Thomas Doms, Principal Consultant & Head of New Digital Business Development at TÜV AUSTRIA provides a deeper insight on AI certification processes in an interview with x-technik.
Mr Doms, the year is 2022. What kind of acceptance has AI gained in everyday working life?
AI is nothing new these days, it has actually been around for decades. However, what has strictly changed in the last few years is the fact that we are basically "democratising" this technology. This means that AI can no longer be used exclusively on supercomputers somewhere, but also in everyday life - professionally and privately. AI is thus more widely applicable.
Data sets shape AI. The better these are, the better the result. Now the question is where companies should get the correct data needed for AI. Not every data set is helpful.
It is true that for good AI systems, a lot of training data still has to be made available, which then in turn recognise patterns etc. and constantly learn. The extent to which an AI can ultimately differentiate and decide depends on the data know-how provided.
It is therefore not sufficient that I have, for example, 20,000 test reports of a technical system in paper form. These data sets are in no way supportive of my concerns. What I need as a company is the extracted information to train the model. This has to be solved internally at the companies.
How good are companies at this process?
Many companies find it difficult to provide information in a structured and consistent way for training. Therefore, it is important to understand that you need a high number of good quality data sets to get reliable results.
If you want to use AI sensibly and it should also pay off monetarily, you also have to ask yourself what it would be suitable for within your own structures. Questions then arise such as: Do I want to optimise something internally, and if so, what? Do I want to work more efficiently in my administrative processes? Can AI support me in my production processes? Where can I reduce maintenance costs via predictive maintenance? Without a clear definition of my goals, it is difficult to get an answer.
TÜV AUSTRIA is working on certification methods to support manufacturers in developing safe, reliable and high-quality machine learning models and to offer users a seal of quality for trustworthy AI systems. What is it about in detail?
With our certification, we want to make a reliable statement about how robust and reliable the respective AI in the application works in operation. Basically, it is a seal of quality that the company to be certified receives and thereby also secures itself to a certain extent on the market. At the same time, this process can also mean that due to numerous updates of the software application(s), which are common, a renewed check is necessary - on the one hand through annual monitoring audits, and on the other hand possibly also during the year in the case of larger updates with other training data or function extensions.
This means that certifications for AI would ultimately be "never completed"?
AI systems need to be audited regularly and often. Because of this, we also work intensively with research and scientific institutions such as the Institute for Machine Learning at Johannes Kepler University Linz (JKU) on appropriate certification methods to support manufacturers in developing safe, reliable and high-quality machine learning models.
Your are supported in this by Prof. Sepp Hochreiter, a renowned scientist and pioneer of modern artificial intelligence. He sees AI as pointing the way to the future. What stage are you at within the aforementioned collaboration?
The first stage of success has been reached. So-called supervised learning applications in the low to medium risk range are already being certified today. We are already carrying out the first certification projects, whereby the applications are mainly in the industrial environment but also in the consumer sector.
In the next phases of the development cooperation, the current approaches will be expanded in order to be able to certify more safety-critical applications based on a broader spectrum of machine learning methods. This means that we are also examining, in cooperation with the JKU, whether certifications could be carried out during ongoing operation in the future, so that no plant stops would be necessary.
Let's take another look at the plants to be certified. What does a TÜV AUSTRIA certification process mean for an applicator in concrete terms? Would you have continuous insight into its internal processes and data? Does it become transparent as a company?
If the data distribution changes and the current machine learning model does not function properly, a new model must be trained. Recertification is then necessary for this new model. There are no alternatives here. This is common with software products, that they evolve. As TÜV AUSTRIA, we will be testing far away from fixed testing intervals in the future; continuous monitoring will then be a prerequisite.
How high is the acceptance for this process?
It is certainly a challenge, just like disclosing the training data set, because insights into possible company internals could thus be granted - that is true. However, we as TÜV AUSTRIA are an independent third party that handles this data and information confidentially and in trust.
However, even if companies would prefer to operate without insight, AI offers enormous opportunities and changes work processes in a positive sense. The fact that certifications also require certain "new" prerequisites is part of the development of AI. We are therefore constantly considering, together with the JKU, what further, optimised approaches there might be here.
When did the cooperation with JKU start?
The collaboration began 1.5 years ago as part of a doctoral thesis and has now been expanded. With AI, we need science to continuously incorporate the state of the art.
At the moment, so-called unsupervised learning models are the goal. This is a type of machine learning that independently finds patterns and correlations in the data. We would like to use it to gain more knowledge and insights more quickly, again in the context of dissertations at JKU.
Now time is pressing as the EU has announced that it will push for the regulation of AI. AI-critical systems are to be defined here, and in a relatively short time. To what extent does this influence certification methods?
In two years, we will urgently need test bases in this context, because the EU's decision affects about 15% of applications. However, there is an "advantage", if you want to put it that way, for industrial companies. In the normal industrial production process, the ethical components that otherwise have to be taken into account in AI applications are omitted. Most of this is covered by functional safety.
How does a certification process work?
If you want to have an application in your company in which AI is used and which is to be tested, we first send out a catalogue of requirements in which our test criteria are listed. General evidence, the functional design of the AI process and also data protection aspects are taken into account. At the beginning of the audit process, we then hold a workshop in which we define the scope together with the AI user - from the aspect of "should" to "can". It would also be possible in the certification process to define the target, which expresses the goodness of the AI application in a percentage value.
Are there companies that fail the certification access requirements due to a lack of necessary documentation?
There is a small percentage that realises early on that they are still missing essential basic requirements and that these processes need to be worked on first. In some cases, more transparency needs to be created in the development process, and often proof is missing. It can take up to a few months to submit the documents or rectify the open points, and only then do the companies enter the audit with us.
Do companies also abandon a certification process?
There are companies that realise that they are not yet ready for a certification process. In addition, it has to be said that there are - albeit few - companies that do not pass the audit, at least in the first run. After all, we are talking about over 200 requirements in our TÜV AUSTRIA audit catalogue that have to be fulfilled.
In summary, one could state: There is no way around AI certifications anymore.
The pressure is increasing, also in view of the fact that AI development is taking place at supplier companies, which are often smaller. In some cases, we are also talking about start-ups that supply AI developments. The buyers of these AI applications naturally want to make sure in advance that the application is certified and delivers quality. A similar procedure has been in place for a long time for mechanical products, but now virtual ones are following suit.
And the latest draft of the standard for the functional safety of machines, which grants type approval to machines, already stipulates that machines that already have an AI module integrated must also provide for a check of these AI modules. This means that a check is already required by the standards. AI is part of everyday working life.
Thank you very much for the interview!
About TÜV AUSTRIA certifications
As part of the certification, TÜV AUSTRIA examines machine learning models and their development process in detail in several test dimensions. Not only is the actual function and reliability of the trained models examined, but also the security of the software and whether it was developed appropriately for the requirements of its field of application, as well as ethical aspects and data protection. These certifications are currently unique on the market.