AI readiness: How businesses should prepare for the coming wave of AI regulation

For years, AI regulations have lagged far behind AI technology’s explosive growth. But now that’s starting to change.

The European Union is rolling out the first major international AI regulation, the E.U. AI Act, which establishes new risk management, governance, transparency, data privacy and cybersecurity requirements for organizations that use AI. This is a clear signal that businesses need to get serious about AI readiness and data privacy — even in situations where this specific law doesn’t apply.

Keep reading to learn why, plus how to get started making your business more AI-ready from a data privacy perspective.

Why should U.S. businesses care about the E.U. AI Act?

Some U.S. businesses that serve customers or conduct operations in Europe may be directly affected by the E.U. AI Act. Depending on how you develop or use AI and your connection to the European market, you may need to take compliance action to avoid penalties.

Key features of the E.U. AI Act

The E.U. AI Act takes a risk-based approach that classifies AI tools or systems into one of four risk buckets:

• Unacceptable risk: AI that manipulates users, discriminates or otherwise actively causes harm. (This falls far outside the scope of how most businesses use AI.)
• High risk: Certain AI tools that affect critical areas like infrastructure safety, employment, education, essential services, financial systems, law enforcement and democracy. (This is also out of scope for most businesses.)
• Limited risk: AI systems used in lower-risk situations that need only limited oversight from a compliance perspective.
• Minimal risk: AI systems that don’t need regulation.

Depending on which bucket your AI use or development falls into, you may have significant or more limited compliance requirements to follow.

But what if you don’t do any business outside U.S. borders? Don’t assume that means you can just ignore risks that the E.U. law is trying to address.

Don’t ignore AI data privacy even if the E.U. AI Act doesn’t apply to your business

The purpose of the E.U. AI Act is to promote stronger AI risk management, governance, transparency, data privacy and cybersecurity. This is something every business needs to be responsible for, as falling short here can expose your business to financial, operational and reputational damage. Don’t wait for a law before you act to protect your business and customers.

However, more laws are also coming. Individual U.S. states like California already have AI rules in place with additional legislation in progress; the rules will continue to evolve at both the state and federal levels.

This means that regardless of whether you see it as a risk-based approach to manage AI risks or just a compliance exercise, you need to implement a strategy to prepare for and manage AI risks.

How should U.S. companies take action to improve AI data privacy and cybersecurity?

CIOs and CISOs at U.S. businesses and organizations that use AI should implement a cohesive AI risk management strategy to mitigate AI-related risks and protect sensitive internal and customer data.

Here are practical action steps to help you get started:

1. Know your jurisdiction

Are you affected by the E.U. AI Act or U.S. state-level AI regulations? Find out, because if so, you’ll need to determine which regulations apply and when compliance deadlines kick in.

2. Understand the type of data you’re collecting

Clarify exactly what kind of data you’re gathering from your customers. Depending on your industry or the type of customers you serve, you may have to navigate specific privacy and security requirements, like HIPAA, PCI or another specific set of rules.

3. Find an AI and cybersecurity advisor

Find an advisory firm that understands AI, cybersecurity and risk management. This firm can help you assess your current level of AI readiness and implement a security framework to manage risk and protect your sensitive data.

4. Align data protection with core business goals

As your business grows, you will take on new AI and data privacy risks simply as a product of increased scale. Think about your business goals over the next 5 to 10 years and assess what this could mean from a data privacy perspective. Be proactive here, so you can build better protections into your business as you grow rather than waiting for trouble to strike.

5. Do an AI readiness assessment

An AI readiness assessment helps you establish a baseline for where your business stands with AI today. A successful assessment will document how you use AI, identify security or control gaps and develop a plan to fill those gaps. It is a first step towards implementing a full cybersecurity and data privacy framework.

6. Implement an AI, cybersecurity and data privacy framework

Finally, implement an AI cybersecurity and data privacy framework. Doing this will allow you to mitigate AI and data security risks that you identified during your AI readiness assessment, so that you can better protect your data, your customers and your business.

Depending on your industry and goals, you may want to choose a cybersecurity framework like:

• NIST CSF: A great all-around security framework.
• NIST AI RMF: An AI-specific framework that can be added onto existing security controls or implemented as part of a broader security framework.
• ISO/IEC 42001: An international AI management framework that aligns with other ISO frameworks.
• HITRUST: Popular with the healthcare and technology industries (can help organizations meet HIPAA compliance standards).
• PCI DSS: A security framework used by retail, service and other businesses accepting point-of-sale payments.
• SOC 2: An attestation framework to help show your customers or stakeholders that you have certain crucial security controls in place.

Talk to your advisor about which framework makes the most sense for your business.

Here’s how to conduct an AI readiness assessment

Conducting an AI readiness assessment is an essential first step to understanding where your business is today and where you need to improve. Do this to set a baseline, identify security gaps and make a plan to solve them (which may include implementing a cybersecurity framework).

Key steps include:

1. Establish a baseline

Document all the different ways your organization collects and uses data. This includes your customer data input process, where customer and internal data is stored, who has access and what data gets shared with AI.

Also take stock of your existing AI tool inventory and use cases, as well as who within your organization owns each.

2. Do a gap assessment

The purpose of a gap assessment is to identify gaps in your existing controls around AI use, data privacy and cybersecurity. Look at your current controls and notice what’s missing or could be improved (including not just from a security perspective, but also in terms of inefficiencies or ineffective AI use).

3. Make a plan to fill your control gaps

Develop a plan to fill the control gaps you identified during your gap assessment. This may include installing new controls, training your team, bringing in third-party support or hiring a new team member. Implementing a full AI, cybersecurity and data privacy framework is the most comprehensive way to do this and is also an opportunity to integrate AI more effectively into your business.

4. Conduct ongoing monitoring

Once you’ve completed your AI readiness assessment and taken action to improve your security, don’t stop paying attention. New AI models, cybersecurity risks and regulatory requirements continue to arrive on the scene. To keep up, conduct ongoing monitoring of your business’s AI use as well as the broader security landscape.

If you keep thinking about your data security as evolving alongside the expanding capabilities of AI models, you’ll be in great shape.

Read more

• AI governance checklist: A basic framework for your business
• AI risk management: Business strategy, governance and more
• Cybersecurity risk management: A guide for business leaders