Everything You Should Know About the EU AI Act

The European Union’s comprehensive rulebook for artificial intelligence, the EU AI Act, has been under development for several years. But get ready because we’ll hear much more about this regulation soon as important compliance deadlines start rolling in. In the meantime, let’s dive into an overview of what this law is all about and what it aims to achieve.

So, What Is the EU Trying to Achieve?

Let’s rewind to April 2021, when the European Commission first introduced the proposal for the AI Act. At that time, lawmakers presented it as a way to boost the EU’s ability to innovate AI by building trust among its citizens. The idea was to ensure that AI technologies stay “human-centered” while providing businesses with clear guidelines to unleash their machine-learning potential.

As automation becomes more widespread across various industries and aspects of society, it has the power to boost productivity significantly. However, it also brings risks, mainly if the AI systems produce poor results or infringe on individual rights. The EU’s goal with the AI Act is to encourage the adoption of AI and develop a solid local AI ecosystem by setting up conditions that minimize the chances of things going wrong. Lawmakers believe these safeguards will increase citizens’ trust in AI and encourage its responsible use.

Fostering an AI ecosystem through trust wasn’t too controversial in the early part of the decade when the law was being discussed and drafted. However, some critics argued that it might be too soon to regulate AI and that such regulations could hinder European innovation and competitiveness.

Fast-forward to today, and it’s hard to argue that it’s too early to regulate AI, especially with the explosion of generative AI tools like ChatGPT bringing AI into the mainstream spotlight. Nevertheless, some still worry that the AI Act might hold back European AI startups, even though support measures like regulatory sandboxes are included to help them thrive.

Despite these concerns, lawmakers are now mainly discussing how to regulate AI. With the AI Act in place, the EU has set its direction, and the next few years will be about executing this plan.

What Does the AI Act Require?

Interestingly, most AI applications aren’t regulated under the AI Act because they fall outside the scope of the risk-based rules. It’s also important to note that military uses of AI are completely out of scope since national security falls under member-state jurisdiction, not the EU level.

The Act uses a risk-based approach to create a hierarchy of regulations for the AI applications that are within scope. At the top are a few specific use cases, such as “harmful subliminal, manipulative and deceptive techniques” or “unacceptable social scoring,” which are classified as carrying an “unacceptable risk” and are therefore banned. However, even these bans come with plenty of exceptions. For example, while there’s a ban on law enforcement using real-time remote biometric identification in publicly accessible spaces, it’s not an absolute ban. Some exceptions allow its use for certain types of crimes.

Next down the hierarchy are “high-risk” use cases. These include AI applications in critical infrastructure, law enforcement, education and vocational training, healthcare, and more. For these high-risk applications, developers must conduct conformity assessments before launching their products on the market and continue them regularly, especially when they make significant updates to their models.

What does this mean for developers? They must prove they meet the law’s requirements in data quality, documentation, transparency, human oversight, accuracy, cybersecurity, and robustness. They also need to set up quality and risk-management systems to show compliance if an enforcement authority decides to audit them. Additionally, high-risk systems deployed by public bodies must be registered in a public EU database.

There’s also a “medium-risk” category, which applies to AI systems like chatbots or tools that generate synthetic media. The concern is that these technologies could be used to manipulate people, so the law requires that users be informed when interacting with or viewing AI-produced content.

All other AI uses are considered low or minimal risk and aren’t regulated by the AI Act. Activities like using AI to sort and recommend social media content or target advertising are not obligations under these rules. However, the EU encourages all AI developers to voluntarily follow best practices to boost user trust.

These tiered, risk-based rules make up the bulk of the AI Act. However, there are also specific requirements for the complex models that power generative AI technologies, referred to as “general purpose AI” models (GPAIs). These foundational models are often used by developers who access APIs from GPAIs to integrate these capabilities into their software, usually fine-tuned for specific use cases to add value. It has given GPAIs a significant position in the market, with the potential to influence AI outcomes on a large scale.

GenAI Has Entered the Chat

The rise of generative AI (GenAI) changed the conversation around the EU’s AI Act and led to modifications in the rulebook. As the legislative process dragged on, the hype around GenAI tools like ChatGPT surged, prompting lawmakers in the European Parliament to take action.

Members of the European Parliament (MEPs) proposed adding extra rules for GPAIs—the models behind GenAI tools. This move caught the tech industry’s attention, intensifying lobbying efforts to carve out exceptions for GPAIs. French AI firm Mistral was particularly vocal, arguing that rules on model makers would hinder Europe’s ability to compete with AI giants from the U.S. and China. Even OpenAI’s Sam Altman got involved, hinting to journalists that his company might pull its tech out of Europe if the laws became too burdensome. He quickly backtracked, resorting to traditional lobbying tactics after the EU called him out on his comments.

