The Commission's proposed Artificial Intelligence Act would make model documentation a legal duty for high-risk systems

2021-04-21EU Policy

Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts, COM(2021) 206 final, 2021/0106 (COD) (Brussels, 21 April 2021)

The European Commission published its proposal for a regulation on artificial intelligence under the ordinary legislative procedure. Article 3(1) defines an artificial intelligence system as software developed with one or more of the techniques listed in Annex I, which names machine learning approaches, logic- and knowledge-based approaches, and statistical approaches, that can for a given set of human-defined objectives generate outputs such as content, predictions, recommendations or decisions. The proposal prohibits a short list of practices, including manipulative subliminal techniques, general-purpose social scoring by public authorities and real-time remote biometric identification in public spaces for law enforcement subject to listed exceptions. It classifies a system as high-risk by its intended purpose, covering safety components of products already subject to third-party conformity assessment and stand-alone systems in the eight Annex III areas, from biometric identification and critical infrastructure to employment, law enforcement and the administration of justice. High-risk providers would carry obligations on risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and "accuracy, robustness and cybersecurity," with conformity assessment for stand-alone systems carried out as a general rule by the provider under its own responsibility. Annex IV specifies the documentation: the general logic of the system and of the algorithms, the system architecture, the training methodologies and techniques and the training data sets used, the validation and testing procedures, and the "metrics used to measure accuracy, robustness, cybersecurity."

What it changesThe Annex IV list is, almost item for item, the content a patent specification on a machine learning system needs to satisfy written description and enablement: architecture, training method, training data characteristics, validation procedure and performance metrics. An in-house program with products that would fall in Annex III should set up one engineering record that serves both the compliance file and the patent drafter, written as the system is built rather than reconstructed before filing. The documentation is intended for regulators and notified bodies, so anything in it that the company wants to patent should be filed before the file is handed over, and anything it wants to keep as a trade secret should be marked as confidential. The proposal is subject to amendment by the Parliament and the Council over a period of years, so the action now is building the record, not redesigning the portfolio. Tooling that produces the logs, oversight interfaces and data governance checks the proposal describes is itself a filing area for European applications.