Your contact for new licenses
Have you ever heard of the New Legislative Framework? No, it is not the Commission President’s new initiative to reduce bureaucracy, but a path to leaner legislation from 2008 – and this is exactly what will be important now that the AI Act has come into force.
“In principle, we welcome the EU’s New Legislative Framework approach, which only defines general requirements in the legal text itself and allows industry experts to work out the specific technical implementation specifications in the most practical way possible,” Bitkom AI expert Janis Hecker told my colleague Corinna Visser. This is because the decisive rules for AI companies are now being drawn up by standardization committees.
Read her feature to find out how the different levels – national, European and international – work together on standardization. Not just informative for those interested in AI.
We hope you enjoy reading the 750th issue of Europe.Table.
The schedule is very ambitious, thinks Filiz Elmas, Head of Artificial Intelligence Strategy Development at the German Institute for Standardization (DIN). The European AI Regulation (AI Act) only just came into force on August 1. “But we have set ourselves the goal of completing the drafts for the corresponding harmonized European standards by the end of this year,” says Elmas. The consultation process will then begin. “The publication of the finished standards is planned by the end of 2025 at the latest,” adds Elmas. The companies and organizations affected will then only have six months to make their AI systems compliant. This is because the AI Act will be applicable 24 months after it comes into force, i.e. from August 2, 2026.
In fact, companies are already waiting eagerly for these standards. “For AI companies, the timely adoption of harmonized standards is one of the most important prerequisites for an innovation-friendly implementation of the AI Act,” emphasizes Daniel Abbou, Managing Director of the AI Federal Association. Start-ups and SMEs in particular would have to expect massive compliance costs if they did not have sufficient preparation time for the necessary conformity assessment procedures. “For these companies, implementation is otherwise only possible with a massive amount of time and consulting, which inevitably leads to high additional costs,” says Abbou. In the worst case scenario, this would be to the detriment of the company’s innovative strength and lead to delayed or even failed market launches.
“Standards play a particularly important role for AI systems that fall under high-risk AI systems in the AI Act,” explains Janis Hecker, Artificial Intelligence Speaker at the digital association Bitkom. The EU has defined a list of requirements for providers of these systems in the AI Act. “However, how these are to be implemented technically will primarily be determined by harmonized European standards that are yet to be developed.” The advantage of harmonized European standards is that any company that complies with them automatically receives a presumption of conformity with the AI Act. This is a legally secure way of bringing your own high-risk AI systems onto the market in accordance with the AI Act.
The Commission issued a standardization request to the European Committee for Standardization and the European Committee for Electrotechnical Standardization (CEN/CENELEC) back in May 2023. The AI Act was still in the legislative process at the time. The standardization request comprises a list of ten points of new European standards to be developed. This includes standardization documents on:
Germany – or more precisely DIN and the German Commission for Electrical, Electronic & Information Technologies (DKE) – have done the groundwork. They drew up an initial standardization roadmap back in November 2020, the second edition of which followed in December 2022. “The roadmap is the strategic roadmap for AI standardization at the national level,” explains Filiz Elmas. It was created in a very broad participation process involving more than 570 experts. In working groups, these experts from various fields identified where there is a need for norms and standards.
What the experts develop at the national level, Germany contributes to the European and international standardization process via DIN. “AI is a global topic,” explains Elmas. “It makes little sense to take a national approach and develop national standards. That’s why we started developing corresponding standards at ISO/IEC level at an early stage.”
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have established a subcommittee for artificial intelligence (SC42) in the Joint Technical Committee on Information Technology (JTC1). “This was the first committee to be formed on the topic of trustworthy AI and has since resulted in more than 30 ISO standards,” says Elmas.
The corresponding body at the European level, the Joint Technical Committee 21 Artificial Intelligence (CEN-CENELEC JTC 21), was only established in the course of the discussion on the AI Act. It incorporated the recommendations from the German standardization roadmap for AI. Work at EU level therefore began much later than the ISO committee at the international level. “But the topics are the same,” explains Elmas. “In this respect, JTC 21 will also use international standards that already exist and adapt them to the European level. You don’t have to reinvent the wheel.”
