AI value chain

The AI value chain, a concept operationalized by the OECD and central to the EU AI Act (Regulation (EU) 2024/1689), represents the entire socio-technical lifecycle of an AI system. It extends beyond technical stages like data acquisition and model development to define the legal roles and obligations of distinct economic actors. These actors include providers (who develop the AI), deployers (who use it professionally), importers, and distributors. Unlike a simple 'AI lifecycle' (e.g., ISO/IEC 23894), the value chain concept legally assigns responsibilities. Articles 25-29 of the EU AI Act detail obligations for each actor, such as conducting conformity assessments (providers) or ensuring human oversight (deployers). This framework enables targeted risk management by allocating accountability to the actor best positioned to mitigate risks at each stage, ensuring a clear chain of responsibility.

Practical application involves three key steps: 1. **Role Identification & Responsibility Mapping**: Enterprises must first determine their role (e.g., provider, deployer) under the EU AI Act's definitions. They then map regulatory obligations, such as risk management system implementation and technical documentation, to internal departments. 2. **Supply Chain Due Diligence**: Deployers must conduct rigorous due diligence on AI providers, contractually requiring them to supply technical documentation and conformity declarations as specified in the regulation. For example, a global manufacturer in Taiwan would require its German AI vendor to provide full transparency on training data and testing protocols. 3. **Post-Market Monitoring**: Establish robust systems to track AI performance and report any 'serious incidents' to authorities within the mandated timeframe (e.g., 15 days under the EU AI Act, Article 73). Proper implementation can increase compliance rates to over 95% and ensure audit-readiness with a clear accountability trail.

Taiwanese enterprises face three primary challenges: 1. **Regulatory Ambiguity**: Many firms are unaware of the EU AI Act's extraterritorial scope, mistakenly believing it only applies to EU-based companies. The regulation applies if the AI's output is used within the EU. 2. **Supply Chain Opacity**: Companies acting as 'deployers' often struggle to obtain the necessary technical documentation and compliance evidence from their upstream AI 'providers,' especially those outside the EU, shifting the compliance burden onto them. 3. **Resource Constraints**: Implementing a compliant AI Management System (AIMS) aligned with standards like ISO/IEC 42001 requires significant investment in multidisciplinary talent (legal, data science, security) and budget. **Solutions**: Prioritize conducting a regulatory impact assessment, embed AI compliance requirements into supplier contracts, and leverage Governance-as-a-Service (GaaS) models or automated tools to manage costs and bridge talent gaps.

Winners Consulting specializes in AI value chain for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact