The EU AI Act, which came into force on 1 August 2024, aims to foster the responsible development and use of artificial intelligence (AI). The legislation is intended to ensure that AI systems used in the EU are safe, transparent, traceable, non-discriminatory and environmentally friendly—and overseen by people rather than by automation.
The question is—is the new regulation a challenge for compliance or a catalyst for innovation?
The Act establishes a model for the regulation of AI and may set a baseline for global regulations, in a similar way General Data Protection Regulation (GDPR) has done for personal data regulation.
Though the regulation may be seen as a challenge for compliance, the AI Act aims to instil confidence in consumers through reliability, transparency and fairness—as well as being a catalyst for innovation in AI adoption.
Connect with us
Together we work collaboratively to unlock and preserve the value of AI.
Who is affected by the AI Act?
The AI Act applies to private organisations and public authorities and, according to Article 2 of the AI Act, affects five main groups of stakeholders: providers, deployers, importers and distributors, product manufacturers and affected persons. The AI Act expressly does not apply to private individuals if they use AI systems for purely private purposes. Additionally, there are further exemptions for systems used for the purpose of scientific research and development, the military, defence and national security.
Organisations falling under the EU AI Act are expected to comply with its requirements by 2026. In some cases, however, such as a ban on prohibited practices and an obligation to ensure staff AI literacy, the term is significantly shorter and is effective from February 2025. There are significant financial penalties for non-compliance with the AI Act. Fines for non-compliance with the EU AI Act are up to €35 million or up to 7% of annual turnover. PwC’s approach, however, is not focused on mere compliance, but is on using the Act instrumentally as a tool to drive business transformation.
How can PwC help organisations use the EU AI Act to drive innovation?
AI Act compliance
Our interdisciplinary Risk and Legal Teams are able to help your organisation in the whole process related to AI Act compliance:
- Compliance Strategy: Assist in defining and developing AI Act compliance strategies.
- Assessment: Assess the current stage of compliance with AI Act and other relevant regulations and standards, for instance: the Digital Operational Resilience Act (DORA), the Network and Information Systems Directive 2022 (NIS2), a directive for a common high level of cybersecurity across the Union, and the General Data Protection Regulation (GDPR).
- Implementation: Assist in the design of policies, procedures and practices required by the regulation as a part of an AI Governance Framework, taking into account market standards such as the National Institute of Standards and Technology (US Department of Commerce) AI Risk Management Framework (NIST AI RMF) or the International Organisation for Standardisation (ISO) framework ISO-42001.
- Technical model assessment: At PwC, we provide a comprehensive framework for Algorithm and AI Validation Services, focusing on the technical assurance of AI systems. Our approach evaluates key factors such as sensitivity, specificity and accuracy while addressing contextual considerations and enabling continuous monitoring. This ensures compliance with the EU AI Act, reduces risks associated with data and mitigates potential biases in AI outcomes.
Our teams are able to help your organisation with the following areas:
Algorithm selection and design: Assess the suitability and alignment of algorithms with business objectives, ensuring ethical and responsible AI design practices.
Data collection: Verifying the relevance, sufficiency and representativeness of collected data to support robust model development and reduce biases.
Data quality and preprocessing: Ensuring data accuracy, completeness and consistency through rigorous preprocessing techniques, while identifying and mitigating potential data issues.
Model training and tuning: Evaluating the effectiveness of training processes, hyperparameter optimisation and ensuring that models generalise well across diverse scenarios.
Model validation and performance metrics assessment: Testing model accuracy, robustness, sensitivity and specificity against real-world conditions, using industry-standard and bespoke performance metrics.
Monitoring and continuous improvement: Reviewing model deployment processes, scalability and integration into business workflows, with a focus on operational resilience and governance of Machine Learning Operations (MLOps).
Explainability and transparency: Assessing the interpretability of AI models to enhance trust and understanding among stakeholders, facilitating compliance with regulatory requirements.
Risk mitigation and bias detection: Identifying and mitigating risks, including algorithmic bias, to promote fairness and equity in AI outcomes.
We understand that the AI Act should be considered in relation with other relevant regulations and standards, and are therefore able to capture synergies between different regulations and address compliance in a comprehensive way.
Responsible AI practice
Compliance with the AI Act is a key element of the responsible AI practice which should be implemented and followed by each organisation that seeks to use AI responsibly and build trust in AI. Our teams are able to help your organisation in the following elements:
- AI strategy: Define responsible AI strategies, covering elements related to compliance with regulations and sector standards.
- Management: Manage the implementation of end-to-end AI governance frameworks covering the entire AI life cycle.
- Assess and mitigate: Perform AI risk assessments and design risk mitigating actions, which can include the identification and classification of AI systems and the organisation role in the AI value chain in accordance with AI Act taxonomy.
- Monitor and report: Define rules and practices related to the monitoring and reporting of AI within organisations with respect to regulatory requirements.
- People and culture: Conduct training and workshops to build organisational awareness and upskill people about AI opportunities, risk and appropriate practices related to the technology’s use as a business transformation driver.
How can your organisation use a responsible approach to build trust in AI and gain the full benefits of being compliant?
Connect with us
Together we work collaboratively to unlock and preserve the value of AI.
Contact us
Angel Bangachev
Director, Legal Business Solutions | Attorney-at-Law, PwC Bulgaria
Tel: +359 894 333 237
