# data[].attributes.headline
DPO Session #26 – Main legal compliance questions for companies using AI, a discussion with Peter Craddock, Partner @ Keller & Heckman

# data[].attributes.subject
DPO Session #26 – Main legal compliance questions for companies using AI, a discussion with Peter Craddock, Partner @ Keller & Heckman

# data[].attributes.attachment_link.readable_text
The looming AI governance legal framework in the EU has certainly been newsworthy. However, while preparing for the new compliance requirements, it feels like some of the current legal obligations (such as data protection, for example) have lost their shine in comparison to the expected regulatory developments. At the same time, there might be a misplaced optimism about the possibility of legal consultants, in-house DPOs or other company compliance functions to tackle and implement the entire range of the EU AI Act provisions.

AI governance should not be assimilated with data protection, and, at the same time, data protection should not be missing from an AI governance program. Confused already? We think it is important to know the limitations that we, as lawyers and privacy managers, will have when advising on the development and acquisition of AI systems, but at the same time to start supplementing our knowledge base.

For this edition of the DPO Sessions, we will talk with Peter Craddock about the main steps companies should take to prepare for the AI Act, whilst not forgetting about the current legal obligations to protect privacy and personal data.

# data[].attributes.attachment_link.title
DPO Session #26 - Main legal compliance questions for companies using AI, a discussion with Peter Craddock, Partner @ Keller & Heckman

# data[].attributes.attachment_link.description
We will talk with Peter Craddock about the main steps companies should take to prepare for the AI Act, whilst not forgetting about the current legal obligations to protect privacy and personal data.

# data[].attributes.attachment_caption
Peter Craddock - Data/Cyber/Tech Law; helping you innovate & use data better (EU & international)

# data[].attributes.headline
Op-Ed: If AI replaces work for junior lawyers, what happens next? 

# data[].attributes.subject
Op-Ed: If AI replaces work for junior lawyers, what happens next? 

# data[].attributes.body
Your AI GPS, providing direction, structure, and a bird's-eye view on all things AI regulation, tech & society

# data[].attributes.attachment_link.title
RegInt: Decoding AI Regulation | LinkedIn

# data[].attributes.attachment_link.description
RegInt: Decoding AI Regulation | 579 followers on LinkedIn. Your AI GPS, providing direction, structure, and a bird's-eye view on all things AI regulation, tech & society | When you are stuck in a current - don't fight it; get to the bottom and swim to the other side. Same with AI - to help you get to the bottom and swim across we have we've crafted a series of episodes - think of them as your AI GPS, providing direction, structure, and a bird's-eye view on all things AI. Tea - an IP and privacy specialist and AI enthusiast – and Peter – a tech and privacy specialist and less enthusiastic – will serve up fresh, offbeat takes on the latest buzzwords and hot topics, all while keeping our feet firmly planted in the realm of the factual.

# data[].attributes.headline
Debunking the EU AI Act: an overview of the new legal framework

# data[].attributes.subject
Debunking the EU AI Act: an overview of the new legal framework

# data[].attributes.body
Fieldfisher Data & Privacy Team

# data[].attributes.attachment_link.title
Debunking the EU AI Act: an overview of the new legal framework

# data[].attributes.headline
Part 1: Product compliance for consumer products powered by AI

# data[].attributes.subject
Part 1: Product compliance for consumer products powered by AI

# data[].attributes.attachment_link.readable_text
Understanding upcoming requirements in the EU and their impact on businesses

In today's consumer-driven world, ensuring the safety and reliability of products is paramount. Hence, product safety and compliance are critical issues that every company involved in the supply chain should be aware of. This is even more true when it comes to products powered by artificial intelligence ("AI"), which pose new risks due to their interconnectivity, self-learning capabilities and increased exposure to cybersecurity vulnerabilities.

While the AI Act (a product safety law for specific AI systems), is currently attracting a lot of attention, the General Product Safety Regulation (GPSR) should not be overlooked. It is another at least partially AI-specific product safety law in the EU, which was adopted in June 2023 to adequately address AI-related product risks. Whereas the AI Act is entirely AI-specific, the revisions to the general product safety legislation aim to - amongst others - address the integration of AI technology into existing product safety frameworks and introduce AI-specific requirements. Similar to the AI Act, the new legislation is a portion of the so-called AI Package as part of the EU's approach to regulating AI (details here).

As AI technologies become increasingly prevalent in various industries, particularly consumer products, this article aims to provide an overview of the key regulatory changes resulting from the new GPSR and how they specifically impact consumer products powered by AI ("AI-powered consumer products"). Even with regard to the revised or new requirements of the GPSR that are not exclusively AI-specific, the GPSR may still have significant implications for AI-powered consumer products. Therefore, whereas Part 1 of this article deals with the AI-specific requirements of the GPSR, Part 2 provides an overview of the new requirements that, whilst not exclusively AI-specific, may still have a significant impact on AI-powered consumer products.

