Navigating the Regulatory Landscape: Agentic AI’s Governance Challenges in the Era of the EU AI Act

Effective Strategies to Mitigate High-Risk Levels in AI Systems

Implementing measures to reduce risk in artificial intelligence systems is crucial for ensuring security and compliance. Key considerations include agent identity verification, maintaining comprehensive logs, conducting policy checks, incorporating human oversight, enabling rapid revocation, obtaining documentation from vendors, and preparing evidence for regulatory purposes.

Decision-makers have several options to establish a thorough record of agentic system activities. For instance, utilizing a Python SDK like Asqav can cryptographically sign each agent’s action and connect all records to an immutable hash chain, similar to blockchain technology. This approach ensures the integrity of records and prevents unauthorized alterations.

For governance teams, employing a verbose, centralized, and possibly encrypted system of record for all agentic AIs is essential. This system provides detailed data beyond individual software logs and offers insights into the actions of agentic instances across the enterprise.

One common pitfall for organizations is neglecting to maintain a registry of all operational agents, each uniquely identified with records of capabilities and permissions. This ‘agentic asset list’ aligns with the requirements of the EU AI Act’s Article 9, emphasizing the need for ongoing, evidence-based AI risk management throughout deployment stages.

• Article 9: In high-risk areas, AI risk management should be a continuous, evidence-based process integrated into all deployment stages and subject to constant evaluation.

Additionally, decision-makers must adhere to the provisions of Article 13 of the Act, which mandates that high-risk AI systems should be designed for user interpretability. Third-party AI systems must be transparent to users, accompanied by sufficient documentation to ensure lawful and safe use.

• Article 13: High-risk AI systems must be designed to allow users to understand the system’s output. Therefore, AI systems from third parties must be interpretable by users and come with comprehensive documentation for safe and compliant usage.

Meeting these requirements involves considering both technical and regulatory aspects when selecting AI models and deployment methods.