Artificial Intelligence Act Explained

Number:	2024/1689
Type:	Regulation
Eea:	yes
Artificial Intelligence Act
Madeby:	European Parliament and Council
Ojrefurl:	http://data.europa.eu/eli/reg/2024/1689/oj
Ojref:	OJ L, 2024/1689, 12.7.2024
Councilvote:	21 May 2024
Epvote:	13 March 2024
Commenced:	1 August 2024
Amends:	Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU
Status:	current

The Artificial Intelligence Act (AI Act) is a European Union regulation concerning artificial intelligence (AI). It establishes a common regulatory and legal framework for AI within the European Union (EU).^[1] It came into force on 1 August 2024,^[2] with provisions coming into operation gradually over the following 6 to 36 months.^[3]

It covers all types of AI across a broad range of sectors, with exceptions for AI systems used solely for military, national security, research and non-professional purposes.^[4] As a piece of product regulation, it does not confer rights on individuals, but regulates the providers of AI systems and entities using AI in a professional context.^[5]

The Act classifies non-exempt AI applications by their risk of causing harm. There are four levels – unacceptable, high, limited, minimal – plus an additional category for general-purpose AI.

• Applications with unacceptable risks are banned.
• High-risk applications must comply with security, transparency and quality obligations, and undergo conformity assessments.
• Limited-risk applications only have transparency obligations.
• Minimal-risk applications are not regulated.

For general-purpose AI, transparency requirements are imposed, with additional evaluations for high-capability models.^{[6] [7]}

The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance with the regulation.^[8] Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers from outside the EU if they have users within the EU.

Proposed by the European Commission on 21 April 2021,^[9] it passed the European Parliament on 13 March 2024,^[10] and was unanimously approved by the EU Council on 21 May 2024.^[11] The draft Act was revised to address the rise in popularity of generative artificial intelligence systems, such as ChatGPT, whose general-purpose capabilities did not fit the main framework.^[12] More restrictive regulations are planned for powerful generative AI systems with systemic impact.

Provisions

Risk categories

There are different risk categories depending on the type of application, with a specific category dedicated to general-purpose generative AI:

• Unacceptable risk – AI applications in this category are banned, except for specific exemptions. When no exemption applies, this includes AI applications that manipulate human behaviour, those that use real-time remote biometric identification (such as facial recognition) in public spaces, and those used for social scoring (ranking individuals based on their personal characteristics, socio-economic status or behaviour).
• High-risk – AI applications that are expected to pose significant threats to health, safety, or the fundamental rights of persons. Notably, AI systems used in health, education, recruitment, critical infrastructure management, law enforcement or justice. They are subject to quality, transparency, human oversight and safety obligations, and in some cases require a "Fundamental Rights Impact Assessment" before deployment. They must be evaluated both before they are placed on the market and throughout their life cycle. The list of high-risk applications can be expanded over time, without the need to modify the AI Act itself.
• General-purpose AI – Added in 2023, this category includes in particular foundation models like ChatGPT. They are subject to transparency requirements. High-impact general-purpose AI systems which could pose systemic risks (notably those trained using a computational capability exceeding 10²⁵ FLOPS)^[13] must also undergo a thorough evaluation process.
• Limited risk – AI systems in this category have transparency obligations, ensuring users are informed that they are interacting with an AI system and allowing them to make informed choices. This category includes, for example, AI applications that make it possible to generate or manipulate images, sound, or videos (like deepfakes). In this category, free models that are open source (i.e., whose parameters are publicly available) are not regulated, with some exceptions.^[14]
• Minimal risk – This category includes, for example, AI systems used for video games or spam filters. Most AI applications are expected to fall into this category.^[15] These systems are not regulated, and Member States cannot impose additional regulations due to maximum harmonisation rules. Existing national laws regarding the design or use of such systems are overridden. However, a voluntary code of conduct is suggested.

Exemptions

Articles 2.3 and 2.6 exempt AI systems used for military or national security purposes or pure scientific research and development from the AI Act.

Article 5.2 bans algorithmic video surveillance only if it is conducted in real time. Exceptions allowing real-time algorithmic video surveillance include policing aims including "a real and present or real and foreseeable threat of terrorist attack".^[16]

Recital 31 of the act states that it aims to prohibit "AI systems providing social scoring of natural persons by public or private actors", but allows for "lawful evaluation practices of natural persons that are carried out for a specific purpose in accordance with Union and national law."^[17] La Quadrature du Net interprets this exemption as permitting sector-specific social scoring systems, such as the suspicion score used by the French family payments agency .^[18]

Governance

The AI Act establishes various new bodies in Article 64 and the following articles. These bodies are tasked with implementing and enforcing the Act. The approach combines EU-level coordination with national implementation, involving both public authorities and private sector participation.