It is particularly important to industry that European standards are in line with international standards. With the AI Act, the European Union has created the world’s first comprehensive set of rules for AI. “It should therefore now also be a requirement that the regulations created are applied as widely as possible,” demands Abbou from the German AI Association. “So that the global compliance jungle is easier to navigate for AI companies – ideally with a corresponding harmonization beyond the European Union.”
However, standardization bodies should also consider existing international standards in the opposite direction with regard to the standards to be developed for the AI Act. For example, the standards for Artificial Intelligence Management Systems (ISO/IEC 42001) and for requirements for bodies that audit and certify AI management systems (ISO/IEC 42006) could serve as the basis for harmonized standards under Article 40 of the AI Act. “Both approaches would help to avoid fragmentation of the global market and, at the same time, serious disadvantages for European and German providers,” says Abbou.
However, Elmas assumes that international standards will be tightened somewhat in some areas in order to comply with the AI Act. Nevertheless, the work of JTC 21 is essentially based on the work of ISO. “This is a large network of players,” says Elmas.
CEN/CENELEC functions on a decentralized basis. The members are the national standardization bodies (NSB), for Germany the DIN, and the national committees (NC), for Germany the DKE. They operate the technical groups that draw up the standards. DIN and DKE as well as CEN and CENELEC work closely together, also in joint committees. The CEN-CENELEC Management Center in Brussels manages and coordinates this system. There are currently 42 German experts active in JTC 21 (37 in the ISO committee SC42). In this way, German perspectives find their way into European and international standardization committees.
DIN has just published DIN/TS 92004. The standard is intended to provide guidelines for identifying and analyzing risks in AI systems throughout the entire life cycle. This standard is also intended for the European standardization process. “We have not developed a classic DIN standard in the field of AI,” says Elmas. “What we develop at the national level are usually preliminary standards so that they can be quickly introduced and incorporated at the international level.”
The standards are then developed in the relevant international committees. “In the end, there will be no DIN standards on AI at the German level,” explains Elmas. This is because once the European standards have been adopted, the national standardization bodies are supposed to convert them into identical national standards and withdraw all conflicting national standards.
Unfortunately, SMEs are hardly represented in the relevant committees of the German and European standardization organizations, states Abbou from the AI Association. Yet it is precisely these companies that could benefit greatly from such mechanisms and are dependent on quickly implementable and cost-effective time-to-market processes in the manufacturing sector, for example.
“One obstacle to the participation of SMEs in such processes and committees is certainly the effort involved in participating in the relevant committees and the potential loss of resources within the company,” says Abbou. German SMEs should therefore be further sensitized to this topic through targeted information campaigns. Abbou suggests providing SMEs with targeted incentives for direct participation, for example by comprehensively promoting participation in standardization committees.
Associations such as the German AI Association or Bitkom offer SMEs a platform to get involved in the standardization process. “As Bitkom, we principally welcome the EU’s New Legislative Framework approach, which only defines general requirements in the legal text itself and has the specific technical implementation specifications drawn up by industry experts in the most practical way possible,” says Janis Hecker. However, it is not yet possible to say how the specific process for developing the harmonized European standards for high-risk AI systems in the AI Act will ultimately be evaluated.
In her speech to the European Parliament, the now re-elected Commission President Ursula von der Leyen also made the reduction of bureaucracy a key issue. It is good that the EU Commission wants to deal with this in detail. After all, much of our national legislation now also has its origins in European directives and regulations. Green Deal initiatives, such as the IED, CSRD and CS3D directives, are causing European SMEs in particular to suffocate in paperwork – but without providing the necessary support for implementation. In particular, reporting obligations with up to 1,000 individual aspects are pushing companies to their limits.
The new EU Commission is now set to change this: the topics of competitiveness and reducing bureaucracy are new political priorities. This includes many initiatives that also sound good for SMEs: a Vice-President of the EU Commission for implementation, simplification – in short: cutting red tape. Annual progress reports from all Commissioners on this topic are planned, as well as competition and SME checks. There is also to be a new definition category for small mid-cap companies – an issue that WVMetalle is particularly committed to because the current SME protection is all too often undermined through the back door. It remains to be seen whether the EU institutions will bring about tangible relief.
