2023 is seen by some as the time when the Wild Wild West of the AI frontiers reigned. If that’s the case, then we can look to 2024 and beyond as the time when a new sheriff came to town: the EU AI Act. The excitement and frenzy that came from OpenAI’s ChatGPT was soon tempered by governing bodies looking to what sort of frameworks might be needed to ensure the safe and ethical use of these AI systems. Efforts to finalize and pass the EU AI Act were well on their way before the hype around generative AI took off, but that same hype likely proved pivotal toward passing such a wide-sweeping piece of legislation.
Kassi Burns, senior attorney at King & Spalding, author of several publications on AI (including some co-authored with myself), and independent producer of her podcast on AI and emerging technologies (Kassi &), joins me to dive into what attorneys need to know about AI governance to not get lost in the dust.
Olga V. Mack: What are key elements that every attorney here in the U.S. should know about the EU AI Act?
Kassi Burns: First, the EU AI Act is focused on the protection of health, safety, and fundamental rights of individuals against the harmful effects of AI systems. This is meant to be accomplished with a risk classification pyramid for AI systems, with varying degrees of requirements depending on the level of risk. Those levels of risk being: unacceptable risk, high risk, transparency risk, or permitted/no risk.
Secondly, while the EU AI Act was passed on June 13, 2024, it is not expected to come into effect until August 1, 2024. Once it does come into effect, it will do so in a phased process over a 2-year period. The European Commission has created an EU AI Office, officially opening in June 2024, which is currently focused on creating frameworks and guidelines to facilitate compliance and enforcement of the EU AI Act.
Finally, it’s important to remember that the EU AI Act is for all AI systems that have a presence in the EU. This means a few things: it isn’t just limited to generative AI systems, nor does it exclude a company simply because they don’t have a physical presence in the EU.
OM: There seem to be some unknowns with enforcement of the EU AI Act, as acknowledged by the EU AI Office. What are some resources attorneys can turn to now to prepare for AI compliance?
KB: Running just over 450 pages, I don’t think it’s expected for all attorneys to run out and ready the full text of the EU AI Act. Thankfully, the European Commission published an AI Question & Answer briefing, which covers the key elements of the EU AI Act and is easy to digest.
While we don’t have a final set of guidelines or frameworks from the EU AI Office, we can look at existing frameworks to help get into an AI governance mindset. The NIST AI Risk Management Framework, published in 2023, is one example of an existing model that can help an attorney prepare for what an AI compliance program might look like.
OM: Let’s say in-house counsel reaches out to their outside counsel to ask what they should be doing to prepare for the EU AI Act and other AI-related laws. How might that trusted advisor respond?
KB: Attorneys can spend 2024 helping their clients get organized: conduct an AI mapping exercise to help in-house counsel know all of the AI system in use that might carry a compliance requirement, assist in drafting AI and Generative AI policies, help clients prepare AI-related training content for its employees, and provide guidance on what sort of 2025 AI compliance budget needs the company might anticipate.
OM: We’ve been focused on the EU AI Act, but are there any U.S.-based laws or regulations that attorneys should be aware of?
KB: Yes, and at least one is already in effect. Let me start by saying the US AI legislative landscape is ripe with activity, so these are just a few examples. The first I’ll mention is the Utah AI Policy Act, which was passed in March 2024 and went into effect in May 2024. This piece of legislation is focused on protecting consumers in regards to generative AI systems, requiring companies to be transparent with consumers that they are engaging with a genAI bot. Colorado also recently passed their own Colorado AI Act, though it isn’t scheduled to go into effect until February 2026. Colorado’s Act is similar to the EU AI Act, in that it is meant to protect individuals from harm that may come from high risk AI systems.
OM: Do you have any last words of wisdom to share?
KB: There are so many but I’ll try to keep it brief. Take the time to become educated on these technologies, even try playing around with them in your free time in low risk use cases. Don’t underestimate the pervasiveness and ubiquity of AI tools and the potential risk they may pose. One perfect example is generative AI transcription tools, some of which exist as browser extensions and may not be apparent to all call participants they are in use. Finally, don’t be afraid to dial a friend. If you don’t understand an issue, reach out to your colleagues or a service provider who can help inform you on the more technical elements that are related to your clients’ legal issues. It takes a village, especially while we are learning to live in the Wild Wild West of AI!
Olga V. Mack is a Fellow at CodeX, The Stanford Center for Legal Informatics, and a Generative AI Editor at law.MIT. Olga embraces legal innovation and had dedicated her career to improving and shaping the future of law. She is convinced that the legal profession will emerge even stronger, more resilient, and more inclusive than before by embracing technology. Olga is also an award-winning general counsel, operations professional, startup advisor, public speaker, adjunct professor, and entrepreneur. She authored Get on Board: Earning Your Ticket to a Corporate Board Seat, Fundamentals of Smart Contract Security, and Blockchain Value: Transforming Business Models, Society, and Communities. She is working on three books: Visual IQ for Lawyers (ABA 2024), The Rise of Product Lawyers: An Analytical Framework to Systematically Advise Your Clients Throughout the Product Lifecycle (Globe Law and Business 2024), and Legal Operations in the Age of AI and Data (Globe Law and Business 2024). You can follow Olga on LinkedIn and Twitter @olgavmack.
