AI Compliance in Companies (Part I) – Why and How Should Employees Be Trained?

The use of AI in companies has the potential to save costs and increase sales through automation. At least, that is what many companies are currently hoping for from the new hype surrounding deep learning and generative AI that has emerged in recent years, triggered by the success of ChatGPT. Developments in this area have been progressing rapidly ever since, with large US and Chinese tech companies in particular seeming to be engaged in a fierce competition to outdo each other on an almost weekly basis. In doing so, they are improving their models with new features, greater accuracy, and increased efficiency, for example. In addition to the major players, a wide range of other service providers and specialized tools for various areas of application have already established themselves. This rapid development makes it difficult to keep track of which solution might be suitable for your own company. Companies must first ask themselves what AI can actually do and where its technical limits lie. Then they need to clarify whether and how AI can be used profitably. Key decisions concern whether the project should be implemented in-house or outsourced. Should AI be developed or adapted in-house (fine-tuning), or should third-party applications be used, such as “AI as a Service” (AIaaS)? Should data be processed on your own servers, or is a cloud solution preferred? A strategic approach and sufficient AI expertise are essential to answer all these questions. Management is responsible for setting the course for the success of AI projects. This includes ensuring that employees have the necessary expertise in dealing with AI systems. The employees involved must therefore be trained accordingly. However, this is no longer just a business necessity, but also a direct result of legal requirements. The EU AI Act refers to AI literacy in this context. But what exactly does AI literacy mean, and how far do the legal training requirements extend?

Requirement for AI Literacy

The AI Act defines AI literacy as the skills, knowledge, and understanding that enable providers, operators, and affected parties, taking into account their respective rights and obligations under this Regulation, to use AI systems competently and to be aware of the opportunities, risks, and potential harm that AI can cause. According to Article 4 of the AI Act, providers and operators of AI systems are required to take measures to ensure, to the best of their ability, that their personnel and other persons involved in the operation and use of AI systems on their behalf have a sufficient level of AI literacy. The technical knowledge, experience, education, and training of employees must be taken into account, as well as the specific context in which the AI systems are to be used and the target groups for which the systems are intended. Unlike most other obligations under the AI Act, the training obligation applies regardless of how the underlying AI systems are classified in the various risk categories of the regulation. Companies are therefore obliged to ensure that their employees have a sufficient level of AI literacy. The obligation to ensure AI literacy must be fulfilled to the best of the company’s ability, in an individualized and context-specific manner. In concrete terms, this means that companies must tailor training to the technical knowledge, experience, and educational level of their employees. At the same time, the specific context in which the AI systems are used must be taken into account. However, it remains unclear how these requirements are to be implemented in individual cases. There is currently no simple set of rules or checklist that companies can use in this context. Instead, companies must develop their own appropriate measures and training concepts to meet the requirements of the regulation.

Who Requires Training and What Are the Benefits of an AI Officer?

There is currently no established best practice for ensuring AI literacy. To counteract this and promote exchange between companies, the European AI Office has published the Living Repository of AI Literacy Practices, which presents the practices implemented by participating companies to promote AI literacy. This can provide valuable information for your own implementation. Based on this, the following steps are necessary: determining the target group and analyzing needs, considering the application context, selecting and implementing training approaches, measuring and evaluating the impact (KPIs), and dealing with challenges and continuous improvement. The first step should therefore be to lay the foundations, which includes formulating AI guidelines and, building on these, guidelines for employees on how to deal with AI. Governance structures should be established for this purpose. One possible measure could be the introduction of an AI function (AI officer) to manage skills development. When it comes to training, it makes sense to distinguish between basic training for all employees and target group-oriented training for specific areas of responsibility. The basic training can provide all employees with a fundamental understanding of how AI systems work and the ethical and legal challenges they pose. In more advanced, subject-specific training courses, the knowledge required for the respective area of responsibility can be imparted and the basic knowledge deepened. Depending on requirements, the topics to be covered could include the following in particular: General basics on AI, technical fundamentals, areas of application and limitations, security and risk management, legal framework and compliance requirements (especially AI Regulation and GDPR), as well as ethical and social aspects. The training process should be standardized to ensure a consistent level of competence throughout the company. The training should be documented and reviewed for effectiveness. Training can also be provided by external service providers. However, management should ensure that the training covers content relevant to the company’s own situation.

Attorney Anton Schröder

I.  https://fin-law.de

E. info@fin-law.de