Update on the European Union's AI Act

We are pleased to share that the European Parliament approved sweeping legislation to regulate AI on 21 May 2024, marking a significant milestone in the global tech landscape.

This comes nearly three years after the draft rules were first proposed, and the AI Act was approved with 523 votes in favor. The AI Act seeks to protect fundamental rights, democracy, the rule of law, and environmental sustainability from high-risk AI, while boosting innovation.

After being signed by the presidents of the European Parliament and of the Council, the legislative act will be published in the EU’s Official Journal and enter into force in June 2024. The new regulation will apply two years after its entry into force, with some exceptions for specific provisions.

What does this mean for AI development?

The Act defines obligations for AI applications based on potential risks and impact. High-risk applications, including those used in law enforcement and healthcare, must not discriminate and need to abide by privacy rules. Developers have to show that the systems are transparent, safe, and explainable to users.

The law categorises different types of AI according to risk. AI systems presenting only limited risk would be subject to very light transparency obligations, while high-risk AI systems may be authorised, subject to a set of requirements and obligations to gain access to the EU market.

Before a high-risk AI system is deployed by some entities providing public services, the fundamental rights impact will need to be assessed. Users of a high-risk AI system that are public entities, will need to be registered in the EU database for high-risk AI systems.

What about AI-generated content?

AI systems deemed low-risk, like spam filters, still have to inform users that they’re interacting with AI-generated content. Deepfakes and other AI-generated media will need to be clearly labeled.

The AI Act also addresses the use of general-purpose AI (GPAI) models. GPAI models not posing systemic risks will be subject to some limited requirements regarding transparency, but those with systemic risks will have to comply with stricter rules.

What practices are being banned?

The EU is banning practices that it believes will threaten citizens’ rights. This includes biometric categorisation systems based on sensitive characteristics, untargeted scraping of images of faces from CCTV footage and the web to create facial recognition databases, and AI that manipulates human behavior or exploits people’s vulnerabilities.

AI systems such as cognitive behavioral manipulation and social scoring will be banned from the EU because their risk is deemed unacceptable. The law also prohibits the use of AI for predictive policing based on profiling and systems that use biometric data to categorize people according to specific categories such as race, religion, or sexual orientation. Users of an emotion recognition system will have to inform natural persons when they are being exposed to such a system.

However, there are strictly defined and regulated exceptions, such as when necessary to search for a missing child, to prevent a specific and imminent terrorist threat, or to detect, locate, identify, or prosecute a perpetrator or suspect of a serious criminal offence.

How will the Act be enforced?

The fines for infringements of the AI Act are set as a percentage of the offending company’s global annual turnover in the previous financial year or a predetermined amount, whichever is higher. SMEs and start-ups are subject to proportional administrative fines.

To ensure proper enforcement, several governing bodies are set up:

An AI Office within the Commission to enforce the common rules across the EU
A scientific panel of independent experts to support the enforcement activities
An AI Board with member states’ representatives to advise and assist the Commission and member states on consistent and effective application of the AI Act
An advisory forum for stakeholders to provide technical expertise to the AI Board and the Commission

Does the Act provide measures in support of innovation?

The AI Act intends to provide an innovation-friendly legal framework, promoting evidence-based regulatory learning. The new law foresees that AI regulatory sandboxes, enabling a controlled environment for the development, testing, and validation of innovative AI systems, should allow for testing and validation of innovative AI systems in real-world conditions.

This is a significant step forward in the regulation of AI, and it will be interesting to see how these regulations evolve and influence global AI development.