Dear startup founders,
As a mentor am pleased to see the enthusiasm and innovation you bring to the incubator. This year, the focus is on AI solutions, which is interesting, but it also brings with it specific challenges.
As a lawyer with 15 years of experience, specializing in Data Privacy and AI Governance, I would like to take this opportunity to give you a brief overview of some of the basic concepts within the Data Privacy and AI Governance framework.
Data Privacy
Legal Basis: Before processing personal data, you must have a legal basis (legal obligation, legitimate interest, consent, etc.). For AI solutions, you can mostly think about legitimate interest or about consent as a legal basis.
Privacy by Design and Default: This means embedding privacy protections into processes from the very start and ensuring that privacy settings are the default option for users, e.g. setting privacy-friendly defaults in apps, limiting data retention periods automatically, encryption.
Data Minimization: Collect only data that is necessary for the functioning of your products. For AI systems, this is often a challenge because models need a lot of data to train but consider implementing techniques such as pseudonymization or anonymization prior to training of AI models.
Rights of individuals: Users have rights (access, rectification, deletion – “right to be forgotten”, data portability, etc.). Your products must have mechanisms in place to effectively exercise these rights. For AI systems, the right to erasure is particularly complex due to the nature of model training (“Machine Unlearning” techniques).
Data Protection Impact Assessment: For high-risk processing you are required to carry out a DPIA before you start processing data. AI solutions often fall into this category.
AI Governance
The European Union has adopted the AI Act, the world’s first comprehensive legal framework for AI. The act is based on a risk-based approach, which means that the obligations depend on the level of risk your AI system poses.
Risk Identification: Your first step is to classify your AI system by risk:
- Unacceptable risk: Prohibited (e.g. social scoring)
- High risk: Strict compliance obligations (e.g. AI for medical devices, recruitment) If your startup is developing high-risk AI, extensive requirements await you: establishing a risk management system, high-quality training data, technical documentation, human oversight, transparency, and accuracy
- Limited risk: Required transparency (e.g. notification to users that they are interacting with AI)
- Minimal/Low Risk: Minimum commitments (e.g. spam filters)
Data quality and anti-bias: The data used to train high-risk AI systems must be relevant, representative, error-free and, most importantly, processed in a way that minimizes the risk of discrimination or bias.
Transparency and explainability: Especially for high-risk systems, you will need to be able to explain to the user (and the regulator) how the AI made a certain decision (Right to explanation).
Conclusion
In conclusion, respecting privacy and AI governance principles can be a competitive advantage. Startups that incorporate these principles from the beginning will build trust from users and investors and avoid high fines and product stoppages in the future.If you will have any questions, you can contact me, and I will be happy to provide you with additional guidance and best of luck with your business endeavours.
Rene Veronek, Head of Data Privacy & AI Governance at HBOR, startup mentor at BIRD Incubator