Background to the revisions

The need to update current product safety rules is driven by several critical factors, in particular the emergence of new technologies and the evolving nature of AI-powered consumer products. Rapid technological advances have led to the creation of innovative consumer products such as health and fitness trackers, service robots and smart home systems, which often use AI to enhance their functionality. AI, whether predictive or generative AI, may improve product performance, personalisation and automation but it also presents unique safety challenges.

For example, an AI-powered vacuum cleaner could fail to accurately detect obstacles due to overfitting, and AI-powered healthcare devices could make incorrect diagnoses or treatment recommendations due to incomplete training data, potentially putting people's health at risk. Existing product safety regulations were inadequate to address these unique risks, and an updated regulatory framework was needed to better protect consumers using these new technologies. While the GPSR introduces specific modifications to the existing framework to en-sure the safety and accountability of AI-powered consumer products, it also continues to apply to products without AI functionality. Therefore, even if only some of the changes are AI-specific, they all affect AI-powered consumer products and their risk exposure in one way or another.

The upcoming legal framework

The GPSR ( Regulation (EU) 2023/988), which entered into force on 12 June 2023 and will be applicable from 13 December 2024, is a revised version of the General Product Safety Directive ( Directive 2001/95/EC, "GPSD"). It aims to improve the safety framework for non-food consumer products by imposing specific product conformity requirements on economic operators, primarily manufacturers, to ensure that only safe products are placed on the EU market. The GPSR inter alia addresses the challenges of new technologies and acts as a safety net for consumers and a regulatory framework to fill gaps in existing or future product-specific legislation, ensuring a high level of consumer protection. The GPSR covers risks not addressed by sector-specific legislation, including, but not limited to, general product safety requirements, standards for online marketplaces, obligations in case of accidents, consumer information and remedies, product safety recalls and the operation of the Rapid Alert System.

Key changes under the GPSR

The GPSR addresses, amongst others, AI-related product risks. The Regulation introduces several important changes and requirements for economic operators placing AI-powered consumer products on the EU market. The new AI-specific requirements are detailed below.

1. Coverage of AI-powered consumer products excluding stand-alone AI-software

The GPSR retains the broad definition of "product" from the previous GPSD. It is defined as any item that is either intended for consumers or likely to be used by consumers, even if it was not originally intended for them. The GPSR therefore covers both consumer products in general and AI-enabled consumer products more specifically. Although, this is not a change in the law, it is now clear that stand-alone AI software is not covered by the GPSR. This was controversial under the GPSD. However, the fact that the EU legislator did not explicitly include (AI) software in the definition, although it is included in related legislation, namely the revised Product Liability Directive (Article 4(1)), for which EU policymakers reached a political agreement in December last year, must be taken as a clear indication that it was deliberately left out of scope. Moreover, the inclusion of (AI) software was explicitly recommended by the EU Commission's report on the safety and liability implications of Artificial Intelligence, the Internet of Things and robotics (page 11, see here).

The GPSR therefore only applies to AI embedded in physical consumer products, as opposed to pure AI-based stand-alone software. There are many examples of such consumer products embedding AI technology in the form of predictive and/or generative AI. For example, smart home appliances (such as a washing machine) can incorporate predictive algorithms to analyse usage patterns, environmental factors and user preferences in order to optimise energy consumption, adjust settings for efficient operation or even anticipate maintenance needs. Similarly, a smart refrigerator with generative AI capabilities can analyse the food inside and generate meal suggestions or recipes based on available ingredients. Equally, personalised health devices (e.g., fitness trackers) can analyse data such as heart rate, sleep patterns or activity levels to provide personalised health insights or generate customised exercise plans.

2. Updated meaning of "safe products" under the GPSR

The GPSR updates the aspects to assess whether a product is a "safe product". It includes risks arising from product interconnectivity, cybersecurity and AI elements in product function-ality. This change recognises the evolving nature of AI-powered consumer products and addresses the unique risks associated with interconnected and technologically advanced products, including post-market risks.

Manufacturers are therefore required to consider the specific risks associated with AI elements in product functionality, and to establish mechanisms for post-market monitoring of AI-powered consumer products. This could include collecting user feedback, monitoring product usage and performance data, promptly addressing any issues identified, and retraining or fine-tuning AI algorithms as new data becomes available or user patterns change. This approach ensures that the product remains effective, adapts to evolving user needs, and addresses potential biases or inaccuracies due to changes in data patterns. For example, if AI algorithms in smart home devices such as smart thermostats are not regularly updated to reflect new conditions, the system may not accurately control heating systems, leading to incorrect recommendations, unnecessary spending or compromised building safety.

