BREAKING NEWS! EU Artificial Intelligence Act clears the last hurdle

On Tuesday 21 May 2024, the Council of the EU issued a press release (Artificial intelligence (AI) act: Council gives final green light to the first worldwide rules on AI), confirming its final seal of approval for the landmark piece of AI legislation, known as the EU Artificial Intelligence Act (AI Act). It provides a uniform regulatory framework for the development, provision, deployment and use of AI systems in the EU.

The AI Act is a regulation and as such, will be directly effective in each EU member state. This was a momentous day given it is the first piece of legislation of its kind in the world. One could say it is the most significant and groundbreaking piece of legislation to emerge out of 2023/24 and it is hoped by the law makers that it will 'set a global standard for AI regulation'.

Press release

In the press release, Mathieu Michel, Belgian secretary of state for digitisation stated: 

"The adoption of the AI act is a significant milestone for the European Union. This landmark law, the first of its kind in the world, addresses a global technological challenge that also creates opportunities for our societies and economies. With the AI act, Europe emphasizes the importance of trust, transparency and accountability when dealing with new technologies while at the same time ensuring this fast-changing technology can flourish and boost European innovation".

The press release summarises the main aims and provisions of the AI Act as follows:

• Balance – the AI Act is trying to balance the need to foster the development and uptake of safe and trustworthy AI systems whilst protecting the citizens' fundamental rights and stimulate investment and innovation.
• Exemptions – the Act applies only in the EU but there are exemptions for military and defence and in some instances, for research purposes.
• Risk-based approach – the Act categorises different types of AI according to risk - those AI systems that present the highest level of risk are subject to the most stringent obligations and those presenting low risk are subject to lighter transparency obligations.
• General Purpose AI Models (GPAI) – in relation to GPAI models (e.g. Generative AI models such as ChatGPT), models not posing systemic risks will be subject to some limited requirements (e.g. regarding transparency), but those with systemic risks will have to comply with stricter rules.
• New governing bodies – these will be set up to ensure proper enforcement e.g. an AI Office, an AI Board, a scientific panel of independent experts and an advisory forum.
• Penalties will apply for non-compliance – a percentage of the offending company’s global annual turnover in the previous financial year or a predetermined amount, whichever is higher. SMEs and start-ups will be subject to proportional fines. 
• Transparency and protection of fundamental rights – before a high-risk AI system is deployed by some entities providing public services, the fundamental rights impact will need to be assessed and the entities must be registered in the EU database for high-risk AI systems.
• Measures in support of innovation – the AI Act provides for an innovation-friendly legal framework and aims to promote evidence-based regulatory learning. Regulatory sandboxes will be used enabling a controlled environment for the development, testing and validation of AI systems.

Entry into force

The press release clarifies that the AI Act will be published in the EU’s Official Journal in the coming days and will enter into force twenty days after this publication. The new regulation will apply two years after its entry into force (so 2026), with some exceptions for specific provisions:

• Some provisions will apply after 6 months – general provisions (i.e. scope and definitions) and prohibited AI practices (to stop unacceptable practices as quickly as possible in the EU).
• Some provisions will apply after 12 months – provisions establishing notifying/notified bodies, provisions establishing EU AI Board/National regulators and provisions on GPAI and penalties.
• Some provisions will apply after 36 months – in relation to some high-risk AI systems.

The press release ends by setting out some background to the premise of the AI Act and lists various links for further information.

Comment 

This is an ambitious piece of law in a rapidly developing area but it is hoped to be a huge step in the right direction. It will no doubt take time for those affected by this Act to familiarise themselves with the provisions and there are likely to be some teething issues. It will be interesting to see whether or not the so-called 'Brussels effect' manifests itself and whether the AI Act does indeed 'set the global standard for AI regulation' highlighted in the press release.

The press release does not mention this but one of the most important features of the AI Act to remember is its extraterritorial effect. It will apply not only to entities in the EU but also to developers, deployers, importers, and distributors of AI systems outside the EU, if their systems' output occurs within the EU. (See Article 2 – Scope).

Despite the general provisions only applying in 2026, given the increase in demand for the use of AI in organisations and the development of generative AI in recent months, UK organisations should start taking steps to ensure compliance with the AI Act sooner rather than later, if it applies. This is particularly important for businesses dealing with intellectual property, when there is such a large focus on transparency and compliance with EU copyright law. Article 53 (which was only added towards the end of the AI Act's legislative journey) stipulates that providers of general-purpose AI models are under an obligation to put in place a policy to comply with EU copyright law and to produce a summary about the content used for training AI models. It is therefore important for businesses to assess how AI is used/going to be used and what AI policies and strategies are in place. That is the case whether you are looking to protect intellectual property rights, or you need to comply with the rules so as not to infringe intellectual property rights.

Only time will tell whether the UK, which favours a more flexible, sector-led approach to AI, will change its tune once the AI Act is properly in operation. Although the UK government has made it very clear (and Rishi Sunak reiterated this only last week when the AI Private Members Bill (see here for our blog on this Bill - New UK Artificial Intelligence (Regulation) Bill introduced) moved to the next level of its legislative journey through Parliament) that there is still currently no desire for legislation. The aim of this approach is to allow regulators to respond rapidly to emerging risks at the same time as giving developers room to innovate and grow in the UK. However, will UK businesses want to follow the EU's more stringent regulation so as not to alienate themselves from the EU market? We will watch how the UK government and UK businesses respond to the AI Act with eagle eyes.

If you need advice for your business on any aspect of AI, please contact us at Fieldfisher. We have built, and continue to build, a wealth of expertise in this area.

For further Fieldfisher articles/webinars with more detail on the EU AI Act and its provisions, please see below various links:

AI Governance: What it is and what it should never be | Fieldfisher (2 May 2024)

New developments and ambitions in artificial intelligence | Fieldfisher (29 April 2024)

Webinar: Assessing "high risk AI systems" under the EU AI Act | Fieldfisher (webinar) (14 March 2024)

Generative AI – Privacy Risks & Challenges | Fieldfisher (webinar) (23 February 2024)

Debunking the EU AI Act: an overview of the new legal framework | Fieldfisher (webinar) (2 February 2024)

The EU AI Act: A Comprehensive Regulation of Artificial Intelligence | Fieldfisher (14 December 2023)