The European Artificial Intelligence Act (Regulation – EU – 2024/1689) (the "Act") commenced on 1 August 2024 and regulates AI systems based on their risk classification. The Act adopts a risk-based approach and classifies AI systems into four categories based on their risk level:
- unacceptable risk;
- high risk;
- limited risk; and
- minimal risk.
The Act imposes more onerous provisions as the risk level of an AI technology increases.
Article 5 of the Act bans the following AI-related practices:
- Using an AI system to impair a person or group of persons' ability to make informed decisions through utilising methods which are subliminal, manipulative, or deceptive;
- Exploiting a natural person or group of persons' vulnerabilities such as their age, disability, or specific social or economic situations with the objective of distorting such person(s) behaviour in such a manner that it causes or is likely to cause such person or another person significant harm;
- Classification of natural persons or groups of persons based on their social behaviour with social scoring leading to either or both (i) detrimental or unfavourable treatment of certain natural persons or groups of persons in social contexts; and (ii) detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour.
- Risk assessments of natural persons to assess or predict the risk of such person committing criminal offences;
- Untargeted scarping of facial images from the internet or CCTV footage to create facial recognition databases;
- Inferring emotions of natural persons in the workplace or education institutions (except where the use of the AI system is for medical or safety purposes);
- Using biometric classification systems for the purpose of categorising natural persons based on their biometric data to deduce or infer their race, political opinions, religious beliefs, etc. This prohibition does not apply to any labelling or filtering of lawfully acquired biometric information datasets or categorisation of biometric data in law enforcement; and
- Using real-time biometric identification systems in publicly accessible spaces for the purposes of law enforcement (except for (i) targeted search of specific victims of abduction, trafficking or sexual exploitations or search of missing persons; (ii) prevention of a specific substantial and imminent threat to life of physical safety or threat of a terrorist attack; and (iii) or identification of suspects suspected of having committed a serious offence, such as terrorism, human trafficking, murder, etc.).
Article 99(3) of the Act provides for hefty penalties should a party engage in any of the practices prohibited by Article 5 of the Act, being administrative fines of up to the greater of 35 million EUR or if the offender is an undertaking, up to 7% of its total worldwide annual turnover for proceeding financial year, whichever is greater. However, the sanction regime under the Act will only take force and effect from 2 August 2025.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