But it is not only the European level that has some catching up to do in this respect. Federal and state policy as well as regional policy and administration must also ease the burden on industrial SMEs. Many companies in this country see bureaucracy as one of the biggest obstacles to their development.
It is therefore important that politicians put a stop to the increasing regulatory frenzy and instead reduce regulations. There are plenty of proposals for this: one of the most important in relation to the EU is the consistent 1:1 implementation of regulations at the national level. Germany’s ambitious practice of “let’s just take it up a notch” must come to an end.
At this point, we would like to reiterate von der Leyen’s proposal for annual reporting by all Commissioners on progress in reducing bureaucracy. Consistent input from our federal ministries is urgently required.
The bureaucratic madness is also spreading at the state and municipal levels. Take construction projects, for example: In Berlin, the average wait for a building permit is 30 months. A builder in Bavaria needs 73 different forms and has to contact 14 authorities to build a detached house. Not to mention industrial projects.
But bureaucracy is also increasingly taking place in the own sector. As a customer, it undoubtedly makes sense to agree certain standards with your own suppliers. These are described in the relevant standards. With the so-called “High Level Structure,” the authors of these standards have attempted to create an alignment between the systems, for example for quality, the environment or occupational safety.
Additional standard requirements, however, are difficult, for example for medical technology, aircraft construction and the automotive industry. Different standards for each raw material may seem sensible at first, but in practice the differences between the individual commodities are marginal. However, the difference is all the greater in terms of the effort required on the part of the suppliers, who then have to maintain, audit and train different systems. In addition, there are extensive audits with assessments, action plans and, in the worst case, sanctions.
Auditors often act like large companies in spirit and project the desire for similar structures onto small businesses. As if that were not enough, there are now also demands for data security and sustainability. The familiar pattern of “standard plus own further requirements” continues.
Is this still proportionate, let alone expedient? It is no longer possible for suppliers to make sense of all these regulations. This is because the economic performance of the German industry is declining in international comparison. And we have not been patent world champions for a long time. More and more companies are moving away or closing down completely. Is it possible to turn the tide again? Yes, but what we need is less restrictive regulation, more freedom and more time for our engineers.
Gerd Röders is President of the German Metals Federation
Have you ever heard of the New Legislative Framework? No, it is not the Commission President’s new initiative to reduce bureaucracy, but a path to leaner legislation from 2008 – and this is exactly what will be important now that the AI Act has come into force.
“In principle, we welcome the EU’s New Legislative Framework approach, which only defines general requirements in the legal text itself and allows industry experts to work out the specific technical implementation specifications in the most practical way possible,” Bitkom AI expert Janis Hecker told my colleague Corinna Visser. This is because the decisive rules for AI companies are now being drawn up by standardization committees.
Read her feature to find out how the different levels – national, European and international – work together on standardization. Not just informative for those interested in AI.
We hope you enjoy reading the 750th issue of Europe.Table.
The schedule is very ambitious, thinks Filiz Elmas, Head of Artificial Intelligence Strategy Development at the German Institute for Standardization (DIN). The European AI Regulation (AI Act) only just came into force on August 1. “But we have set ourselves the goal of completing the drafts for the corresponding harmonized European standards by the end of this year,” says Elmas. The consultation process will then begin. “The publication of the finished standards is planned by the end of 2025 at the latest,” adds Elmas. The companies and organizations affected will then only have six months to make their AI systems compliant. This is because the AI Act will be applicable 24 months after it comes into force, i.e. from August 2, 2026.
In fact, companies are already waiting eagerly for these standards. “For AI companies, the timely adoption of harmonized standards is one of the most important prerequisites for an innovation-friendly implementation of the AI Act,” emphasizes Daniel Abbou, Managing Director of the AI Federal Association. Start-ups and SMEs in particular would have to expect massive compliance costs if they did not have sufficient preparation time for the necessary conformity assessment procedures. “For these companies, implementation is otherwise only possible with a massive amount of time and consulting, which inevitably leads to high additional costs,” says Abbou. In the worst case scenario, this would be to the detriment of the company’s innovative strength and lead to delayed or even failed market launches.
