Skip to main content

AICR Consulting

AICR logotype
NEWS
October 29, 2024

Comprehensive National Framework for AI Governance: Ensuring Compliance and Innovation Under the AI Act in Lithuania

Comprehensive National Framework for AI Governance

AI Act Overview and CapAI Guidelines

The Artificial Intelligence Act (AIA) was accepted in August 2024, setting the foundation for regulating AI systems within the European Union. The Act introduces a comprehensive framework aimed at ensuring that AI systems operating in the EU are trustworthy, legally compliant, and ethically sound. It emphasizes the classification of AI systems based on risk, focusing particularly on high-risk AI systems, which are subject to stricter rules concerning safety, transparency, and risk management. These high-risk systems include those used in areas such as law enforcement, recruitment, and healthcare.

The AI Act mandates a certification process for AI systems, ensuring that they meet these requirements before being deployed in the market. However, one significant challenge the Act presents is the absence of detailed practical guidelines on how organizations can comply with these rules. This is where CapAI, a conformity assessment procedure developed by the University of Oxford, comes into play. CapAI offers structured guidance, particularly in addressing how organizations can navigate the AI lifecycle, which is crucial for aligning with the Act’s requirements.

Machine learning life cycle stages in relation with AI act. AICR Consulting

Figure 1. Machine learning life cycle stages in relation with AI act, source: CapAI 2022

The machine learning (ML) lifecycle forms the core structure for AI system development, comprising distinct stages that guide the process from inception to eventual deactivation. Each stage is crucial for ensuring that AI systems are compliant with legal, ethical, and technical standards, especially in light of the AI Act (AIA). The lifecycle includes:

  1. Design: This stage defines the objectives and ethical values that guide the entire development process. It’s the starting point where the requirements for the AI system are outlined, ensuring that both the technical specifications and ethical considerations are clearly mapped out. Article 10 of the AI Act is relevant here, as it sets the baseline for the development process by ensuring transparency and risk management from the start.
  2. Development: In this phase, data is prepared, and models are trained within a controlled training environment. Ensuring data quality, fairness, and robustness are key to minimizing risks and ensuring compliance with the AI Act. The Act’s requirements around data governance and transparency are especially important during the training stage.
  3. Evaluation: Once trained, the AI system is tested in a testing environment using unseen data to ensure performance, fairness, and compliance with ethical norms. This stage is crucial for validating the AI’s performance under different scenarios and detecting any biases or risks before deployment. Article 14 of the AI Act emphasizes the importance of monitoring during and after testing to ensure the AI operates within legal frameworks.
  4. Operation: After successful evaluation, the AI system is deployed into the production environment. During operation, continuous monitoring and maintenance are essential to ensure that the system remains compliant with ethical, legal, and performance requirements. Sustaining the system and ensuring updates or improvements align with regulations is key during this stage.
  5. Retirement: When an AI system no longer meets operational or ethical standards, it enters the retirement phase. This involves either deactivation or an update to ensure continued compliance, maintaining the integrity of the system within legal boundaries.

This lifecycle, supported by Articles 10 and 15 of the AI Act, provides a structured framework for ensuring that AI systems adhere to the required compliance and risk management standards throughout their entire lifecycle. The accompanying figure visualizes this process, highlighting the transitions between stages and the environments in which development and operation occur.

The integration of this figure offers a clearer view of how AI systems evolve through these stages, from initial design to retirement, emphasizing the continuous monitoring required for compliance with the AI Act. CapAI addresses each of these stages by providing an internal review protocol (IRP) that helps organizations ensure that their systems adhere to ethical standards, legal norms, and technical robustness at every stage of the AI lifecycle. For example, during the design phase, CapAI recommends identifying the ethical values that will guide development, while in the evaluation phase, it emphasizes rigorous testing to ensure the AI system is fair and unbiased.

AI system risk classification and conformity recommendations. AICR Consulting

Figure 2. AI system risk classification and conformity recommendations, source: CapAI 2022.

Furthermore, the AI Act introduces a risk classification system, dividing AI systems into three levels:

  • Unacceptable risk: Systems in this category are banned outright. Examples include social scoring algorithms used by governments and certain real-time biometric systems.
  • High risk: Systems like those used in employment, education, or critical infrastructure fall under this category and must comply with stringent rules regarding risk management, data quality, and technical documentation.
  • Low or minimal risk: These systems require no specific actions or compliance measures, although good practices are encouraged.

