Panelist Ryan Carrier

Ryan Carrier

ForHumanity

United States

Ryan Carrier founded ForHumanity after a 25 year career in finance. He launched the nonprofit organization with the goal of using the independent audit of corporate AI systems as a means of mitigating the risk associated with artificial intelligence. As ForHumanity’s executive director and board chair, he is responsible for the of the organization’s day-to-day operations and the overall process of independent auditing. Previously, he owned and operated Nautical Capital, a quantitative hedge fund that used AI algorithms. Before that, he was director of Macquarie Bank’s Investor Products business and was vice president of Standard & Poor’s Index Services business. He has a bachelor’s degree in economics from the University of Michigan.

Voting History

Statement	Response
Organizations will be ready to meet the requirements of the EU AI Act as they phase in over the next 12 months. Strongly disagree	“The requirements of the EU AI Act are extremely dense. For existing high-risk AIs, it requires a substantial amount of backfilling on the Article 10 data management and governance front. The risk management process requires substantial expertise. The issues around ethics are enormous, and there are simply not enough qualified individuals in the world to execute Fundamental Rights Impact Assessments and the remaining 40-plus assessments that ForHumanity has identified as required under the act. This doesn’t even include the integration of quality management, technical documentation, and robust compliance and monitoring programs. The challenge of integration and coordination with top management and oversight bodies is likely to be haphazard and disjointed. A good comparison might be GDPR, where we are nearly six years in and many organizations remain insufficiently compliant, especially in regard to technical and organizational controls. The same will occur with the EU AI Act: Organizations will be insufficiently compliant and allowed to operate, treading the fine line between enforcement and undiscovered noncompliance. CEN-CENELEC standards under JTC 21 won’t be available before 2025 at the earliest. ”
Organizations are sufficiently expanding risk management capabilities to address AI-related risks. Disagree	“The tech industry has not established risk management by design and has a 40-plus-year history to overcome. It is the only major economic sector that remains largely unregulated. As a result, we see little governance, oversight, and accountability in the sector. Individual players pay lip service to the idea of risk management and safety, and they actively operate to subvert measures such as policy and standards (areas where they can do so quietly). Overtly, large tech players have fired entire teams associated with risk management and responsible AI. Lastly, there is a complete unwillingness to engage with civil society and external programs of governance, oversight, and accountability. These organizations determine their own “responsible AI practice,” eschewing global best practices. There is a failure to include diverse input and multi-stakeholder feedback in the risk management process, and the result is limited perspectives on risk identification and a failure to disclose residual risk. Until society sees public disclosures of residual risk associated with AI tools, we will know that companies are not taking risk seriously, because they are making limited efforts to protect against liability.”

Statement

Response

Organizations will be ready to meet the requirements of the EU AI Act as they phase in over the next 12 months. Strongly disagree

“The requirements of the EU AI Act are extremely dense. For existing high-risk AIs, it requires a substantial amount of backfilling on the Article 10 data management and governance front. The risk management process requires substantial expertise. The issues around ethics are enormous, and there are simply not enough qualified individuals in the world to execute Fundamental Rights Impact Assessments and the remaining 40-plus assessments that ForHumanity has identified as required under the act. This doesn’t even include the integration of quality management, technical documentation, and robust compliance and monitoring programs. The challenge of integration and coordination with top management and oversight bodies is likely to be haphazard and disjointed.

A good comparison might be GDPR, where we are nearly six years in and many organizations remain insufficiently compliant, especially in regard to technical and organizational controls. The same will occur with the EU AI Act: Organizations will be insufficiently compliant and allowed to operate, treading the fine line between enforcement and undiscovered noncompliance. CEN-CENELEC standards under JTC 21 won’t be available before 2025 at the earliest. ”

Organizations are sufficiently expanding risk management capabilities to address AI-related risks. Disagree

“The tech industry has not established risk management by design and has a 40-plus-year history to overcome. It is the only major economic sector that remains largely unregulated. As a result, we see little governance, oversight, and accountability in the sector. Individual players pay lip service to the idea of risk management and safety, and they actively operate to subvert measures such as policy and standards (areas where they can do so quietly). Overtly, large tech players have fired entire teams associated with risk management and responsible AI. Lastly, there is a complete unwillingness to engage with civil society and external programs of governance, oversight, and accountability. These organizations determine their own “responsible AI practice,” eschewing global best practices. There is a failure to include diverse input and multi-stakeholder feedback in the risk management process, and the result is limited perspectives on risk identification and a failure to disclose residual risk. Until society sees public disclosures of residual risk associated with AI tools, we will know that companies are not taking risk seriously, because they are making limited efforts to protect against liability.”