“Standards play a particularly important role for AI systems that fall under high-risk AI systems in the AI Act,” explains Janis Hecker, Artificial Intelligence Speaker at the digital association Bitkom. The EU has defined a list of requirements for providers of these systems in the AI Act. “However, how these are to be implemented technically will primarily be determined by harmonized European standards that are yet to be developed.” The advantage of harmonized European standards is that any company that complies with them automatically receives a presumption of conformity with the AI Act. This is a legally secure way of bringing your own high-risk AI systems onto the market in accordance with the AI Act.
The Commission issued a standardization request to the European Committee for Standardization and the European Committee for Electrotechnical Standardization (CEN/CENELEC) back in May 2023. The AI Act was still in the legislative process at the time. The standardization request comprises a list of ten points of new European standards to be developed. This includes standardization documents on:
Germany – or more precisely DIN and the German Commission for Electrical, Electronic & Information Technologies (DKE) – have done the groundwork. They drew up an initial standardization roadmap back in November 2020, the second edition of which followed in December 2022. “The roadmap is the strategic roadmap for AI standardization at the national level,” explains Filiz Elmas. It was created in a very broad participation process involving more than 570 experts. In working groups, these experts from various fields identified where there is a need for norms and standards.
What the experts develop at the national level, Germany contributes to the European and international standardization process via DIN. “AI is a global topic,” explains Elmas. “It makes little sense to take a national approach and develop national standards. That’s why we started developing corresponding standards at ISO/IEC level at an early stage.”
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have established a subcommittee for artificial intelligence (SC42) in the Joint Technical Committee on Information Technology (JTC1). “This was the first committee to be formed on the topic of trustworthy AI and has since resulted in more than 30 ISO standards,” says Elmas.
The corresponding body at the European level, the Joint Technical Committee 21 Artificial Intelligence (CEN-CENELEC JTC 21), was only established in the course of the discussion on the AI Act. It incorporated the recommendations from the German standardization roadmap for AI. Work at EU level therefore began much later than the ISO committee at the international level. “But the topics are the same,” explains Elmas. “In this respect, JTC 21 will also use international standards that already exist and adapt them to the European level. You don’t have to reinvent the wheel.”
It is particularly important to industry that European standards are in line with international standards. With the AI Act, the European Union has created the world’s first comprehensive set of rules for AI. “It should therefore now also be a requirement that the regulations created are applied as widely as possible,” demands Abbou from the German AI Association. “So that the global compliance jungle is easier to navigate for AI companies – ideally with a corresponding harmonization beyond the European Union.”
However, standardization bodies should also consider existing international standards in the opposite direction with regard to the standards to be developed for the AI Act. For example, the standards for Artificial Intelligence Management Systems (ISO/IEC 42001) and for requirements for bodies that audit and certify AI management systems (ISO/IEC 42006) could serve as the basis for harmonized standards under Article 40 of the AI Act. “Both approaches would help to avoid fragmentation of the global market and, at the same time, serious disadvantages for European and German providers,” says Abbou.
However, Elmas assumes that international standards will be tightened somewhat in some areas in order to comply with the AI Act. Nevertheless, the work of JTC 21 is essentially based on the work of ISO. “This is a large network of players,” says Elmas.
CEN/CENELEC functions on a decentralized basis. The members are the national standardization bodies (NSB), for Germany the DIN, and the national committees (NC), for Germany the DKE. They operate the technical groups that draw up the standards. DIN and DKE as well as CEN and CENELEC work closely together, also in joint committees. The CEN-CENELEC Management Center in Brussels manages and coordinates this system. There are currently 42 German experts active in JTC 21 (37 in the ISO committee SC42). In this way, German perspectives find their way into European and international standardization committees.
DIN has just published DIN/TS 92004. The standard is intended to provide guidelines for identifying and analyzing risks in AI systems throughout the entire life cycle. This standard is also intended for the European standardization process. “We have not developed a classic DIN standard in the field of AI,” says Elmas. “What we develop at the national level are usually preliminary standards so that they can be quickly introduced and incorporated at the international level.”
The standards are then developed in the relevant international committees. “In the end, there will be no DIN standards on AI at the German level,” explains Elmas. This is because once the European standards have been adopted, the national standardization bodies are supposed to convert them into identical national standards and withdraw all conflicting national standards.
