Phil Lee’s Post

Interesting update for anyone watching out for #NIS2 developments - EU Commission publishes draft implementing regulation, revealing what it thinks should qualify as a "significant incident" (triggering reporting duties) and what cybersecurity measures in-scope entities need to implement, ahead of October's implementation deadline 👇 Kudos to Dr W Kuan Hon, whose post here (https://lnkd.in/e2ATggG7) first alerted us to the Commission's publication.

We're starting to receive a lot of questions from clients about how to get #aiact ready and, when confronted with a 400+ page piece of legislation, the task can at first seem overwhelming. The trick, as with all things, is to break it down into easy-to-follow conceptual steps, as illustrated in the simple graphic below. As always, Digiphile keeping it simple, strategic and actionable for you 😀

Look what just arrived in the post for me! A shiny new book from the mind of data protection mega-brain Dr W Kuan Hon, "Technology and Security for Lawyers and Other Professionals", to which I wrote the foreword. While it's always exciting to see your name in print, my meagre two-and-a-bit page contribution doesn't begin to compare to the absolutely mammoth effort undertaken by Kuan in writing this 500+ page encyclopedic reference / epic. Well done Kuan!!! 👏👏👏

A couple of days ago, I posted about incident reporting rules under the AI Act but, as Carey Lening, CDPP pointed out in a comment, it’s just one of a suite of new EU laws with incident reporting requirements. There’s also #NIS2, which - from October - will impose its own cyber threat and incident reporting requirements. If you’re looking to understand those a bit better, then check out this excellent post from Digiphile’s Marco Piana 👇

How does incident reporting work under the #AIAct? It's a bit more complex than you might imagine. The precise rules vary depending on whether the AI system is "high risk" or not, whether the incident itself is "serious", whether you are a provider or deployer, and, if a provider, whether you provide the impacted AI system or a #GPAI model integrated into it. Got all that? Don't worry if not - the Digiphile infographic below should help:

The Swiss-US DPF is one step closer to finally going live. 👇 (Kudos to David Rosenthal for keeping us informed here at Digiphile.)

We don't just advise on #AI legal issues, we also explore ways we can use #AI safely, securely and responsibly to improve productivity. Digiphile's Director of Operations, Alastair Lee, explains below how a simple question to ChatGPT has transformed our approach to e-billing clients. If you're a small law firm, you may also want to read this.

Under Article 50(2) of the #AIAct, providers of generative AI systems have to ensure that any audio, image, video or text content they generate are "marked in a machine-readable format and detectable as artificially generated or manipulated". We can expect regulatory guidance in the form of Codes of Practice to be produced by the AI Office. It'll still be a couple of years before this provision comes into effect, but I saw an early indication of how it is likely to work just yesterday, following a post I had shared (https://lnkd.in/emWzK27d) in which I used a cartoon graphic of a robot standing next to an explosion, which I'd generated using ChatGPT. When I looked at the post later in the day, I noticed it sported a little "CR" icon, in its top left corner. Curious as to what this was, I clicked on it and it opened a "Content credentials" dialogue box, indicating that the image had been generated by OpenAI. What's most remarkable about this is that I didn't download the image from ChatGPT (because the download was in a .webp format, not recognised by LinkedIn), but had instead screenshot it and saved it as .png file. Despite this, LinkedIn still recognised it as AI generated. Following links in this content credentials dialogue box took me to a page explaining that LinkedIn has adopted the  Coalition for Content Provenance and Authenticity (C2PA) to help identify AI-generated content, where it has been "cryptographically signed using C2PA Content Credentials".  The goal of C2PA "is to enable consumers to trace the source and authenticity of media content, including when generative AI use is detected.". If you're interested to read more, see here: https://lnkd.in/euXPjUvm So this is what the future for AI generative content labelling will likely look like, and you should expect to see this type of label cropping up more often across digital media. In the meantime, good on OpenAI and LinkedIn for proactively adopting these measures now, and not just waiting until it became a legal obligation.