EU AI Act and Algorithmic Governance: The Regulatory Architecture of a New Technological Order

1. AI Risk: Mathematical Foundations and Classification

Before analysing the regulatory framework, it is essential to understand the mathematical structure underlying the concept of algorithmic risk. The EU AI Act does not formally define risk in quantitative terms, but its pyramid classification — unacceptable, high, limited, minimal — is conceptually consistent with risk management models developed in statistics and systems engineering.

1.1 Entropy, Uncertainty and Informational Risk

In information theory, Shannon entropy H measures the uncertainty of a probabilistic system:

H(X) = − Σᵢ p(xᵢ) · log₂ p(xᵢ)

A high-risk AI system is, by definition, a system operating in domains where the uncertainty of its output — measured on the entropy of the predictive distribution — produces significant material consequences for individuals or communities. The Regulation translates this technical concept into a legal category: Annex III lists the sectors where algorithmic uncertainty is intolerable without adequate human supervision.

1.2 Loss Function, Bias and Legal Liability

Training a machine learning model minimises a loss function L with respect to the model's parameters θ:

θ* = argminθ E[L(f(x; θ), y)]

This optimisation occurs on a training dataset that, if statistically imbalanced, produces a model with systematic bias: the distribution of residuals is not random but correlated with protected attributes (sex, ethnicity, age). From a legal standpoint, a documented algorithmic bias in the decision-making process of a high-risk system constitutes a violation of the non-discrimination principle enshrined in art. 10(2) of the EU AI Act — which requires training data to be "free from errors and complete in relation to the intended purpose".

2. The International Regulatory Framework

The regulation of AI is today a genuinely global phenomenon, with profoundly different approaches reflecting diverse governance philosophies.

2.1 United States: Executive Order 14110 and NIST AI RMF

On 30 October 2023, President Biden signed the Executive Order on Safe, Secure, and Trustworthy AI (EO 14110), requiring providers of "dual use foundation model" AI systems to notify the federal government of red team test results and training parameters, invoking the Defense Production Act.

In parallel, the National Institute of Standards and Technology (NIST) published the AI Risk Management Framework (AI RMF 1.0), a voluntary framework articulated in four functions: Govern, Map, Measure, Manage. Unlike the European approach based on binding obligations, the US model favours industrial self-regulation — except for regulated sectors (health, finance, energy).

2.2 China: Sectoral and Algorithmic Regulation

China has adopted a sectoral approach: the Interim Measures on the Administration of Generative AI Services (July 2023) specifically regulate GPT-type models, requiring registration with the CAC (Cyberspace Administration of China), prior security assessment, labelling of synthetic content, and prohibition of content threatening national unity. The framework is integrated by earlier measures on recommendation algorithms (2022) and deepfakes (2022).

2.3 United Kingdom: Principles-Based Approach

Post-Brexit, the UK chose an anti-fragmentation strategy: no sector-specific AI legislation, but five cross-cutting principles (safety, transparency, fairness, accountability, contestability) entrusted to existing sector regulators (FCA, CMA, ICO, Ofcom). The AI Safety Institute, inaugurated in November 2023, is the world's first government body dedicated to the safety of frontier models.

2.4 UNESCO and OECD: Global Soft Law

The UNESCO Recommendation on the Ethics of AI (November 2021, 193 Member States) constitutes the principal global soft law instrument: it defines eleven core values (respect for human rights, welfare, inclusivity, transparency, accountability, environmental sustainability, privacy, multi-stakeholder governance, good governance, participation) and forty policy action areas. It is non-binding, but forms the reference basis for national legislations, including the EU AI Act.

The OECD AI Principles (2019, updated 2024), adopted by 46 countries, directly influenced the definition of "AI system" in the EU AI Act.

3. Regulation (EU) 2024/1689 — EU AI Act

Approved by the European Parliament on 13 March 2024 and published in the Official Journal of the EU on 12 July 2024, Regulation (EU) 2024/1689 entered into force on 1 August 2024, with progressive application: prohibited systems from 2 February 2025; general-purpose AI systems from 2 August 2025; high-risk systems from 2 August 2026.

