Abstract | Probably one of the currently most important legal acts of the EU is the newly adopted Artificial Intelligence (AI) Act. The European Union is the first body in that regard that has actually began to implement legal regulation of AI technologies. As the AI Act is a regulation, it will be directly effective in all EU countries and will substantially affect the treatment of AI systems by natural and legal persons in the EU.
However, the AI Act will not affect only persons seated in the EU. Given the nature of the internet and the online world, AI systems cannot be given strict national boundaries. Thus, for the regulation to be effective, the AI Act also embodies its cross-border reach beyond the EU in certain situations. This article therefore aims to clarify the basic aspects of this new regulation and draw attention to its possible application also to non-EU natural and legal persons.
I. Introduction
6.01. On May 21, 2024, the Council of the EU adopted the AI Act.1/2 The AI Act aims to:
... improve the functioning of the internal market and promote the uptake of human-centric and trustworthy artificial intelligence (AI), while ensuring a high level of protection of health, safety, fundamental rights enshrined in the Charter, including democracy, the rule of law and environmental protection, against the harmful effects of AI systems in the Union and supporting innovation.3
6.02. This regulation is the first general act seeking to regulate artificial intelligence. The AI Act lays down, inter alia, prohibitions of certain AI practices, introduces special rules for so-called high-risk AI systems, and harmonises rules for placing on the market, putting into service, and using AI systems in the EU.4
6.03. It, of course, follows that every EU member state is directly bound by this regulation. The AI Act thus applies to all providers and their authorised representatives, deployers, importers and distributors, product manufacturers, and affected persons throughout the whole EU.5 Interestingly, however, the AI Act specifically defines its application also to persons located outside the EU. To properly understand the content of this regulation, it is necessary to introduce what the AI Act means by 'AI system,' what the basic principles of the introduced regulation are, and to point out how this EU regulation may also affect natural and legal persons from third countries (non-EU countries).
II. Definition of AI System
6.04. Article 3(1) AI Act defines an AI system as:
... a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.
6.05. This definition must be read in the context of Recital 12 AI Act which gives an overview of the purpose of the created definition. The definition attempts to be all-encompassing yet generalised so that it can flexibly adapt to rapid developments in AI.6 On the other hand, traditional software that is not an AI system per se cannot fall under the definition. Therefore, the definition must be based on the key characteristics of the AI system.7
6.06. According to the regulation, the main feature that distinguishes AI from classical software is probably its inference capability.8 This means the process of: '... obtaining the outputs, such as predictions, content, recommendations, or decisions, which can influence physical and virtual environments, and to a capability of AI systems to derive models or algorithms, or both, from inputs or data.'9 Next to the inference, the differentiation from any other software is secured by the word 'autonomy'. Due to the combination of those words, no regular software with predetermined output by algorithm shall fit in this category. This should ensure that this definition will not become outdated in the near future.10
6.07. The definition of an AI system has changed over time due to negotiations during the legislative process.11 The definition chosen in the final version of the regulation follows the latest definition of the Organisation for Economic Co-operation and Development (OECD):
An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.12
6.08. However, in contrast to the OECD definition, the definition adopted in the AI Act emphasises the adaptive and autonomous nature of the AI system.
III. Impact of the AI Act on Third Countries, Non- EU Countries
6.09. Article 2 AI Act refers to the scope of its application. As the AI Act is by its nature a regulation, it applies within the EU according to the general rules applicable to regulations. It is therefore a legal act that has general application and direct applicability in EU Member States. However, it is important to note that the wording of Article 2 also gives this regulation scope outside the EU. It may therefore also affect natural and legal persons from third (non-EU) countries.
6.10. Pursuant to Article 2(1), the AI Act applies to:
(a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;
(b) deployers of AI systems that have their place of establishment or are located within the Union;
(c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;
(d) importers and distributors of AI systems;
(e) product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;
(f) authorised representatives of providers, which are not established in the Union;
(g) affected persons that are located in the Union.
(emphasis by Author)
6.11. The AI Act has a broad scope and does not apply strictly to EU providers. Placement on the EU market is the main determinant. For this reason, the AI Act can very simply apply to natural and legal persons seated in third countries. Therefore, it is necessary to identify in particular the obligations that apply to providers and deployers, as this is the position in which non- EU persons dealing with AI systems are most likely to be.13
III.1. Placing an AI System on the EU Market
6.12. As stated above, the main determinant for the scope of application is whether a natural or legal person places on the market or puts into service AI systems or places on the EU market a general-purpose AI model. It is therefore necessary to elaborate on what exactly it means to 'place' an AI system on the market and when an AI system is considered to be placed on the market. Assessing these questions is even more challenging in the online world.
