Dave Lewis

Topics: AI, compliance, natural language, evaluation, plain language Technologies: python, LLM APIs, prompt design, evaluation methods Tldr; build and rigorously evaluate the AI-assisted checks in a civic compliance checker, for questions like ‘is this privacy policy actually written in plain language’, where a pattern match cannot give the answer. Motivation: Some compliance questions are irreducibly … Read more

Topics: web development, data visualisation, human-computer interaction, transparency Technologies: javascript, web development, python (for the underlying checker output) Tldr; take the raw output of a compliance checker and turn it into an institutional report that the organisation being assessed can actually read, understand, and act on. Motivation: A scan that produces a wall of pass … Read more

Topics: privacy, tracking, consent, headless browsers, GDPR Technologies: python (Playwright or Puppeteer), network traffic analysis, javascript Tldr; build the part of a compliance checker that watches what a website actually does during a visit, and use it to detect behavioural tracking and consent theatre on sites that are meant to serve the public. Motivation: A … Read more

Topics: web compliance, testing, public infrastructure, evaluation, semantic web Technologies: python (headless browsers, e.g. Playwright), javascript, RDF / linked data (optional) Tldr; take a single civic standard, build it into a rigorous automated test suite that scans real public-sector websites, and measure how often it gets the answer right. Motivation: Public-serving organisations will be expected … Read more

The EU AI Act [1] requires providers of AI systems to determine whether their AI system is prohibited, high-risk, limited-risk, or minimal-risk under the Act. To support this, the European Commission has published guidelines for prohibited AI [2] and high-risk systems (draft)[3] providing example use cases for each risk category. Although these guidelines are helpful, … Read more

The EU’s AI Act brings a range of A- based products into the scope of EU product regulation. It places a set of risk management and monitoring requirements that expand EU health and safety and consumer protection legislation by expanding the scope to protect Fundamental Rights [1]. A major challenge is the lack of an … Read more

Organisations aiming to bring AI-based products onto the European Single Market must assess risks and compliance issues against a range of regulatory acts. While some legislation is supported by technical standards or codes of practice, organsiations increasingly have to track requirements from multiple  digital regulatory acts, e.g. the AI Act, GDPR, the Data Act, the … Read more

Publicly funded research and innovation (R&I) projects and international standards development are two forms of collaborative technical activities that aim to provide benefits to markets and society, and yet coordination between them is often poor. Such coordination is complicated as both R&I projects and standards development projects both operate over fixed lifecycles, such that for … Read more

The  EU AI Act calls for risk assessment to be conducted for AI systems in specific high risk applications and separately for systemic risks introduced by general-purpose AI (GPAI) systems (i.e. systems corresponding to the largest language models and their use as generative foundation models). The AI Act does not however provide guidance on how … Read more