Information flow modeling improves role-based AI Act compliance assessments
Transparent Information Flow Modeling for Role-Aware AI Act Assessment
Artificial Intelligence
Summary
The European Union's AI Act aims to control risky AI systems by ensuring transparency and clear responsibilities. The authors show that by modeling how information and decisions move through both AI and people, they can better understand and assess the risk and accountability of AI in real workplaces. They tested this approach on a real recruitment tool used by a government agency and found it helps reveal where information risks may hide and whether the system is used as intended. This modeling method goes beyond simple checklists by connecting technical details with social and organizational factors.
What this means in practice
- •For compliance officers: Use information flow modeling to evaluate AI systems' role-specific compliance with regulations in complex organizational contexts.
- •For public sector it teams: Assess recruitment AI tools by modeling how information travels between system components and users to identify risks and improve transparency.
Authors
Mattias Brännström, Themis Dimitra Xanthopoulou, Lili Jiang
Abstract
The European Union's Artificial Intelligence Act introduces a structured framework for governing high-risk AI systems, emphasizing transparency, risk management, and role-specific accountability. However, current assessment practices often rely on monolithic system views or disconnected checklists, limiting their ability to capture the socio-technical complexity of real-world deployments. We explore the use of the Information Flow Methodology (IFM), a modeling-based approach to AI Act compliance assessment. IFM represents decision systems -- whether algorithmic, human, or hybrid -- as networks of information sites and transformation channels, enabling structured analysis of how information, decisions, and responsibilities flow across organizational and technical boundaries. We apply IFM in a real-world case involving a recruitment support tool used by a public-sector organization, evaluating both the Provider's system and the Deployer's recruitment process. Our results demonstrate that IFM can serve as a scaffold to bridge both component-based and holistic perspectives, and how technical systems are situated within socio-technical contexts. In doing so, IFM supports transparency, identifies risk pathways, and enables alignment analysis between intended and actual use. We argue that such modeling provides a foundational tool for effective, context-sensitive AI governance and accountability -- offering capabilities beyond conventional checklist-based assessments.