3.1 Risk Architecture: The Regulatory Pyramid

The EU AI Act adopts a risk pyramid regulatory structure, inspired by the European product safety approach but adapted to the specifics of algorithmic systems:

3.2 Prohibited Systems (Art. 5)

The absolute prohibition — applicable from 2 February 2025 — targets the AI practices most harmful to fundamental rights. Among prohibited systems:

• Social scoring systems by public authorities assessing the conduct of natural persons to penalise them in contexts unrelated to those in which the data were collected;
• Subliminal manipulation systems acting below the threshold of individual awareness to distort behaviour in a prejudicial manner;
• Real-time biometric recognition in public spaces by law enforcement authorities (with strict exceptions for terrorism, missing minors, identification of perpetrators of serious crimes);
• Biometric classification systems inferring protected characteristics (political opinions, sexual orientation, ethnicity, religion);
• Individual predictive policing systems based solely on profiling.

3.3 High-Risk Systems: Compliance Obligations

High-risk systems are listed in Annex III (seven categories, from biometric identification to education, employment, essential public services, law enforcement, migration, justice). For these, the Regulation imposes a complete system of ex ante conformity assessment:

The risk management system under art. 9 is a cyclical process inspired by ISO/IEC 31000 and requires: identification and analysis of known and reasonably foreseeable risks; estimation and evaluation of risks for each use scenario and reasonably foreseeable misuse; adoption of adequate risk management measures; post-market monitoring.

3.4 Transparency and Explainability: The Most Challenging Technical Requirement

Art. 13 of the EU AI Act requires that high-risk systems be designed to ensure transparency "sufficient to enable deployers to interpret the output of the system and use it appropriately". Art. 14 requires systems to permit effective human oversight, including the ability to "correctly understand the relevant capacities and limitations" of the system.

These requirements translate, in technical practice, into the implicit obligation to adopt explainable AI (XAI) methodologies. The most widely used techniques are:

3.5 Institutional Governance and Sanctions

The EU AI Act establishes a multi-level governance ecosystem: the AI Office of the European Commission supervises general-purpose AI (GPAI) models with training parameters exceeding 10²⁵ FLOPs; national competent authorities (designated by Member States by August 2025) supervise application in specific uses; the Advisory Forum and European AI Board (comprising representatives of national authorities) ensure coordination.

4. The Italian Regulatory Framework: L. 66/2024

Italy responded to the EU AI Act with Law of 9 August 2024, no. 66 (Provisions and delegation to the Government on artificial intelligence), published in the Official Journal on 9 August 2024, in force from 24 August 2024. This is a framework law that:

• Establishes fundamental principles for the development and use of AI in compliance with fundamental rights, transparency and non-discrimination (art. 1);
• Delegates the Government to enact legislative decrees adapting to EU law within 12 months;
• Introduces specific provisions for public administration, the judiciary, the medical sector and journalism: magistrates may not use AI systems to issue jurisdictional measures; doctors retain clinical responsibility even when assisted by diagnostic AI;
• Regulates copyright for works generated with AI support: absent recognition of human creative contribution, the work falls into the public domain;
• Designates the National Cybersecurity Agency (ACN) and AgID as national competent authorities pending the formal designation provided for by the EU AI Act;
• Entrusts AGCOM with oversight of compliance with transparency obligations for generative AI systems in media and electronic communications.

5. Algorithmic Governance: The Technical Dimension

Compliance with the EU AI Act is not a documentary exercise: it requires the understanding and implementation of specific technical methods in software engineering and machine learning.

5.1 Explainability: SHAP, LIME and Beyond

The two techniques described in §1 — SHAP and LIME — cover 70-80% of practical explainability cases required by the EU AI Act. For deep neural networks (DNN), saliency mapping techniques (Grad-CAM for CNNs; Attention Visualisation for Transformers) allow visualisation of the input regions that most influenced the output. These visualisations can be produced and attached to the technical documentation required by art. 11 of the Regulation.