Altman’s foray into European diplomacy became one of the more visible side effects of the AI Act.

All this noise led to a tense and prolonged legislative process. It took months of negotiations between the European Parliament, the Council, and the Commission to finally push the AI Act over the finish line last year. The political agreement was reached in December 2023, leading to the adoption of the final text in May 2024.

The EU has touted the AI Act as a “global first.” However, being first in this rapidly evolving tech space means there’s still a lot of work to be done, such as setting specific standards for the law’s application and creating detailed compliance guidance (Codes of Practice) to make the oversight and ecosystem-building envisioned by the Act a reality.

So, when evaluating its success, the law is still a work in progress and will continue for quite some time.

What’s Happening with GPAIs?

The AI Act continues with the risk-based approach but imposes only lighter requirements for most GPAIs. For commercial GPAIs, this means adhering to transparency rules, including technical documentation and disclosures about using copyrighted material in training models. These rules are designed to help downstream developers comply with the AI Act.

There’s also a second tier for the most powerful and potentially risky GPAIs, where the Act increases obligations on model makers by requiring proactive risk assessments and mitigation for GPAIs with “systemic risk.” The EU is particularly concerned about compelling AI models that could pose risks to human life or even risks where tech makers might lose control over the development of self-improving AIs.

Lawmakers used a computed threshold for model training to classify systemic risk. GPAIs will fall into this category if the cumulative amount of compute used for their training exceeds 10²⁵ floating point operations (FLOPs). So far, no models are believed to fall into this scope, but that could change as generative AI advances.

There’s also some flexibility for AI safety experts overseeing the AI Act to flag concerns about systemic risks that might arise elsewhere. (For more details on the governance structure the EU has set up for the AI Act—including the various roles of the AI Office—check out our earlier report.)

Thanks to lobbying from companies like Mistral, the rules for GPAIs were softened, with lighter requirements for open-source providers. Research and development (R&D) also got a carve-out, meaning GPAIs that have yet to be commercialized are entirely outside the scope of the Act, with no transparency requirements applying.

A Long March Toward Compliance

The AI Act officially came into force across the EU on August 1, 2024. This date kicked off the timeline for various compliance deadlines from early next year until around the middle of 2027.

Here are some of the main compliance deadlines:

Six months in: Rules on prohibited use cases come into effect.

Nine months in: Codes of Practice start to apply.

• 12 months in: Transparency and governance requirements kick in.
• 24 months in: Other AI requirements, including obligations for some high-risk systems, are implemented.
• 36 months in: Additional high-risk system requirements take effect.

The staggered approach to these legal provisions is meant to give companies enough time to organize their operations. More importantly, it allows regulators the necessary time to understand what compliance looks like in this cutting-edge context.

As we speak, the EU is busy crafting guidance for various aspects of the law ahead of these deadlines, such as Codes of Practice for GPAI developers. They’re also consulting on the law’s definition of “AI systems” (i.e., which software falls inside or outside the scope) and clarifying the use of banned AI.

The full impact of the AI Act on companies that fall within its scope is still being developed and detailed. However, key details are expected to be finalized in the coming months and into the first half of next year.

One More Thing to Consider

Given the rapid pace of development in the AI field, what’s required to stay compliant with the law will likely keep evolving as these technologies and their associated risks continue to advance. This rulebook might need to remain a living document, adapting as needed.

AI Rules Enforcement

Oversight of GPAIs is centralized at the EU level, with the AI Office playing a crucial role. The Commission can impose penalties for non-compliance reaching up to 3% of a model maker’s global turnover.

For other AI systems, enforcement is decentralized, meaning it’s up to member-state authorities (and there might be more than one oversight body designated) to assess and investigate compliance issues for most AI applications. How effective this decentralized structure will be remains to be seen.

On paper, penalties can be pretty steep:

• Up to 7% of global turnover (or €35 million, whichever is greater) for breaches of banned uses.
• Up to 3% of global turnover for violations of other AI obligations.
• Up to 1.5% for providing incorrect information to regulators.

Enforcement authorities can apply a sliding scale of sanctions, ensuring that the EU takes compliance seriously.

Wrapping It Up

The EU AI Act is a groundbreaking legislation that balances innovation with robust safeguards to ensure AI technologies are developed and used responsibly. While it’s already making waves and setting a global precedent, it’s still evolving to keep up with the fast-paced world of AI. Businesses and developers must stay informed and adaptable as the EU continues to refine and enforce these essential regulations.