This risk classification, visualized in Figure 2, helps to clarify which AI systems are subject to stricter regulatory scrutiny. For more details on how the ML lifecycle aligns with the AI Act. While the AI Act provides a robust regulatory framework, tools like CapAI are essential for offering organizations the practical guidance they need to comply, ensuring their AI systems are both ethical and technically sound throughout the ML lifecycle.

Governance Structure in the EU for AI Act Implementation

Supranational and national bodies involved in the implementation and enforcement of the AIA. AICR Consulting

Figure 3. Supranational and national bodies involved in the implementation and enforcement of the AIA, Source: Novelli et al. 2024

The governance framework of the AI Act is designed to ensure a harmonized implementation across the European Union through both supranational and national authorities. At the supranational level, the European Commission plays a central role, supported by the AI Office and the AI Board. The governance structure is further supported by two advisory bodies: the Advisory Forum and the Scientific Panel, both appointed by the Commission to provide expertise and recommendations for the Act’s implementation.

Key Supranational Bodies:
  1. AI Office: The AI Office, established within the Directorate-General for Communications Networks, Content and Technology, is responsible for ensuring that the AI Act is consistently applied across all Member States. The office supports the creation and operation of regulatory sandboxes and provides administrative assistance to the AI Board and other relevant bodies. The AI Office also monitors General Purpose AI (GPAI) systems to assess conformity with the AI Act’s requirements.
  2. AI Board: Comprised of representatives from each Member State, the AI Board works closely with the AI Office to coordinate national authorities and ensure a uniform application of the AI Act. The board issues recommendations and harmonizes administrative practices across the EU, focusing on high-risk AI systems. This coordination ensures that all Member States follow consistent regulatory processes.
  3. Advisory Forum and Scientific Panel: These bodies bring together stakeholders from industry, academia, and civil society. While the Advisory Forum focuses on technical expertise and stakeholder feedback, the Scientific Panel provides in-depth analysis on AI models and assists in evaluating General Purpose AI. The Scientific Panel plays a pivotal role in assessing systemic risks posed by GPAI models.
National Authorities:

At the national level, each EU Member State is required to establish several authorities to implement and enforce the AI Act:

  1. Notifying Authorities: These bodies oversee the conformity assessment They are responsible for processing applications from companies that seek to be recognized as Notified Bodies, which will conduct assessments to ensure AI systems meet the high-risk classification standards set by the AI Act.
  2. Notified Bodies: These entities are legally recognized to carry out conformity assessments for high-risk AI systems. Their role is to ensure that AI providers comply with technical documentation and safety requirements before their products are deployed in the EU market.
  3. Market Surveillance Authorities: These bodies ensure that AI systems in the market continue to comply with safety and performance standards. They have the power to investigate and take corrective actions if a system is found to pose risks to public safety or fundamental rights​.

National Structure for AI Governance

The national implementation of the AI Act in Lithuania is built on a structure of key institutions assigned to oversee the conformity, regulation, and market surveillance of AI systems. These institutions are responsible for ensuring that AI systems, particularly those classified as high-risk, comply with both national and EU regulations. Lithuania has established a framework of authorities to provide conformity assessments, oversee market practices, and support companies in aligning with the AI Act.

  1. Notifying Authorities: In Lithuania, the Innovation Agency has been designated as the notifying authority responsible for overseeing and licensing conformity bodies. These conformity bodies will conduct compliance assessments of high-risk AI systems before these systems are placed on the market. The Innovation Agency ensures that these bodies are qualified to provide CE marking, which signifies that an AI system complies with the EU’s safety, transparency, and performance standards. Only organizations that have been licensed by the Innovation Agency can issue this CE marking, which is necessary for legal distribution within the European Union. The notifying authority also monitors and reviews the conformity bodies’ performance, ensuring they meet the high standards required under the AI Act​.
  2. Conformity Bodies and CE Marking: Conformity bodies assess high-risk AI systems to ensure they comply with the necessary legal and ethical standards. These bodies evaluate the system’s algorithms, data usage, transparency, and performance to ensure they meet the criteria set by the AI Act. Once a system passes the evaluation, the conformity body provides a CE marking, allowing the product to be marketed and sold within the EU. These bodies play a crucial role in the certification process and must maintain their licensing from the Innovation Agency. Without this CE marking, AI systems cannot be distributed within the EU market.
  3. Market Surveillance Authorities: The Communications Regulatory Authority of Lithuania (RRT) is responsible for the market surveillance of AI systems. Its role is to ensure that AI systems already on the market continue to comply with the AI Act’s safety, ethical, and technical standards. The RRT monitors AI systems for potential risks to public safety, privacy, or ethical violations and has the authority to investigate and enforce corrective actions when necessary. If an AI system is found to be non-compliant, the RRT can initiate recalls, remove the product from the market, or impose penalties. The RRT ensures that the market remains safe and that AI systems do not pose any risk to society.
  4. Regulatory Sandbox: A core feature of Lithuania’s AI governance structure is the AI regulatory sandbox, overseen by the Ministry of Innovation. This sandbox provides a controlled environment for companies to test their high-risk AI systems while receiving regulatory guidance. Companies can collaborate with regulators to ensure their products meet the conformity requirements of the AI Act before going to market. This initiative aims to foster innovation while ensuring that systems are safe and compliant with EU regulations. The sandbox also offers legal advice and practical support to companies developing AI solutions​.

