JTC 21 PRELIMINARY VIEWS

ON
AI ACT TIMELINE
AND
HORIZONTAL/VERTICAL INTEGRATION

Patrick Bezombes
CEN CENELEC
1 E
T
L'IN
D
O
A
S
M
R
C
F
G
É
REGULATORY CONTEXT
&
TIMELINE

20/04/2023 2
 Horizontal/Vertical regulation context
The AI Act (AIA) proposal requires full consistencywith existing Union legislation applicable to sectors where high-risk
AI systems are already used or likely to be used in the near future (Annex II.A and Annex II.B)

Policy aim: all high risk AI systems must comply with horizontal requirements of the AIA irrespective of a sector.

Two main processes provided in the AIA to achieve this in practice (important differences between e.g. health and
automotive)

A.New Legislative Framework (NLF) legislation (e.g. machinery, medical devices, toys)

B.Old Approach legislation (e.g. aviation, cars)

The ex-ante essential requirements for high-risk AI systems set in the AIA will have to be taken into account
when adopting relevant implementing or delegated legislation under those acts.

20/04/2023 3
New regulatory and standard framework on AI
ARTICULATION BETWEEN REGULATION AND STANDARDIZATION

AI Act

New legislative
Standardization request framework

European standardization
Harmonised standards
organisations
(CEN-CENELEC)

Standards, Technical
International specifications, Technical reports
standardization
organisations
(ISO-IEC-ITU)
20/04/2023 4
 General timeline for
horizontal harmonized standards development

2021 2022 2023 2024 2025

?
Regulation AI Act
1st Draft AI Act Entry into
Publication
(AI Act) application
?
Standardization Revised ?
30/04/2025
request Standardization
?/04/2023 request
Development of harmonised standards
Standardization Standardization Develop homegrown standard
Work plan Adopt/adapt ISO-IEC/SC 42 standards
Parallel development under Vienna agreement

Development of conformity assessment schemes

Conformity
assessment Designation of the notified bodies

Today
20/04/2023 5
« HORIZONTAL » CONTEXT

20/04/2023 6
 Request for standardization to strengthen the AI act
Standardization request
1. risk management system for AI systems
2. governance and quality of datasets used to build AI systems
3. record keeping - built-in logging capabilities in AI systems
4. transparency and information to the users of AI systems
5. human oversight of AI systems
6. accuracy specifications for AI systems
7. robustness specifications for AI systems
8. cybersecurity specifications for AI systems
9. quality management system for providers of AI system
10. conformity assessment for AI systems
“
We need a horizontal approach to unleash the potential
of artificial intelligence in all areas. A cross-cutting
technology can only be effectively regulated by
horizontal rules that provide solutions to common
challenges.
”
Commissioner Thierry Breton
 Set of AI standards to be published by Q2 2025
 CEN-CENELEC JTC 21 will:
• Adopt/adapt ISO-IEC/SC 42 standards
• Develop standards jointly with SC 42
• Develop homegrown standard if/when needed
20/04/2023 7
 Draft standardization work programme for the AI Act
(category view)
ISO/IEC 22989:2022 Artificial intelligence concepts and terminology

ISO/IEC 23053:2022 Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML) Terminology
and concepts
ISO/IEC 5259 - part 1 Data quality for analytics and machine learning (ML) Overview, terminology, and examples

ISO/IEC 12792 Transparency taxonomy of AI systems

Req. ISO/IEC 42001 AI management system

Req. ISO/IEC 27001:2013 Information security management systems AI management system

ISO/IEC 23894 AI Risk Management &
Risk management
Req. CEN-CENELEC AI Risk catalogue

Req. CEN-CENELEC AI trustworthiness characterisation

Req. CEN-CENELEC Accuracy of NLP (Natural Language Model) systems

IA
ISO/IEC 5259 - part 2 Data quality for analytics and machine learning (ML) Data quality measures &
Req. ISO/IEC 5259 - part 3 Data quality for analytics and machine learning (ML) Data quality management requirements and guidelines Data

ISO/IEC 5259 - part 4 Data quality for analytics and machine learning (ML) Data quality process framework

Req. ISO/IEC 42006 Requirements on bodies performing audit and certification of AI management systems Conformity
assessment
Green : published
Black : in developpement 20/04/2023 8
 HORIZONTAL APPROACH
&
VERTICAL STANDARDIZATION

20/04/2023 9
 Principles for Horizontal/Vertical integration

 Horizontal standards set the foundations in line with the Standardization

Request
 Horizontal standards set terminology and requirements aligned with the AI Act
 Vertical standards should align with the terminology and requirements of the
sector legislation
 Vertical standards build upon horizontal standards
 Vertical standards only add sector or technology specifics

20/04/2023 10
Anticipating and addressing « inconsistencies »

Verticals should contribute to the development of Horizontal harmonized

standards (not the reverse)

If horizontal terminology and requirements are not covering sectoral needs:

- Complement should be developed by Verticals

If horizontal terminology and requirements conflict with sectoral regulation:

- Justified adaptation/derogation should be done by Verticals

20/04/2023 11
« Horizontal/Verticals » integration options
Potential actions by « verticals »

Option 1
Fit to verticals Horizontal Contribution to horizontal standards development

Option 2 Vertical Contribution to horizontal standards development +

Complemented complement(s) to develop
Horizontal

Option 3 Vertical Contribution to horizontal standards development +

Adapted Horizontal adaptation(s) to develop

Vertical 1

Vertical 2

Vertical x
Option 4
Silo Horizontal ….

Horizontal
Vertical 1

Vertical 2

Vertical x

Option 5
Horizontal adaptation ….

20/04/2023 12
Conclusion

Close cooperation between JTC 21 and verticals

is essential to:

 ensure compatibility
 avoid any possible inconsistencies between
horizontal and sector specific standards.

20/04/2023 13
SPARE

STRATÉGIE DE NORMALISATION DE L'INTELLIGENCE ARTIFICIELLE 20/04/2023 14

 Horizontal requirements & Vertical specificities
Base line: Strong horizontal/transversal baseline in AI
Horizontal AI requirements
• AI Terminology and concepts/taxonomy/ontology
• Technical requirements frameworks (trustworthiness, metrics, control..) on AI components
• AI management framework, Risk management framework, risk catalogue (not exhaustive)
• ….
Vertical specificities
• Established « Verticals » standards landscape, including harmonized standards
• Use cases
• Context/Environnement
• Operational domain
• Regulatory requirements
• …
Integration of Horizontal requirements into vertical domain
• Risk assessment and treatment concepts: further specification/ operationalization/integration coming from AI horizontal standards
• Technical requirements on AI systems (and components): further specifications coming from AI horizontal requirements/standards
• Integration of AI specific standards into existing domains specific assessment schemes
• …

20/04/2023 15