding back
roadmap and strategy on the AI route. On progress.
the other hand, some participants think it will
increase the cost of accessibility on most projects, According to some participants, current
making it more expensive for companies to meet uncertainty surrounding the text (both the
requirements and targets. classification of companies and how the rules will
be implemented) will likely decrease investment
There is an expectation that standardisation will levels in the short term until regulations become
be a key benefit of the AI Act, making it easier clear, and whether investment levels will recover or
for investors to understand what constitutes AI remain subdued will depend on how manageable
and invest accordingly. However, the current the requirements outlined in the final Act are and
lack of existing standards and resources for how much they are perceived to stifle innovation.
many participants to get involved in formal
standardisation activities continues to generate Many participants agree that even though
uncertainty as to the expected benefits that interventions and regulations are necessary, there
harmonised standards will bring. needs to be more careful consideration given to
their implementation.
I’m pretty sure in the coming years, there will be a vast amount of AI
start-ups popping up, especially thanks to ChatGPT. And the investor
side usually does not go very deep into the tech. If we have any kind
of standardisation or compliance of that regard that they’re doing
something that is actually AI and working AI models and whatnot then
I’m pretty sure it would be positive.
Martin Kambla
Timbeter
Overall, participants find that the AI Act may This will be likely true not only for companies
improve reputation and overall customer classified as high risk, but also for those seen as
perceptions. For participants that support other minimal or limited risk, and as such it could lead to
businesses in being compliant, being ahead of the a sector-wide change.
curve will ensure a competitive edge is maintained.
The main angle of concern is driven by the risks of
According to many participants, the AI Act will non-compliance. There is little understanding at
impact positively on the reputation of vendors this point of the full extent of not being compliant.
and is expected to create the need for trustworthy Businesses need to ensure they do not cause
AI solutions, even for low-risk AI applications. themselves reputational damage due to this.
Businesses are expected to prefer service providers
that can provide an assurance label indicating that
their AI systems perform effectively and that any
potential risks have been reduced or eliminated.
SANDBOXING THE AI ACT SANDBOXING THE AI ACT
26 Testing the AI Act proposal with Testing the AI Act proposal with 27
Europe’s future unicorns Europe’s future unicorns
Stassy Carr
Graduate Executive
[email protected]
DIGITALEUROPE represents the voice of digitally transforming industries in Europe.
We stand for a regulatory environment that enables businesses to grow and citizens to
prosper from the use of digital technologies.
We wish Europe to develop, attract and sustain the world’s best digital talents and
technology companies.
DIGITALEUROPE's membership represents over 45,000 businesses who operate and invest
in Europe. It includes 100 corporations which are global leaders in their field of activity, as
well as 41 national trade associations from across Europe.
www.digitaleurope.org
@DIGITALEUROPE
@DIGITALEUROPE
@DIGITALEUROPEvideo
DIGITALEUROPE
Rue de la Science, 14
B-1040 Brussels
[email protected]
+32 2 609 53 10