6.13. Article 3(9) AI Act defines 'placing on the market' as: 'the first making available of an AI system or a general-purpose AI model on the Union market'. This definition is based on the common concept of placing on the market used in EU law. For example, pursuant to Decision No 768/2008/EC on a common framework for the marketing of products,14 the term 'placing on the market' shall mean: '... the first making available of a product on the Community market'.15 A comparison can therefore be made by interpreting these related and similar legal acts.
6.14. The concept of placing the AI system on the market is linked to the first time the AI system is made available on the EU market. Individual AI system can therefore only be placed once on the EU market. With regards to the internet, the rule in relation to products generally states that: 'Products offered for sale online or through other means of distance sales are deemed to be made available on the Union market if the offer is targeted at end users in the Union'.16/17 An offer targeted at end users in the EU is the offer where the relevant economic operator directs (by any means) its activities to a member state.18 Nevertheless, these activities need to be truly directed to one of the member states of the EU. The general accessibility of a given online market from an EU country, without being intended for that market, is not sufficient.19
6.15. This concept should probably also apply appropriately to the possible commercial provision of AI systems. Nevertheless, it will always depend on the form in which the AI system is provided. Different rules can apply e.g. in the situation where an AI system is just a part of a final product that is being sold within the EU market. One can also imagine the online accessibility of stand-alone AI-system without integration into the product, which is only accessible via a web interface. In practice, it will therefore always be necessary to approach each situation on a case-by-case basis in order to properly assess the liability of the subjects and their obligations pursuant to the AI Act.
III.2. The Usage of AI System's Output as a Reason for Application to Non-EU Persons
6.16. The scope of application defined as placing on the market, putting into service, or using in the EU (Article 2(1)(a)) is, however, not the only way of looking at the possible application of the regulation to non-EU persons. The AI Act is applicable to non-EU persons also due to the strictly 'digital nature' of AI systems.20 This concept is intended to prevent circumvention of the regulation. A typical example provided by the Recital 22 AI Act is the situation where:
'...an operator established in the Union contracts certain services to an operator established in a third country in relation to an activity to be performed by an AI system that would qualify as high-risk. In those circumstances, the AI system used in a third country by the operator could process data lawfully collected in and transferred from the Union, and provide to the contracting operator in the Union the output of that AI system resulting from that processing, without that AI system being placed on the market, put into service or used in the Union.21
6.17. Therefore, the AI Act shall also apply to non-EU providers and deployers if the output produced by the AI system is intended to be used in the EU. For this reason, the application for non-EU persons also arises from Article 2(1) (c), which uses the determinant of where the outcome will be used. Should the use be within the EU, the AI Act applies also to those non-EU providers and deployers.
6.18. However, the AI Act must be seen in the context of related regulation,22 here especially with regards to the liability of providers of intermediary services. Therefore, Article 2(5) states that this regulation does not affect the liability regime as set forth in Chapter II Regulation 2022/2065.23
To read this article in full, please click here.
Footnotes
1. As the AI Act has not yet been officially published at the time of writing this article, the text of the AI Act is taken from Corrigendum to the position of the European Parliament adopted at first reading on 13 March 2024 with a view to the adoption of Regulation (EU) 2024/ ...... of the European Parliament and of the Council laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) P9_TA(2024)0138 (COM(2021)0206 – C9-0146/2021 – 2021/0106(COD)), available at https://www.europarl.europa.eu/doceo/document/TA-9-2024-0138-FNL-COR01_EN.pdf (accessed on 02 July 2024).
2. Risto Uuk, The EU AI Act Newsletter #53: The Law Is Finally Adopted, The EU AI Act Newsletter. 28 May 2024, available at https://artificialintelligenceact.substack.com/p/the-eu-ai-act-newsletter-53-the-law (accessed on 02 July 2024).
3. Article 1(1) AI Act.
4. Article 1(2) AI Act.
5. Article 2(1) AI Act.
6. Recital 12 AI Act: 'The notion of 'AI system' in this Regulation should be clearly defined and should be closely aligned with the work of international organisations working on AI to ensure legal certainty, facilitate international convergence and wide acceptance, while providing the flexibility to accommodate the rapid technological developments in this field.'
7. Recital 12 AI Act: 'Moreover, the definition should be based on key characteristics of AI systems that distinguish it from simpler traditional software systems or programming approaches and should not cover systems that are based on the rules defined solely by natural persons to automatically execute operations.'
