It is evident that European lawmakers believe that risk management provides the optimum framework for assessing risks related to corporate activity. The

The high regard assigned to risk management for example is clear from EU law makers previous approach to occupational health and safety and when developing rules to protect personal data. In both cases, the EU has placed the onus on businesses to adopt risk management techniques and instruments as part of achieving its aims.  t.

This legislative approach is also reflected in new laws being prepared by the EU on the potentially disruptive phenomenon Artificial Intelligence (AI). The signs are that AI will soon become, if it has not already, a major catalyst for change in how many human interactions are carried out, and a tool that will define how the economic and social activities of our communities will both be organized and develop.

Whilst there are many advantages and opportunities afforded by the use of AI it also brings a number of risks and dangers. The latter are not just the known dangers around privacy, image rights, and personal data that sustain the algorithms behind social networks, or the potential for discrimination inherent in the analysis of mass amounts of data by AI. It is also around the danger to many of the human rights or goods we prize most, such as life (self-driving vehicles and city transportation run by AI) or bodily integrity (robot surgeons that can perform high-precision surgery).  To address these extremely meaningful risks and dangers the EU has once again decided that companies should adopt risk management techniques.

The forthcoming AI Law, which European lawmakers put forward in draft legislation in April 2021, and which will establish standards and rules on matters of AI, constitutes a fundamental piece of the new regulatory framework. Lawmakers have used it to lay out the basic duties of companies who create and/or use AI in their internal processes and external relationships. Most of the text looks at what the lawmakers have called “High-risk AI” citing the dangers it poses to safety, security, and fundamental rights. Of most interest in the draft legislation is article 9. It introduces an obligation that users of high-risk AI cannot circumvent: they must establish a risk management system. Before anyone can even deploy a new algorithm of this kind they must identify and describe the potential dangers it presents, conduct an analysis and assessment of its probability and impacts, and also implement steps for prevention, mitigation, and control related to the analysis and assessment. All of this also has to take place through an iterative process that must be embedded as a daily activity in the company’s ongoing affairs.

The legislation above was complemented by a draft Directive, put forward on September 28, 2022, on the adaptation of non-contractual civil liability rules to AI (the artificial intelligence liability directive). The latter wording attempts to modify the way in which some of the underlying principles of civil liability frameworks in Europe are understood, particularly when they apply to claims around of AI liability.

The impending Directive includes norms which, among others, facilitate demonstration of causality chains, or allow the victims of AI-caused damage to have access to the internal documentation of those companies that created or used the AI in question. It is certainly meaningful that the legislation mentions risk management throughout in connection with the core element of civil liability frameworks: culpability or neglect. Risk management becomes, under this draft Directive, an essential part of a companies’ duties of diligence. Diligent companies - those who comply with their duty of care in the eyes of European lawmakers - are those who employ a risk management system as a key component of their decision-making process. Those who do not incur guilt; their conduct is neglectful, careless and worthy of reproach. All of which seems a rather meaningful consequence of the legislation. With these norms, risk management will never again be seen as an optional tool for companies nor one which can be discarded by “fearless” entrepreneurs who decide to take all the risk upon themselves.