The European Union's AI Act has introduced significant obligations for deployers of artificial intelligence systems. One crucial aspect of these duties is record-keeping and retaining relevant information, as well as producing requested documentation. This guide aims to provide practitioners with practical guidance on logging and preserving data for AI systems, as well as complying with the EU AI Act's requirements.
Understanding the Required Record-Keeping
Under the EU AI Act, deployers of AI systems have certain responsibilities when it comes to record-keeping. To ensure compliance, it is essential to understand what types of data and information need to be logged, retained, and made available on request:
- Deployment and operation information: Log details such as the system's configuration, software versions, and any modifications made during its lifecycle.
- AI system performance: Document the system's performance, including metrics like accuracy, precision, recall, and f1-score.
- Data sources and processes: Log details about data sources, pre-processing steps, and algorithms used by the AI system.
- Model and training information: Document the training data, model architecture, and hyperparameters used during training.
- Deployment and usage context: Keep records of the AI system's purpose, intended use, and the environment in which it is deployed.
Logging and Retention Practices
To meet the requirements of the EU AI Act, deployers should establish a robust logging and retention strategy for their AI systems:
Logging Practices
- Establish a comprehensive logging system: Select a suitable tool or method to capture the aforementioned data types.
- Define logging frequency: Determine how often to log relevant data based on the AI system's complexity and operational needs.
- Logging destination: Choose an appropriate storage location or platform for retaining the logged data.
- Logging standards: Ensure that the logging system adheres to relevant standards, such as the Open Data Model (ODM) for AI systems.
Retention Practices
- Retention period: Establish a clear and transparent duration for retaining logged data.
- Data protection: Ensure that data logging and retention adhere to the principles of data protection and privacy.
- Decomposition: Break down retention requirements based on the data types and frequency to avoid overwhelming storage resources.
Retrieving and Producing Logged Data on Demand
As AI systems become more prevalent, the ability to retrieve and produce requested data easily and accurately will be essential for compliance with the EU AI Act. Following are some guidelines:
- Data retrieval method: Choose an efficient and secure method for retrieving logged data, such as a centralized database or an easily accessible platform.
- Data organization: Organize the logged data into categories, ensuring that the data can be quickly retrieved when required.
- Data sharing: Establish protocols for sharing logged data with relevant authorities or stakeholders, including the ability to produce requested data within a specified timeframe.
Guidance for Compliance with EU AI Act Requirements
Exercising care when designing and operating AI systems can help ensure compliance with the EU AI Act. Consider the following:
- Data validation: Ensure that the data logged is accurate, complete, and relevant to the AI system's functionalities.
- Data protection: Implement appropriate data protection measures to protect the privacy and security of individuals whose data is processed by the AI system.
- Data de-identification: If the data contains personally identifiable information (PII), ensure that PII is de-identified or pseudonymized, as required by the EU AI Act.
Data Retention Policy
A clear and transparent data retention policy is essential for ensuring compliance with EU AI Act requirements. Develop a data retention policy that focuses on:
- Data retention duration: Define the maximum duration for retaining data, ensuring that it aligns with the EU AI Act requirements.
- Data retention criteria: Establish criteria for determining which data is relevant for the AI system's operations.
- Data deletion procedures: Define a process for deleting data when the retention criteria are met.
Data Retrieval Procedures
Ensuring that the required data is available when needed is crucial for staying compliant with EU AI Act requirements. Draft data retrieval procedures that focus on:
- Data retrieval methods: Choose efficient and secure ways to retrieve data, such as using APIs or data extraction tools.
- Data access control: Implement strong access control mechanisms to ensure authorized personnel can retrieve data while protecting sensitive information.
- Data selection criteria: Establish criteria for selecting the required data for retrieval, ensuring the data meets the AI Act's requirements.
Put it into practice
The Deployer Duties One-Pager Pack from ActLattice collects the templates and checklists behind this guide in ready-to-use form, so your team can apply the framework without drafting from scratch.