5.2 Bias Detection and Mitigation

The algorithmic bias audit process consists of three phases: data audit (analysis of dataset distribution for protected attributes using statistical methods: χ² test, Kolmogorov-Smirnov, t-test on sub-samples); model audit (calculation of fairness metrics: equalized odds, demographic parity, individual fairness); mitigation (re-weighting of samples during training, adversarial debiasing, post-processing of predictions through group calibration).

5.3 Adversarial Robustness and Cybersecurity

Art. 15(1) of the EU AI Act requires that high-risk systems achieve "adequate levels of accuracy, robustness and cybersecurity". Adversarial robustness — resistance to adversarial examples, i.e., inputs specifically modified to deceive the model — is evaluated through standardised adversarial attack benchmarks (FGSM, PGD, AutoAttack). Defence methodologies include adversarial training, input smoothing, and certifiable defences based on convexification of the parameter space. IEEE Std 1012 (IEEE, 2022) provides the verification and validation framework applicable to safety-critical AI systems.

6. Implications for Legal Counsel

The EU AI Act introduces a new category of professional liability intersecting law, engineering and statistics. Legal counsel assisting companies in achieving Regulation compliance must be able to:

1. Correctly classify the client's AI system in the risk pyramid, verifying the applicability of Annexes I and III — an operation requiring technical understanding of the system's functioning;
2. Structure the risk management system under art. 9 so that it is genuinely operational and not merely documentary: this requires drafting technical risk identification procedures, not just corporate policies;
3. Assess the adequacy of technical documentation under art. 11: system specifications, datasets used, performance metrics, robustness tests, bias audit — documentation that must be readable and verifiable by a technical supervisory authority;
4. Manage contracts in the AI supply chain: the EU AI Act distinguishes the provider (who develops or places the AI system on the market) from the deployer (who uses it in a specific context). Responsibilities differ, and their contractual allocation requires specific indemnification, audit, incident notification and post-market update clauses;
5. Preside over the intersection with the GDPR: many high-risk AI systems process personal data — the DPIA (Data Protection Impact Assessment) can be integrated with the fundamental rights impact assessment (FRIA) introduced by art. 27 of the EU AI Act for deployers of high-risk systems affecting natural persons.

Conclusions

The EU AI Act marks the definitive entry of law into the internal architecture of intelligent systems. It is no longer sufficient to assess the legal consequences of an AI system's output: the Regulation requires oversight of the development, training, validation and monitoring process of the model itself. This demands genuine technical competence from legal counsel — not a superficial knowledge of AI vocabulary, but the ability to engage with data scientists, software engineers and product managers on topics such as bias detection, adversarial robustness, explainability and data governance.

The parallel with the GDPR of 2018 is instructive: professionals who truly understood the regulation — not just the text but its architectural implications for information systems — built lasting market positions. The EU AI Act offers the same opportunity. On a much larger scale.

Sources and References

1. EU AI Act — Regulation (EU) 2024/1689: eur-lex.europa.eu
2. EU AI Office — Regulatory framework on AI: digital-strategy.ec.europa.eu
3. NIST AI RMF 1.0 & Executive Order 14110: nist.gov/artificial-intelligence
4. UNESCO — Recommendation on the Ethics of AI (2021): unesdoc.unesco.org
5. OECD — AI Principles (2019, updated 2024): oecd.ai/en/ai-principles
6. Law of 9 August 2024, no. 66 (Italian AI Law): gazzettaufficiale.it
7. AGCOM: agcom.it
8. IEEE Std 1012-2016/2022 — System, Software, and Hardware Verification and Validation: standards.ieee.org
9. SHAP — Lundberg, S. & Lee, S.-I. (2017). "A Unified Approach to Interpreting Model Predictions". NeurIPS 2017: arxiv.org/abs/1705.07874
10. LIME — Ribeiro, M.T., Singh, S., & Guestrin, C. (2016). "'Why Should I Trust You?': Explaining the Predictions of Any Classifier". KDD 2016: arxiv.org/abs/1602.04938
11. Shannon, C.E. (1948). "A Mathematical Theory of Communication". Bell System Technical Journal, 27(3), 379–423.