8. Recital 12 AI Act: 'A key characteristic of AI systems is their capability to infer.'
9. Recital 12 AI Act.
10. Frederiek Fernhout, Thibau Duquin, The EU Artificial Intelligence Act: our 16 key takeaways, Stibbe, 13. February 2024, available at https://www.stibbe.com/publications-and-insights/the-eu-artificial-intelligence-act-our-16-key-takeaways (accessed on 02 July 2024).
11. Cf. the definition of AI system presented in the original proposal: ''artificial intelligence system' (AI system) software that is developed with one or more of the techniques and approaches listed in Annex I and can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with'. See Article 3 point 1 Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts, 21 April 2021, COM(2021) 206 final, 2021/0106(COD), {SEC(2021) 167 final} - {SWD(2021) 84 final} - {SWD(2021) 85 final}.
12. OECD, Explanatory Memorandum on the Updated OECD Definition of an AI System, 8 OECD Artificial Intelligence Papers, OECD Publishing (2024), at 6.
13. See also Recital 21 AI Act: 'In order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the Union, the rules established by this Regulation should apply to providers of AI systems in a non-discriminatory manner, irrespective of whether they are established within the Union or in a third country, and to deployers of AI systems established within the Union.'
14. Decision No 768/2008/EC of the European Parliament and of the Council of 09 July 2008 on a common framework for the marketing of products, and repealing Council Decision 93/465/EEC, as amended.
15. Annex 1, Chapter R1, Article R1, point 2 Decision No 768/2008/EC of the European Parliament and of the Council of 09 July 2008 on a common framework for the marketing of products, and repealing Council Decision 93/465/EEC, as amended. See also European Commission, Commission Notice, The 'Blue Guide' on the Implementation of EU Products Rules 2022, Information from European Union Institutions, Bodies, Offices and Agencies (2022/C 247/01), at 16: 'For the purposes of Union harmonisation legislation, a product is placed on the market when it is made available for the first time on the Union market. The operation is reserved either for a manufacturer or an importer, i.e. the manufacturer and the importer are the only economic operators who place products on the market (49). When a manufacturer or an importer supplies a product to a distributor (50) or an end-user for the first time, the operation is always labelled in legal terms as 'placing on the market'. Any subsequent operation, for instance, from a distributor to distributor or from a distributor to an end-user is defined as making available.'
16 .European Commission, Commission Notice, The 'Blue Guide' on the Implementation of EU Products Rules 2022, Information from European Union Institutions, Bodies, Offices and Agencies (2022/C 247/01), at 21.
17. In relation to products, the Blue Guide also defines when, on the other hand, the product is not placed on the market, e.g. where a product is: '— manufactured for one's own use unless Union harmonisation legislation covers products manufactured for own use in its scope; — bought by a consumer in a third country while physically present in that country and brought by the consumer into the EU for the personal use of that person; — transferred from the manufacturer in a third country to an authorised representative in the Union whom the manufacturer has engaged to ensure that the product complies with the Union harmonisation legislation'. See European Commission, Commission Notice, The 'Blue Guide' on the Implementation of EU Products Rules 2022, Information from European Union Institutions, Bodies, Offices and Agencies (2022/C 247/01), at 20.
18. European Commission, Commission Notice, The 'Blue Guide' on the Implementation of EU Products Rules 2022, Information from European Union Institutions, Bodies, Offices and Agencies (2022/C 247/01), at 21.
19. Judgment of the CJEU of 12 July 2011, C-324/09, L'Oréal SA and Others v. eBay International AG and Others, ECLI:EU:C:2011:474, point 64: 'Indeed, if the fact that an online marketplace is accessible from that territory were sufficient for the advertisements displayed there to be within the scope of Directive 89/104 and Regulation No 40/94, websites and advertisements which, although obviously targeted solely at consumers in third States, are nevertheless technically accessible from EU territory would wrongly be subject to EU law.'
20. See Recital 22 AI Act: 'In light of their digital nature, certain AI systems should fall within the scope of this Regulation even when they are not placed on the market, put into service, or used in the Union. (...).'
21. Recital 22 AI Act.
22. See Recital 9 AI Act, which states that harmonised rules applicable to the placing on the market, the putting into service and the use of high-risk AI systems should be laid down consistently with the existing regulation, especially with regulation No 765/2008 of 09 July 2008, setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93, as amended, decision No 768/2008 of 09 July 2008, on a common framework for the marketing of products, and repealing Council Decision 93/465/EEC, as amended, regulation 2019/1020 of 20 June 2019, on market surveillance and compliance of products and amending Directive 2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011, as amended. These rules should also be without prejudice to existing EU law on (inter alia) data protection, consumer protection, labour law, fundamental rights, product safety etc.
23. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act).
Originally published by LEX LATA .
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.