Governments and organizations are making too little progress in recording the algorithm and AI systems they use. As a result, it is often not clear to citizens and customers what and how governments and organizations use AI and algorithms. A complete algorithm registry is the basis for transparency, fundamental rights protection, explainability and accountability in the deployment of algorithms and AI.
The Personal Data Authority (AP), as coordinating regulator of algorithms and AI, is therefore calling for algorithm registration to be made mandatory for government organizations. The AP encourages other industries and sectors to work more intensively on setting up algorithm registries. To help governments and companies get started, the AP is publishing 8 tools in the document Getting Started with Algorithm Registration.
Since early 2023, 1,000 algorithms have been included in the Dutch government's Algorithm Register. The City of Amsterdam and Customs are leading the way in this and, together with a group of other public organizations, are setting a good example.
Yet the AP sees that most government organizations are lacking. More than half of the municipalities have not yet registered algorithms. Of the independent administrative bodies, more than three-quarters have not registered anything at all. Almost all registered algorithms lack a fundamental rights assessment. This has only been done in 5 percent of the cases.
With 1,000 algorithms registered, the pioneering phase is over. To take the next step, therefore, the AP advocates establishing a registration requirement for government organizations.
The AP discusses the state of public algorithm registration in the fifth Report AI & Algorithms Netherlands (RAN), which will be released next week.
In sectors such as housing, transportation, healthcare, education, financial services and many sectors outside of government, there is little visibility into algorithm use. As a result, it is often not clear where and how organizations are using algorithms. On the positive side, however, there is interest. For example, the education field is actively working to establish its own algorithm registries.
Algorithms and AI are being used on an increasingly large scale and offer many opportunities, but also pose risks. Such as discrimination, violation of privacy and cybersecurity issues. Registering algorithms is an important first step in mitigating such risks. Registering algorithms provides proactive insight, enabling both internal and external control.
When registering, it is important to describe not only the purpose of the system, but also other important elements. Such as the training data used, how the algorithm works, what controls are in place and who is responsible for them.
Algorithm registration also enables transparency and accountability to citizens, customers, regulators, public representatives, science, media and others. The AP's tools help organizations address algorithm registration in a low-threshold manner and increase internal awareness.
The AP emphasizes that algorithm registries are intended to make visible which algorithms organizations use when performing their tasks. The purpose of algorithm registries differs in 2 respects from that of the European database for high-risk AI systems, which is part of the European AI Regulation.
First, the European database of AI systems focuses on product supply. Providers must register high-risk AI systems before they are marketed, or put into use. Second, algorithm registries have a broader scope: not all impactful algorithms are (high-risk) AI systems. Consider relatively simple decision algorithms that do not contain AI but are used to award or recover subsidies and benefits.
The AP calls on public and private organizations to actively work on algorithm registration. The document Getting Started with Algorithm Registration offers tools to tackle this. Registration is not a goal in itself. It is the first crucial building block towards responsible, transparent and verifiable algorithm use.
