ML solutions that cut costs and speed up operations

Introduction: why ML and OSS are a heightened risk area

ML in the view of regulators (opacity, scale, risk of discrimination). Open-source: responsibility for use lies with the deployer. Examples of cases/fines in an ML context (very brief).

Poll: “Do you use open-source models or datasets in production?

ML under the AI Act: classification and roles

An ML system may be considered high-risk: credit scoring, HR screening, biometrics, critical services, etc. AI provider and deployer.

From the AI Act perspective, what matters in the ML pipeline: training, fine-tuning, inference, monitoring.

Open-source models and data: licences and restrictions

Open-source and who owns the rights to the final result; special AI licences (such as OpenRAIL); custom dataset licences (research-only, prohibition of commercial use, geo-restrictions, etc.).

Distinction: the model licence ≠ the dataset licence. Risks: using data/model outside the licence terms, lack of attribution, use of a “dirty” dataset.

How to work with licences in practice

Team tasks: maintain a register of the models/libraries/datasets used; record licences and restrictions; agree problematic licences (GPL, domain restrictions) with lawyers before implementation. The PM’s role: licensing and source checks in the Definition of Done for ML features.

Mini example: what a table may look like — “Model/dataset → licence → permitted use cases → owner”.

GDPR for ML: data, categories and DPIA

What data you use for training and inference: personal, pseudonymised, aggregated, special category (health, biometrics, etc.), restrictions, anonymisation requirements. DPIA as a tool to describe the ML pipeline and assess risks to data subjects’ rights.

ML and OSS documentation as protection: what you need to have

Minimum set: purposes, data, restrictions, prohibited-use areas; a dataset card (origin/provenance, composition, licence, potential bias); a data flow description; a human-in-the-loop description (when mandatory manual review is required).

Q&A and “tomorrow’s steps”

Answers to questions: “Can we fine-tune a model on users’ data without separate consent?”, “What should we do if the dataset licence is unclear?”. Practical steps: 1) compile a list of all ML models and datasets in the company; 2) create a simple licence register; 3) pick one production model and prepare a model card and a data flow indicating where open-source is used