3. Allocation of responsibilities in the supply chain in case of substantial modifications to AI-powered consumer products

The GSPR emphasises that when a natural or legal person places a product on the market under their own name or substantially modifies a product, they should be recognised as the manufacturer and assume associated obligations. The update in legislation aims to clarify the responsibilities of economic operators when a person other than the original manufacturer significantly modifies the product. This is particularly relevant for AI-powered consumer products, which often undergo rapid technological advancements and updates provided by parties other than the original manufacturer.

Modifications to AI-based products can involve changes to software, algorithms, or data processing capabilities, which can have a substantial impact on the product's behaviour and performance. Third-party software developers, data providers, system integrators, or service providers may be involved in these modifications.

Determining responsibility for safety standards and risks associated with modified AI-powered consumer products becomes complicated as the original manufacturer may not have control over the modifications made by third parties and it is unclear when exactly a modification is considered substantial. This complexity in accountability and compliance can create liability risks. Clear agreements between manufacturers and modifiers are therefore crucial to effectively address these issues.
Read Part 2: Product compliance for consumer products powered by AI here

# data[].attributes.attachment_link.title
Part 1: Product compliance for consumer products powered by AI

# data[].attributes.attachment_link.description
In today's consumer-driven world, ensuring the safety and reliability of products is paramount. Hence, product safety and compliance are critical issues that every company involved in the supply chain should be aware of. This is even more true when it comes to products powered by artificial intelligence ("AI"), which pose new risks due to their interconnectivity, self-learning capabilities and increased exposure to cybersecurity vulnerabilities.

# data[].attributes.headline
AEPD: Artificial Intelligence and automated decisions

# data[].attributes.subject
AEPD: Artificial Intelligence and automated decisions

# data[].attributes.attachment_link.readable_text
Breaking news regarding accountability

Basic tools for accountability compliance

The AEPD has developed tools and help material to assist with compliance with general data protection regulation for small businesses, entrepreneurs and developers, and other types of controllers. This section lists those tools that are common to all types of processing. In the section "Guides, reports and technical notes" you can find specific material that extends their scope to specific treatments, technologies or controllers.

In any case, controllers and processors should not forget to verify that they comply with all the requirements and obligations that guarantee compliance with GDPR and national rules on data protection.

Risk management and Impact Assessment regarding Data Protection

The following resources support the obligation to carry out a risk analysis of personal data processing, and in case that is needed, the obligation to carry out a data protection impact assessment:

There are more resources about risk management and DPIA in the main section: Risk management

Data Protection by Design and by Default

The following resources support the obligation to take into account, from the initial stages of definition and analysis of the processing, appropriate technical and organisational measures for ensuring, by design and by default, data protection principles implementation:

Personal Data Breach Management

The following resources support the obligation to implement incident recording and notification mechanisms in order to properly manage any possible breach.

Application sectors and technologies

In order to respond to sectors of activity or technologies that incorporate singularities in data processing, referenced is made below to resources of interest, both national and international, that can serve as support to comply with the principle of accountability. At this time, published materials and resources cover the following areas:

Anonymisation and Pseudonymisation

Guidelines and technical surveys

Posts

International recommendations and guidelines

Tools

Artificial Intelligence and automated decisions

Due to the big use of the artificial intelligence in biometrics, in the following link you can find some very interesting information about Biometrics

Guidelines and technical surveys

International recommendations and guidelines

Big data

International recommendations and guidelines

Biometrics

Due to the big use of the artificial intelligence in biometrics, in the following link you can find some very interesting information about Artificial Intelligence and automated decisions

Guidelines and technical surveys

Post

International recommendations and guidelines

Blockchain

Posts

Cloud computing

International recommendations and guidelines

Covid-19 Pandemic

Guidelines and technical surveys

Posts

International recommendations and guidelines

Data protection by design and by default

Guidelines and technical surveys

Posts

International recommendations and guidelines

Encryption and privacy

Posts

International recommendations and guidelines

Governance and data protection policies

Posts

International recommendations and guidelines

Internet and mobile systems

Guidelines and technical surveys

Posts

International recommendations and guidelines

Internet of Things (IoT) and Connected Systems

Guidelines and technical surveys

Posts

International recommendations and guidelines

Personal data breach and security

Guidelines and technical surveys

Tools

Templates and forms

Posts

International recommendations and guidelines

Public Administrations

Guidelines and technical surveys

Templates and forms

International recommendations and guidelines

Risk management

Guidelines and technical surveys

Tools

Templates and forms

Posts

International recommendations and guidelines

Telecommuting

Guidelines and technical surveys

Posts

International recommendations and guidelines

# data[].attributes.attachment_link.description
In order to promote and disseminate knowledge about risk management for the rights and freedoms of natural persons, the AEPD (Spanish Data Protection Authority) develops resources and tools to promote compliance with the RGPD, focusing attention on supporting SMEs and entrepreneurs.