The following new bodies will be established:^{[19] [20]}

1. AI Office: attached to the European Commission, this authority will coordinate the implementation of the AI Act in all Member States and oversee the compliance of general-purpose AI providers.
2. European Artificial Intelligence Board: composed of one representative from each Member State, the Board will advise and assist the Commission and Member States to facilitate the consistent and effective application of the AI Act. Its tasks include gathering and sharing technical and regulatory expertise, providing recommendations, written opinions, and other advice.
3. Advisory Forum: established to advise and provide technical expertise to the Board and the Commission, this forum will represent a balanced selection of stakeholders, including industry, start-ups, small and medium-sized enterprises, civil society, and academia, ensuring that a broad spectrum of opinions is represented during the implementation and application process.
4. Scientific Panel of Independent Experts: this panel will provide technical advice and input to the AI Office and national authorities, enforce rules for general-purpose AI models (notably by launching qualified alerts of possible risks to the AI Office), and ensure that the rules and implementations of the AI Act correspond to the latest scientific findings.

While the establishment of new bodies is planned at the EU level, Member States will have to designate "national competent authorities".^[21] These authorities will be responsible for ensuring the application and implementation of the AI Act, and for conducting "market surveillance".^[22] They will verify that AI systems comply with the regulations, notably by checking the proper performance of conformity assessments and by appointing third-parties to carry out external conformity assessments.

Enforcement

The Act regulates the entry to the EU internal market using the New Legislative Framework. It contains essential requirements that all AI systems must meet to access the EU market. These essential requirements are passed on to European Standardisation Organisations, which develop technical standards that further detail these requirements.^[23]

The Act mandates that member states establish their own notifying bodies. Conformity assessments are conducted to verify whether AI systems comply with the standards set out in the AI Act.^[24] This assessment can be done in two ways: either through self-assessment, where the AI system provider checks conformity, or through third-party conformity assessment, where the notifying body conducts the assessment.^[25] Notifying bodies also have the authority to carry out audits to ensure proper conformity assessments.^[26]

Criticism has arisen regarding the fact that many high-risk AI systems do not require third-party conformity assessments.^{[27] [28] [29]} Some commentators argue that independent third-party assessments are necessary for high-risk AI systems to ensure safety before deployment. Legal scholars have suggested that AI systems capable of generating deepfakes for political misinformation or creating non-consensual intimate imagery should be classified as high-risk and subjected to stricter regulation.^[30]

Legislative procedure

In February 2020, the European Commission published "White Paper on Artificial Intelligence – A European approach to excellence and trust".^[31] In October 2020, debates between EU leaders took place in the European Council. On 21 April 2021, the AI Act was officially proposed by the Commission. On 6 December 2022, the European Council adopted the general orientation, allowing negotiations to begin with the European Parliament. On 9 December 2023, after three days of "marathon" talks, the EU Council and Parliament concluded an agreement.^[32]

The law was passed in the European Parliament on 13 March 2024, by a vote of 523 for, 46 against, and 49 abstaining.^[33] It was approved by the EU Council on 21 May 2024.^[11] It entered into force on 1 August 2024,^[2] 20 days after being published in the Official Journal on 12 July 2024.^{[10] [34]} After coming into force, there will be a delay before it becomes applicable, which depends on the type of application. This delay is 6 months for bans on "unacceptable risk" AI systems, 9 months for codes of practice, 12 months for general-purpose AI systems, 36 months for some obligations related to "high-risk" AI systems, and 24 months for everything else.^[33]

Reactions

Experts have argued that though the jurisdiction of the law is European, it could have far-ranging implications for international companies that plan to expand to Europe.^[35] Anu Bradford at Columbia has argued that the law provides significant momentum to the world-wide movement to regulate AI technologies.

Amnesty International criticized the AI Act for not completely banning real-time facial recognition, which they said could damage "human rights, civil space and rule of law" in the European Union. It also criticized the absence of ban on exporting AI technologies that can harm human rights.

Some tech watchdogs have argued that there were major loopholes in the law that would allow large tech monopolies to entrench their advantage in AI, or to lobby to weaken rules.^[36] Some startups welcomed the clarification the act provides, while others argued the additional regulation would make European startups uncompetitive compared to American and Chinese startups.^[37] La Quadrature du Net (LQDN) described the AI Act as "tailor-made for the tech industry, European police forces as well as other large bureaucracies eager to automate social control". LQDN described the role of self-regulation and exemptions in the act to render it "largely incapable of standing in the way of the social, political and environmental damage linked to the proliferation of AI".

