Compliance Cards: Automated EU AI Act Compliance Analyses amidst a Complex AI Supply Chain

As the AI supply chain grows more complex, AI projects —whether they comprise AI systems, general-purpose AI models, or anything else— are increasingly likely to incorporate multiple internally- or externally-sourced components such as datasets and (other) models. In such cases, determining whether or not the aggregate AI project complies with the EU AI Act requires a multi-step process in which compliance-related information about both the project and those components is: (1) gathered, potentially from multiple arms-length sources; (2) harmonized, if necessary; (3) inputted into an analysis that looks across all of it to render a compliance prediction. Because this process is so complex and time-consuming, it threatens to overburden the limited compliance resources of the AI providers (i.e., developers) who bear much of the responsibility for complying with the Act. It also renders rapid or real-time compliance analyses infeasible in many AI development scenarios where they would be beneficial to providers. To address these shortcomings, we introduce a complete system for automating provider-side AI Act compliance analyses amidst a complex AI supply chain. This system has two key elements. First is an interlocking set of computational, multi-stakeholder transparency artifacts that capture AI Act-specific metadata about both: (1) the provider’s AI project; and (2) the datasets and models it incorporates as components. Second is an algorithm that operates across all those artifacts to render a real-time prediction about whether or not the aggregate AI project complies with the AI Act. All told, this system promises to dramatically facilitate and democratize provider-side AI Act compliance analyses (and, perhaps by extension, provider-side AI Act compliance).