AI in Manu­fac­tu­ring and Sup­p­ly Chains: A Trans­at­lan­tic Per­spec­ti­ve on Legal Risks

Arti­fi­ci­al intel­li­gence is incre­asing­ly beco­ming part of com­pa­nies ope­ra­tio­nal pro­ces­ses. From pro­duc­tion plan­ning, pro­cu­re­ment and logi­stics to qua­li­ty manage­ment and pre­dic­ti­ve main­ten­an­ce, new appli­ca­ti­ons also bring gro­wing legal and orga­niza­tio­nal requirements.

In the pod­cast “The Trans­at­lan­tic Per­spec­ti­ve”, Dani­el Wuhr­mann dis­cus­ses with Vanes­sa Mil­ler and Ray­mond J. McV­eigh of Foley & Lard­ner LLP which legal risks com­pa­nies should con­sider when using AI in manu­fac­tu­ring and sup­p­ly chains. The dis­cus­sion high­lights the dif­fe­rent regu­la­to­ry approa­ches taken by the Euro­pean Uni­on and the United States.

Dif­fe­rent regu­la­to­ry approa­ches in the EU and the US

From a Euro­pean per­spec­ti­ve, a key start­ing point is deter­mi­ning how a spe­ci­fic AI sys­tem should be clas­si­fied and used:

  • What role does the com­pa­ny have in rela­ti­on to the AI system?
  • What is the sys­tem used for?
  • What data does it process?
  • Does it have an impact on safe­ty or legal­ly pro­tec­ted rights?

Depen­ding on the appli­ca­ti­on, dif­fe­rent regu­la­to­ry requi­re­ments may app­ly, par­ti­cu­lar­ly under the EU AI Act, pro­duct safe­ty regu­la­ti­ons, data pro­tec­tion law, and cyber­se­cu­ri­ty requirements.

Con­trac­tu­al arran­ge­ments also play a cen­tral role. Stan­dard con­tracts for soft­ware or AI solu­ti­ons are often insuf­fi­ci­ent for indus­tri­al appli­ca­ti­ons. Com­pa­nies should con­sider, among other things, per­for­mance requi­re­ments, respon­si­bi­li­ties, data access and usa­ge rights, as well as lia­bi­li­ty. Docu­men­ta­ti­on requi­re­ments and pro­ces­ses for mana­ging chan­ges and updates to AI sys­tems also need to be addressed.

The US takes a dif­fe­rent regu­la­to­ry approach. While com­pa­nies ope­ra­ting in the EU must par­ti­cu­lar­ly con­sider the requi­re­ments of the EU AI Act and other appli­ca­ble regu­la­to­ry frame­works, AI-related risks in the United Sta­tes have so far been addres­sed to a grea­ter ext­ent through exis­ting legal prin­ci­ples, inclu­ding con­tract law, lia­bi­li­ty, and occu­pa­tio­nal safe­ty, as well as through risk manage­ment and inter­nal cor­po­ra­te governance.

Howe­ver, this does not mean that com­pa­nies ope­ra­ting in the US have less need to take action. The pod­cast recom­mends, among other things, sys­te­ma­ti­cal­ly iden­ti­fy­ing the AI sys­tems in use and the data they can access, clas­si­fy­ing indi­vi­du­al use cases accor­ding to their risk, and estab­li­shing clear inter­nal respon­si­bi­li­ties. This should also include rules for human over­sight, appr­ovals, and inci­dent manage­ment. When pro­cu­ring AI solu­ti­ons, per­for­mance requi­re­ments, data rights, and lia­bi­li­ty pro­vi­si­ons should also be tail­o­red to the spe­ci­fic indus­tri­al application.

Con­clu­si­on

For both the Euro­pean and US mar­kets, main­tai­ning a sys­te­ma­tic over­view of the AI sys­tems in use is essen­ti­al. Com­pa­nies should iden­ti­fy which sys­tems and pro­vi­ders they use, what data the­se appli­ca­ti­ons can access, and what ope­ra­tio­nal con­se­quen­ces could result from incor­rect or unin­ten­ded decisions.

Par­ti­cu­lar atten­ti­on should be paid to appli­ca­ti­ons with a high degree of auto­no­my, for exam­p­le whe­re an AI sys­tem can inde­pendent­ly place orders or influence manu­fac­tu­ring pro­ces­ses. For the­se use cases, com­pa­nies should cle­ar­ly defi­ne and docu­ment respon­si­bi­li­ties, the system’s decision-making aut­ho­ri­ty and limi­ta­ti­ons, as well as appro­pria­te human oversight.

For inter­na­tio­nal­ly ope­ra­ting com­pa­nies, this means that AI gover­nan­ce should not be approa­ched sepa­ra­te­ly for indi­vi­du­al mar­kets. Com­pa­nies using AI sys­tems in Euro­pe and the United Sta­tes, or offe­ring AI solu­ti­ons in tho­se mar­kets, need to account for dif­fe­rent regu­la­to­ry frame­works. This includes the clas­si­fi­ca­ti­on and risk assess­ment of AI sys­tems as well as appro­pria­te pro­ces­ses for docu­men­ta­ti­on, allo­ca­ti­on of respon­si­bi­li­ties, human over­sight, and ongo­ing moni­to­ring and review.

Com­pa­nies ope­ra­ting in both mar­kets should the­r­e­fo­re inte­gra­te the­se requi­re­ments into their struc­tures and pro­ces­ses at an ear­ly stage. This helps ensu­re that the use of AI is not only com­pli­ant with appli­ca­ble regu­la­to­ry requi­re­ments but also mana­ged in a trans­pa­rent, struc­tu­red, and robust manner.

How do you like this for­mat, and which topics would you like us to cover in future epi­so­des? We wel­co­me your feed­back and suggestions.

back

Stay up-to-date

We use your email address exclusively for sending our newsletter. You have the right to revoke your consent at any time with effect for the future. For further information, please refer to our privacy policy.