See also

• Algorithmic bias
• Ethics of artificial intelligence
• Regulation of algorithms
• Regulation of artificial intelligence in the European Union
• Existential risk from artificial general intelligence

Notes and References

1. Web site: Proposal for a Regulation laying down harmonised rules on artificial intelligence: Shaping Europe's digital future . digital-strategy.ec.europa.eu . 21 April 2021 . 2023-01-09 . en . 4 January 2023 . https://web.archive.org/web/20230104120436/https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-laying-down-harmonised-rules-artificial-intelligence . live .
2. 1 August 2024 . AI Act enters into force . Brussels . . 5 August 2024.
3. Web site: Timeline of Developments . 2024-07-13 . artificialintelligenceact.eu . Future of Life Institute . en-US.
4. News: 9 December 2023 . Artificial intelligence act: Council and Parliament strike a deal on the first rules for AI in the world . January 6, 2024 . Council of the EU . 10 January 2024 . https://web.archive.org/web/20240110092304/https://www.consilium.europa.eu/en/press/press-releases/2023/12/09/artificial-intelligence-act-council-and-parliament-strike-a-deal-on-the-first-worldwide-rules-for-ai/ . live .
5. Web site: Mueller . Benjamin . 2021-05-04 . The Artificial Intelligence Act: A Quick Explainer . 2024-01-06 . Center for Data Innovation . en-US . 14 October 2022 . https://web.archive.org/web/20221014172842/http://datainnovation.org/2021/05/the-artificial-intelligence-act-a-quick-explainer/ . live .
6. Web site: Espinoza . Javier . December 9, 2023 . EU agrees landmark rules on artificial intelligence . live . https://web.archive.org/web/20231229130308/https://www.ft.com/content/d5bec462-d948-4437-aab1-e6505031a303 . 29 December 2023 . 2024-01-06 . Financial Times.
7. News: EU AI Act: first regulation on artificial intelligence . 2024-01-06 . European Parliament News . en . 10 January 2024 . https://web.archive.org/web/20240110162551/https://www.europarl.europa.eu/news/en/headlines/society/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence . live .
8. Web site: MacCarthy. Mark. Propp . Kenneth . 2021-05-04 . Machines learn that Brussels writes the rules: The EU's new AI regulation . live . https://web.archive.org/web/20221027115538/https://www.brookings.edu/blog/techtank/2021/05/04/machines-learn-that-brussels-writes-the-rules-the-eus-new-ai-regulation/ . 27 October 2022 . 2021-09-07 . Brookings . en-US.
9. Web site: EUR-Lex – 52021PC0206 – EN – EUR-Lex . live . https://web.archive.org/web/20210823212239/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0206 . 23 August 2021 . 2021-09-07 . eur-lex.europa.eu.
10. Web site: World's first major act to regulate AI passed by European lawmakers . 13 March 2024 . 14 March 2024 . CNBC . 13 March 2024 . https://web.archive.org/web/20240313120308/https://www.cnbc.com/2024/03/13/european-lawmakers-endorse-worlds-first-major-act-to-regulate-ai.html . live .
11. Web site: Browne . Ryan . 2024-05-21 . World's first major law for artificial intelligence gets final EU green light . 2024-05-22 . CNBC . en . 21 May 2024 . https://web.archive.org/web/20240521235907/https://www.cnbc.com/2024/05/21/worlds-first-major-law-for-artificial-intelligence-gets-final-eu-green-light.html . live .
12. News: Coulter . Martin . December 7, 2023 . What is the EU AI Act and when will regulation come into effect? . live . https://web.archive.org/web/20231210214020/https://www.reuters.com/technology/what-are-eus-landmark-ai-rules-2023-12-06/ . 10 December 2023 . 11 January 2024 . Reuters.
13. Web site: Bertuzzi . Luca . 2023-12-07 . AI Act: EU policymakers nail down rules on AI models, butt heads on law enforcement . 2024-01-06 . Euractiv . en-GB . 8 January 2024 . https://web.archive.org/web/20240108215257/https://www.euractiv.com/section/artificial-intelligence/news/ai-act-eu-policymakers-nail-down-rules-on-ai-models-butt-heads-on-law-enforcement/ . live .
14. Web site: Regulating Chatbots and Deepfakes . mhc.ie . Mason Hayes & Curran . en . 11 January 2024 . 9 January 2024 . https://web.archive.org/web/20240109141128/https://www.mhc.ie/hubs/the-eu-artificial-intelligence-act/regulating-chatbots-and-deepfakes-under-the-eu-ai-act . live .
