At Rise of AI 2024 in Berlin, Felix Broßmann, a partner at SKAD AG, gives an overview of the EU AI Act based on his firm's consulting work in AI governance for banks, insurers and startups. He opens by arguing that regulation is needed because generative AI carries real, demonstrated risks: answer quality degrading over time, training data being extractable from models, backdoors surviving safety training, bias in outputs, and chatbots that can be manipulated into damaging statements, such as a car dealership bot offering a car for one dollar or a jailbreak that bypasses safety filters by asking in Zulu. He then explains the Act's risk-based, four-tier structure, including an added layer for general-purpose AI models, and its goals of building trust, harmonizing the internal market and protecting fundamental rights. He details the burden this creates: an 458-page text, high compliance costs, steep fines and unresolved practical questions such as fine-tuning, biometric categorization and AI literacy obligations. He closes with the Act's relief measures for smaller companies and ten concrete recommendations for organizations preparing for enforcement.
Key takeaways
- The AI Act uses a four-tier risk model, with obligations scaling from minimal-risk transparency duties to strict requirements for high-risk systems.
- General-purpose AI models such as ChatGPT face an added regulatory layer aimed at systemic risks as models grow more capable.
- Initial compliance setup can cost around 30,000 euros, with total AI compliance estimated at roughly 17% of AI investment.
- Fines for violations such as supplying incorrect information to authorities can reach 7.5 million euros or 1.5% of global annual turnover.
- Microenterprises, SME cost reductions and regulatory sandboxes offer relief, but questions like fine-tuning and AI literacy remain unresolved.
Detailed notes
Why AI needs regulation
Broßmann opens with documented risks of generative AI: academic research shows answer quality can degrade over time, and training data can be extracted from models, including GPT-3.5. He cites an Anthropic paper on backdoors in Claude 3 that persisted through safety training, and a study showing bias in GPT-4 usage in healthcare. He gives two real-world incidents: a DPD chatbot that was manipulated into giving unwanted answers, and a Chevrolet dealership chatbot in Watsonville that a user convinced to offer a new car for one dollar, which was shut down six weeks later. He also demonstrates a jailbreak: ChatGPT refuses to explain how to produce black powder in English and in Gaelic, but complies when asked in Zulu, a loophole he says still worked two days before the talk.
The good: a risk-based framework
The AI Act aims to build trust through a CE-marking-style certification system, comparable to consumer electronics safety recalls, and pursues two stated purposes: a functioning internal market with harmonized rules across EU states, and protection of health, safety and fundamental rights. It uses a four-tier risk model, from minimal-risk systems that only need transparency to high-risk systems that require a full risk management system and documentation of training data and bias. The final version adds a layer specifically for general-purpose AI models, which face stricter obligations and exchange requirements with commissioners as they grow more capable, to address the kind of systemic risks shown by the jailbreak example.
The bad: complexity, cost and open questions
The Act runs 458 pages, versus 78 for the GDPR, and Broßmann says the substantive rules effectively start around page 100. A European Commission study estimated AI compliance costs at roughly 17% of AI investment, with upfront quality-management setup costing about 30,000 euros for companies without existing risk management. Sanctions are steep: supplying incorrect, incomplete or misleading information to authorities alone can cost 7.5 million euros or up to 1.5% of global annual turnover, on top of possible class action lawsuits. He expects a prohibition phase six months after entry into force, with sanctions following twelve months later. Practical ambiguities remain, including whether video-conferencing tools that track speakers count as regulated biometric systems, how fine-tuning can shift a company from deployer to provider status, what counts as sufficient AI literacy under Article 4, and how to measure fairness when different statistical measures of the same dataset disagree.
A tiny bit of hope
The Act includes relief for microenterprises, roughly nine or fewer employees with up to one million euros turnover, offering simplified quality-management guidance, and cost reductions for small and medium enterprises, including a commitment to re-evaluate certification costs. Broßmann points to planned innovation hubs and regulatory sandboxes that ease obligations for use cases such as medicine or ESG. He notes that companies already operating in regulated industries typically already satisfy 50 to 70% of the required risk-management functions.
Ten recommendations
Broßmann closes with concrete steps: accept that the Act exists and is complex and its fines severe; inform yourself and your colleagues beyond headlines; inventory all AI systems in the company, including edge cases that could be high-risk; build an AI governance structure sized to the organization; and use available help, from consultancies to regional AI hubs, to prepare before enforcement begins.
Quotes
That is why we must talk in all honesty about real risks of AI.
Felix Broßmann
The AI act is there, get over it.
Felix Broßmann
Questions answered in this talk
What is the four-tier risk model in the EU AI Act?
According to Felix Broßmann at Rise of AI 2024, the Act classifies AI systems by risk level, from minimal-risk systems that only need transparency to high-risk systems requiring a full risk management system, training-data documentation and bias checks, with an added tier for general-purpose AI models.
How much can EU AI Act violations cost a company?
According to Felix Broßmann at Rise of AI 2024, supplying incorrect or misleading information to authorities alone can cost 7.5 million euros or up to 1.5% of global annual turnover, with further exposure possible through class action lawsuits.
What relief does the EU AI Act offer small companies?
According to Felix Broßmann at Rise of AI 2024, microenterprises with about nine or fewer employees may get simplified quality-management guidance, SMEs may see reduced certification costs, and regulatory sandboxes are meant to ease obligations for use cases such as medicine or ESG.