The European legislature has proposed the Digital Services Act (DSA) and
Artificial Intelligence Act (AIA) to regulate platforms and Artificial
Intelligence (AI) products. We review to what extent third-party audits are
part of both laws and to what extent access to models and data is provided. By
considering the value of third-party audits and third-party data access in an
audit ecosystem, we identify a regulatory gap in that the Artificial
Intelligence Act does not provide access to data for researchers and civil
society. Our contributions to the literature include: (1) Defining an AI audit
ecosystem that incorporates compliance and oversight. (2) Highlighting a
regulatory gap within the DSA and AIA regulatory framework, preventing the
establishment of an AI audit ecosystem. (3) Emphasizing that third-party audits
by research and civil society must be part of that ecosystem and demand that
the AIA include data and model access for certain AI products. We call for the
DSA to provide NGOs and investigative journalists with data access to platforms
by delegated acts and for adaptions and amendments of the AIA to provide
third-party audits and data and model access at least for high-risk systems to
close the regulatory gap. Regulations modeled after European Union AI
regulations should enable data access and third-party audits, fostering an AI
audit ecosystem that promotes compliance and oversight mechanisms.

审查了欧洲立法机构提出的数字服务法案（DSA）和人工智能法案（AIA），发现 AIA 缺乏为研究人员和公民社会提供数据访问的监管机制，因此呼吁 DSA 和 AIA 的修改和补充以提供第三方审计和数据访问，以建立促进合规和监督机制的人工智能审计生态系统。