European Union: Breaking Boundaries: EU's AI Act Unveiled

"We finally have the world's first binding law on artificial intelligence, to reduce risks, create opportunities, combat discrimination, and bring transparency" - Brando Benifei (the Internal Market Committee co-rapporteur).

Indeed, the stated objectives of the AI Act are to promote the use of AI in a safe and transparent manner respecting fundamental rights and democracy, whilst fostering innovation and economic growth.

Applicability

Acknowledging the borderless characteristic of AI, the AI Act's scope extends beyond the EU's geographical boundaries. It is applicable not only to providers and deployers within the EU, but also to those based outside of the Union, targeting their activities towards the EU market.

Definition of an 'AI system'

In light of AI's wide-ranging impact across various sectors, the legislator opted for a flexible definition of an "AI system", also following the Organization for Economic Co-operation and Development ("OECD") guidelines. The definition reads as follows:

"a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."

Risk Categories

The AI Act establishes a risk-based approach, categorizing AI systems on their capacity to cause harm to society. The higher the risk, the stricter the rules and obligations on providers and deployers of AI systems.

Prohibited AI Systems: AI systems deemed to generate unacceptable levels of risk are prohibited. These include systems used for manipulative practices such as social scoring, systems which classify people based on their behavior or characteristics, and systems capable of influencing human behavior and decisions.

High-Risk AI Systems: these will be subject to strict requirements before entry into the EU market. Additionally, such high-risk systems shall be subject to risk management procedures throughout the their life-cycle, aimed at identifying potential risks and ensuring effective mitigation of the same.

Other AI Systems: this category refers to general-purpose AI ("GPAI") systems, which should as a minimum meet certain transparency requirements. In particular, artificial or manipulated image, audio or video content ('deepfakes') should be clearly labelled as such. Providers of GPAI models should also adhere to EU copyright laws and disclose information regarding the content utilized for training AI models. Furthermore, providers of GPAI systems shall notify the AI Office when their system poses systemic risks on EU society, fundamental rights and values.

AI Governance and Sanctions

The AI Act primarily relies on national competent market surveillance authorities in each Member State as official points of contact. Each Member State must also appoint a representative on the European Artificial Intelligence Board, in order to facilitate coordination at EU level. An EU Artificial Intelligence Office will also be established to strengthen the development and use of trustworthy AI, enforce GPAI rules and foster international cooperation.

The Act establishes harsh fines against those in breach, with penalties reaching up to €40 million or 7% of the of the total worldwide annual turnover for the preceding financial year (whichever is higher). Fines may be imposed in addition to or instead of non-monetary measures such as orders or warnings.

Timeframe

The AI Act is pending a final lawyer-linguist check. Once the final text is published in the Official Journal of the EU, the following timeframes shall apply:

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.