Legislation provides various important guardrails for the design of AI governance in the company. The AI Act and the EU Product Liability Directive, as well as the upcoming AI Liability Directive, are of central importance here. Other relevant legislation exists in areas such as data protection, intellectual property, employment law (for example, issues of co-determination and employee data protection) as well as corporate law and corporate governance. Sector-specific requirements, for example in the insurance, banking or healthcare industry, can also be of considerable importance.
While the legal requirements apply uniformly for all market participants, it is up to the company management to define guidelines for dealing with AI in accordance with the legal framework and to develop an AI strategy. AI governance is based upon such guidelines and will work towards implementing the company's AI strategy.
Another prerequisite for functioning AI governance is transparency regarding the use of AI in the company. To this end, existing AI projects and use cases within the company should be systematically recorded. The systems used and their deployment can be recorded in a company-wide AI register, which contains the essential information on the use of AI in the company, similar to the register of processing activities in accordance with Art. 30 GDPR.
Such AI register forms the basis for AI-related risk management. The risks arising from the use of AI must be identified, assessed and managed.