Founder's Guide
to AI Policy and
Regulation

It is no surprise that some of the earliest AI enforcement action was on privacy grounds, given the often unintentional inclusion of personal data in among the vast amounts of data often used to train AI tools, as well as the privacy risks in deploying certain AI applications like facial recognition technology. Build your product or service with privacy in mind at both the training and deployment stages:

• Adhere to relevant data protection legislation;
• Minimise the amount of personal data you’re using;
• Anonymise or pseudonymise data where possible;
• Be clear about your data practices to establish trust with end-users, clients and regulators including through a public-facing privacy policy on your website.

Ensure your products are responsible from the get-go. It is much easier to begin with a product that is compliant by design rather than have to reverse-engineer it down the line. Think about how you demonstrate the trustworthiness of the AI you’re building; regulations are likely to tighten; expectations are likely to get more specific.

Ben Lyons Head of Policy and Public Affairs, Darktrace

As a founder, you want to ensure you’re protecting the key intellectual property (IP) your company is built on through relevant agreements, and conversely, avoid using third-party (IP) without clarifying that you have the right to do so. When developing and using AI, the value or provenance of content or information used as training data isn’t always clear, so make sure you have strategies to appraise the value of your ideas, as well as to trace content back to its origin.

AI technologies are only as good as the datasets they are trained and tested on. To avoid discriminatory or otherwise detrimental outcomes for your company or users, you should prioritise time to detect potential biases and monitor areas for improvement. Be clear with customers what your AI tools can and can’t do.

Document your processes. Context-specific scorecards and transparency around model training, data usage, your AI’s outputs and related issues are becoming more common in legislative proposals. If you’re training models, be ready to discuss your dataset and methodology, and how your system reaches specific outcomes — this will likely become a regulatory requirement.

Matt Boulos Head of Policy & Safety, Imbue

Conduct some high-level risk mapping to determine which AI risks might be most relevant to your business. Take time to understand the current AI regulatory landscape and how it may apply to your products and operations - both for internal and external use. Collaborate with legal experts, join industry groups to represent your interests (many are listed in this guide), and actively participate in those policy discussions that are most crucial to your startup’s success. Look into AI regulatory sandboxes to get involved in if you’re operating in a sector or use case where there is some uncertainty. Early and consistent engagement with regulators also presents opportunities to shape future regulations, positioning yourself and your company as a proactive leader in the field.

Startups should consider and monitor regulatory risk, and, as they grow, deploy manpower or capital to address it. They should also actively engage with regulators early on. Regulators are typically just trying to protect consumers from being harmed - an aim that should not conflict with your business. The more the regulator understands about the benefits of your technology, the better.

James Clough CTO and co-founder, RobinAI

Find the right regulatory partner who understands your business positioning and can guide you through the evolving complexity of AI regulation. They should be able to help you navigate and implement solutions in an international context. Industry associations can be helpful if you don't have the time or resources to represent your interests yourself.

Lyline Lim Head of Impact, Photoroom

Work with your team and external counsel where necessary to develop principles and practices that reflect your company values, ensure compliance with the law, and minimise potential liability exposure to customers and third parties. Early investment in compliance infrastructure such as data governance, documentation and ethical review processes, personnel policies and sensible terms of use for customers can save startups significant time and resources in the long run. Continually assess whether your AI tool is functioning in the way you intended it to, and consult with stakeholders impacted by your AI use. Don’t forget to establish clear lines of accountability to identify the people who are responsible (and liable) for ensuring these values are implemented and acted upon.

Startups should proactively incorporate ethical considerations into their AI development process, including fairness, transparency, and accountability. This not only helps with regulatory compliance but also builds trust with users and investors.

Megan Capiak Managing Partner, Foundry Ten

Having frameworks and principles in place is a great starting point, but you still need to make them work in practice. Provide your teams with AI ethics-related training to educate them about the implications of AI systems. This will instil a culture of confidence in the technology and its capabilities, and will help you anticipate issues early. Establish what the gaps are in your and your team’s understanding, your understanding of your customer base’s expectations, and how you plan to address any gaps.

The era of ‘move fast and break things’ is over. Don’t be afraid to invest in AI but challenge yourself on what you plan to do about compliance and educate yourself from the outset. Do your homework now - it will pay off in the long run.

Agata Hidalgo European Affairs Lead, France Digitale