TFL Vsebine / Revija SIR*IUS

IA Act in internal auditing practice

Številni viri s področja notranje revizije, namenjeni umetni inteligenci, to področje obravnavajo predvsem z vidika razvoja in upravljanja velikih modelov umetne inteligence, čeprav nove modele v praksi razvija le omejeno število organizacij. Večina majhnih in srednje velikih organizacij uporablja že razvite modele ter na njihovi podlagi uvaja informacijske rešitve in druga orodja, ki temeljijo na tehnologijah umetne inteligence. Zato v pričujočem članku obravnavamo štiri načine uporabe tehnologij umetne inteligence, ki so pogosti v takih organizacijah: lokalno uporabo že razvitih modelov, uporabo modelov prek programskega vmesnika, informacijske rešitve z vgrajenimi funkcionalnostmi umetne inteligence ter javno dostopna orodja umetne inteligence. V članku so povzete ključne določbe Akta o umetni inteligenci, pomembne predvsem za organizacije v vlogi uvajalcev sistemov umetne inteligence, ter na tej podlagi oblikovana izhodiščna vprašanja za načrtovanje notranjerevizijskih poslov, ki vključujejo presojo skladnosti z zahtevami Akta o umetni inteligenci in presojo ustreznosti zasnove notranjih kontrol. Namen članka je notranjim revizorjem ponuditi praktično izhodišče za predhodno prepoznavanje tveganj in določanje področij, ki jih je pri posameznem notranjerevizijskem poslu smiselno podrobneje proučiti.

Many sources in the field of internal auditing that address artificial intelligence focus primarily on the development and governance of large AI models, although in practice only a limited number of organizations develop new models themselves. Most small and medium-sized organizations use already developed models and, on that basis, implement information systems and other tools that rely on artificial intelligence technologies. This article therefore examines four forms of AI use commonly encountered in such organizations: local deployment of existing models, use of models through application programming interfaces, information systems with embedded AI functionalities, and publicly available AI tools. The article summarizes key provisions of the AI Act that are particularly relevant to organizations acting as deployers of AI systems and, on that basis, formulates initial questions for planning internal audit engagements that include assessments of compliance with the requirements of the AI Act as well as assessments of the adequacy of the design of internal controls. The purpose of the article is to provide internal auditors with a practical starting point for preliminary risk identification and for determining the areas that warrant more detailed examination in individual internal audit engagements.