Introduction to the EU Artificial Intelligence Act

On February 2, 2024, a pivotal moment in the regulation of artificial intelligence (AI) within the European Union (EU) unfolded as member states endorsed the final version of the EU Artificial Intelligence Act. This act is a cornerstone in the EU’s ambition to set a comprehensive regulatory framework for AI systems, both developed and deployed within its borders and those affecting its citizens from afar. The unanimous approval of the text, which aligns with the political consensus achieved in late 2023, signals a strong likelihood of its adoption with minimal changes. This development marks the EU’s strategic move to balance technological advancement with ethical and safety considerations in AI.

New Obligations for AI Systems

The Act introduces specific mandates for “foundation models,” targeting the backbone of generative AI applications with unique responsibilities. It categorizes AI applications, banning those posing “unacceptable risks” and exempting military and national security uses. The enforcement landscape is set to be multifaceted, with significant penalties for breaches and an extraterritorial scope that demands global attention.

Systemic Risks and High-Risk AI

The legislation highlights the concept of “systemic risks,” imposing stringent duties on providers of high-risk AI models. These include AI systems with significant computing power, presumed to introduce systemic risks, requiring comprehensive risk assessments, incident reporting, and cybersecurity measures. All AI system providers must enhance transparency and accountability, a move that underscores the EU’s commitment to ethical AI use.

EU-Level Regulatory Bodies

The AI Act establishes a structured oversight mechanism, spearheaded by newly created EU-level regulatory bodies, each with distinct roles:

• AI Office: Tasked with overseeing advanced GPAI models, setting standards, and enforcing rules, staffed by European Commission members and linked to the scientific community.
• AI Board: Advises on Act implementation, coordinates national regulators, and issues recommendations, akin to the European Data Protection Board’s role in privacy matters.
• Scientific Panel: Comprises AI experts advising the AI Office on systemic risk assessments and other technical matters.
• Advisory Forum: A diverse group of stakeholders, including industry and academia, providing expertise to the AI Board and Commission.

National-Level Enforcement

At the national level, member states are required to designate competent authorities for enforcing the Act, categorized into “notifying” and “market surveillance” authorities. These bodies are responsible for conformity assessments, market surveillance, and ensuring AI systems’ compliance with EU regulations.

The Act delineates enforcement mechanisms focusing on market surveillance and financial penalties but stops short of allowing individual civil redress. Violations could result in fines up to 35 million euros or 7% of global annual turnover, emphasizing the severe consequences of non-compliance.

Application to the Value Chain

The Act clarifies responsibilities across the AI value chain, from development to deployment. It mandates specific measures for risk assessment, data governance, and compliance with performance standards, particularly for high-risk and generative AI models. The Act’s nuanced approach to “substantial” modifications by deployers illustrates the EU’s intent to ensure accountability throughout the AI system lifecycle.

Encouraging Codes of Conduct

The EU encourages the development of voluntary codes of conduct, focusing on technical robustness, privacy, transparency, and human oversight. These codes are envisioned to align with broader EU principles, promoting societal and environmental sustainability.

Extraterritorial Reach

The Act’s extraterritorial provisions extend its reach to non-EU entities that deploy AI systems affecting EU citizens, underscoring the EU’s global stance on AI regulation. It complements existing EU laws on data protection, consumer rights, and safety, indicating a comprehensive approach to AI governance.

The Act introduces a phased implementation schedule, with most obligations becoming effective 24 months post-enactment. Provisions related to foundation and GPAI models will take effect sooner, highlighting the EU’s phased approach to regulating AI’s dynamic landscape.

The EU Artificial Intelligence Act stands as a monumental step toward establishing a balanced, ethical, and safe AI ecosystem. By setting stringent regulatory standards, creating robust enforcement mechanisms, and extending its reach beyond its borders, the EU is positioning itself as a global leader in AI governance. This Act not only aims to mitigate risks but also to foster innovation within a framework of accountability and transparency. As the AI industry continues to evolve, compliance with the EU’s regulatory framework will be paramount for entities operating within and outside the EU, heralding a new era of responsible AI development and deployment.

Back