Unfortunately, SMEs are hardly represented in the relevant committees of the German and European standardization organizations, states Abbou from the AI Association. Yet it is precisely these companies that could benefit greatly from such mechanisms and are dependent on quickly implementable and cost-effective time-to-market processes in the manufacturing sector, for example.
“One obstacle to the participation of SMEs in such processes and committees is certainly the effort involved in participating in the relevant committees and the potential loss of resources within the company,” says Abbou. German SMEs should therefore be further sensitized to this topic through targeted information campaigns. Abbou suggests providing SMEs with targeted incentives for direct participation, for example by comprehensively promoting participation in standardization committees.
Associations such as the German AI Association or Bitkom offer SMEs a platform to get involved in the standardization process. “As Bitkom, we principally welcome the EU’s New Legislative Framework approach, which only defines general requirements in the legal text itself and has the specific technical implementation specifications drawn up by industry experts in the most practical way possible,” says Janis Hecker. However, it is not yet possible to say how the specific process for developing the harmonized European standards for high-risk AI systems in the AI Act will ultimately be evaluated.
In her speech to the European Parliament, the now re-elected Commission President Ursula von der Leyen also made the reduction of bureaucracy a key issue. It is good that the EU Commission wants to deal with this in detail. After all, much of our national legislation now also has its origins in European directives and regulations. Green Deal initiatives, such as the IED, CSRD and CS3D directives, are causing European SMEs in particular to suffocate in paperwork – but without providing the necessary support for implementation. In particular, reporting obligations with up to 1,000 individual aspects are pushing companies to their limits.
The new EU Commission is now set to change this: the topics of competitiveness and reducing bureaucracy are new political priorities. This includes many initiatives that also sound good for SMEs: a Vice-President of the EU Commission for implementation, simplification – in short: cutting red tape. Annual progress reports from all Commissioners on this topic are planned, as well as competition and SME checks. There is also to be a new definition category for small mid-cap companies – an issue that WVMetalle is particularly committed to because the current SME protection is all too often undermined through the back door. It remains to be seen whether the EU institutions will bring about tangible relief.
But it is not only the European level that has some catching up to do in this respect. Federal and state policy as well as regional policy and administration must also ease the burden on industrial SMEs. Many companies in this country see bureaucracy as one of the biggest obstacles to their development.
It is therefore important that politicians put a stop to the increasing regulatory frenzy and instead reduce regulations. There are plenty of proposals for this: one of the most important in relation to the EU is the consistent 1:1 implementation of regulations at the national level. Germany’s ambitious practice of “let’s just take it up a notch” must come to an end.
At this point, we would like to reiterate von der Leyen’s proposal for annual reporting by all Commissioners on progress in reducing bureaucracy. Consistent input from our federal ministries is urgently required.
The bureaucratic madness is also spreading at the state and municipal levels. Take construction projects, for example: In Berlin, the average wait for a building permit is 30 months. A builder in Bavaria needs 73 different forms and has to contact 14 authorities to build a detached house. Not to mention industrial projects.
But bureaucracy is also increasingly taking place in the own sector. As a customer, it undoubtedly makes sense to agree certain standards with your own suppliers. These are described in the relevant standards. With the so-called “High Level Structure,” the authors of these standards have attempted to create an alignment between the systems, for example for quality, the environment or occupational safety.
Additional standard requirements, however, are difficult, for example for medical technology, aircraft construction and the automotive industry. Different standards for each raw material may seem sensible at first, but in practice the differences between the individual commodities are marginal. However, the difference is all the greater in terms of the effort required on the part of the suppliers, who then have to maintain, audit and train different systems. In addition, there are extensive audits with assessments, action plans and, in the worst case, sanctions.
Auditors often act like large companies in spirit and project the desire for similar structures onto small businesses. As if that were not enough, there are now also demands for data security and sustainability. The familiar pattern of “standard plus own further requirements” continues.
Is this still proportionate, let alone expedient? It is no longer possible for suppliers to make sense of all these regulations. This is because the economic performance of the German industry is declining in international comparison. And we have not been patent world champions for a long time. More and more companies are moving away or closing down completely. Is it possible to turn the tide again? Yes, but what we need is less restrictive regulation, more freedom and more time for our engineers.
Gerd Röders is President of the German Metals Federation