academia_hack

I've noticed a trend in AI policy (e.g. the EU AI act or the USA's AI executive order) to include references to quantities of Floating -Point operations to differentiate between AI models but I don't really understand the rationale behind it or what the language actually means. For example:

```

Until such technical conditions are defined, the Secretary shall require compliance with these reporting requirements for:

          (i)   any model that was trained using a quantity of computing power greater than 10^26 integer or floating-point operations, or using primarily biological sequence data and using a quantity of computing power greater than 10^23 integer or floating-point operations;

```

What does this mean to me as an engineer? I normally see FLOPS (which I think of as a measurement of operations per second) but this seems to be about total operations without a time dimension? How did this language get into legislation and why does it seem so widespread?

My org is looking at getting past security audits for enterprise and government customers. I've got a lot of say in how we implement compliance but little say as to if we should do it. We're selling into a highly regulated sector looking at ITAR and CMMC and similar stuff.

Today, we're pretty much a BYOD shop (we buy new employees unmanaged laptops). People manage their own devices and we do colab stuff with Google Workspace. Developers love this because they don't have to "mother may I" IT for every tool and library.

There's a lot of pressure from our compliance lead to go with endpoint management, big corporate antivirus (e.g. Sophos), active directory accounts, kicking people off OSX to windows, etc. We've got an endless parade of MSP consultants and vendors trying to pitch $500k assessment and remediation packages as well and I'm worried leadership will bite and we'll end up developing on devices that can basically only open excel.

My worry is that this'll choke our product operations to death. Clearly we have to do something, but I don't want to go overboard. Everytime I push back I'm told that "security is important" (true but vacuous) and asked for comparable alternatives.

Have y'all experienced any small companies that get this right and strike a good balance?