In addition to these key bodies, several sector-specific authorities will regulate AI systems within particular industries:

  • State Data Protection Inspectorate (VDAI): The VDAI is responsible for overseeing the use of AI systems in fields such as law enforcement, migration, and justice. It is particularly focused on the regulation of biometric systems, such as facial recognition and emotion detection technologies, ensuring that these systems do not infringe on individuals’ privacy rights and are compliant with both the AI Act and the General Data Protection Regulation (GDPR). The VDAI ensures that AI systems operating in these sensitive sectors meet high standards of transparency and accountability.
  • Bank of Lithuania (LB): The Bank of Lithuania will supervise AI systems used in financial institutions, ensuring that they meet the safety and ethical standards required for high-risk systems under the AI Act. This includes monitoring AI used for financial decision-making, such as credit scoring and fraud detection, to ensure that these systems are fair, transparent, and do not compromise financial stability.
  • National Cyber Security Center (NKSC): The NKSC is tasked with ensuring that AI systems are secure from cyber threats. It provides guidance on best practices for cybersecurity in AI systems and ensures that these systems protect the confidentiality, integrity, and availability of data. The NKSC focuses on AI systems that interact with sensitive data and helps organizations implement strong cybersecurity measures to prevent breaches and ensure data protection.

These institutions collectively provide a comprehensive national governance structure to support the responsible development and deployment of AI systems. The combination of notifying authorities, conformity bodies, market surveillance, and sector-specific regulators ensures that AI systems in Lithuania meet the highest standards of safety, transparency, and ethical compliance. Organizations are also encouraged to adopt the ISO AI management system to further reduce risks and ensure adherence to global standards.

Reference:

  1. Floridi, L., Holweg, M., Taddeo, M., Amaya, J., Mökander, J., & Wen, Y. (2022). CapAI-A procedure for conducting conformity assessment of AI systems in line with the EU artificial intelligence act. Available at SSRN 4064091.
  2. Girdvainis, B. (2024). Dirbtinio intelekto valdysenos modelis: Strateginės gairės. Lietuvos Respublikos Ekonomikos ir inovacijų ministerija. https://data.kurklt.lt/wp-content/uploads/2024/03/Dirbtinio-intelekto-valdysenos-modelis.-Strategines-gaires.pdf
  3. Novelli, C., Hacker, P., Morley, J., Trondal, J., & Floridi, L. (2024). A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities. AI Board, Scientific Panel, and National Authorities (May 5, 2024).
  4. Novelli, M., et al. (2024). Robust governance for the AI Act: Insights and highlights. EU Artificial Intelligence Act. Retrieved from https://artificialintelligenceact.eu/robust-governance-for-the-ai-act/
  5. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (Text with EEA relevance)
Valentas Gruzauskas
About author

Dr. Valentas Gružauskas is an expert in AI governance, conformity assessment, and ethical AI applications. As an Associate Professor at Vilnius University and CEO of AI Conformity & Research Consulting, he leads initiatives in AI regulation and ISO standards. He actively participates in AI governance through the Horizon Europe Programme and various standardization committees. Dr. Gružauskas has made significant contributions to fields like machine learning, deep learning, and agent-based modeling, with a focus on AI ethics and data depersonalization. His work is widely published in esteemed journals, reflecting his impact and recognition in the AI community.