15. Web site: Liboreiro . Jorge . 2021-04-21 . 'Higher risk, stricter rules': EU's new artificial intelligence rules . 2024-01-06 . Euronews . en . 6 January 2024 . https://web.archive.org/web/20240106182629/https://www.euronews.com/my-europe/2021/04/21/the-higher-the-risk-the-stricter-the-rule-brussels-new-draft-rules-on-artificial-intellige . live .
16. live.
17. Web site: European Parliament legislative resolution of 13 March 2024 on the proposal for a regulation of the European Parliament and of the Council on laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act) and amending certain Union Legislative Acts (COM(2021)0206 – C9-0146/2021 – 2021/0106(COD)) . 24 May 2024 . 21 May 2024 . https://web.archive.org/web/20240521164731/https://www.europarl.europa.eu/doceo/document/TA-9-2024-0138_EN.html . live .
18. live.
19. News: Bertuzzi . Luca . November 21, 2023 . EU lawmakers to discuss AI rulebook's revised governance structure . Euractiv . 18 April 2024 . 22 May 2024 . https://web.archive.org/web/20240522124047/https://www.euractiv.com/section/artificial-intelligence/news/eu-lawmakers-to-discuss-ai-rulebooks-revised-governance-structure/ . live .
20. Friedl . Paul . Gasiola . Gustavo Gil . 2024-02-07 . Examining the EU's Artificial Intelligence Act . Verfassungsblog . 10.59704/789d6ad759d0a40b . en-GB . 16 April 2024 . 22 May 2024 . https://web.archive.org/web/20240522124123/https://verfassungsblog.de/examining-the-eus-artificial-intelligence-act/ . live .
21. Web site: 13 March 2024 . Artificial Intelligence Act . European Parliament . 18 April 2024 . 18 April 2024 . https://web.archive.org/web/20240418000949/https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52021PC0206 . live . Article 3 – definitions. Excerpt: "'national competent authority' means the national supervisory authority, the notifying authority and the market surveillance authority;"
22. Web site: 12 December 2023 . Artificial Intelligence – Questions and Answers . 2024-04-17 . European Commission . 6 April 2024 . https://web.archive.org/web/20240406232525/https://ec.europa.eu/commission/presscorner/detail/en/QANDA_21_1683 . live .
23. Tartaro . Alessio . 2023 . Regulating by standards: current progress and main challenges in the standardisation of Artificial Intelligence in support of the AI Act. . European Journal of Privacy Law and Technologies . 1 . 1 . 10 December 2023 . 3 December 2023 . https://web.archive.org/web/20231203233559/https://universitypress.unisob.na.it/ojs/index.php/ejplt/article/view/1792 . live .
24. Web site: EUR-Lex – 52021SC0084 – EN – EUR-Lex . 2023-04-17 . eur-lex.europa.eu . en . 17 April 2023 . https://web.archive.org/web/20230417093353/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021SC0084 . live .
25. Veale . Michael . Borgesius . Frederik Zuiderveen . 2021-08-01 . Demystifying the Draft EU Artificial Intelligence Act — Analysing the good, the bad, and the unclear elements of the proposed approach . Computer Law Review International . en . 22 . 4 . 97–112 . 10.9785/cri-2021-220402 . 2107.03721 . 235765823 . 2194-4164.
26. Casarosa . Federica . 2022-06-01 . Cybersecurity certification of Artificial Intelligence: a missed opportunity to coordinate between the Artificial Intelligence Act and the Cybersecurity Act . International Cybersecurity Law Review . en . 3 . 1 . 115–130 . 10.1365/s43439-021-00043-6 . 258697805 . 2662-9739.
27. Smuha . Nathalie A. . Ahmed-Rengers . Emma . Harkens . Adam . Li . Wenlong . MacLaren . James . Piselli . Riccardo . Yeung . Karen . 2021-08-05 . How the EU Can Achieve Legally Trustworthy AI: A Response to the European Commission's Proposal for an Artificial Intelligence Act . 3899991.
28. Ebers . Martin . Hoch . Veronica R. S. . Rosenkranz . Frank . Ruschemeier . Hannah . Steinrötter . Björn . December 2021 . The European Commission's Proposal for an Artificial Intelligence Act—A Critical Assessment by Members of the Robotics and AI Law Society (RAILS) . J: Multidisciplinary Scientific Journal . en . 4 . 4 . 589–603 . 10.3390/j4040043 . 2571-8800 . free .
29. Almada . Marco . Petit . Nicolas . The EU AI Act: Between Product Safety and Fundamental Rights . 4308072 . 27 October 2023.
30. Romero-Moreno . Felipe . 29 March 2024 . Generative AI and deepfakes: a human rights approach to tackling harmful content . International Review of Law, Computers & Technology . 39 . 2 . 1–30. free . 10.1080/13600869.2024.2324540 . 1360-0869 . free . 2299/20431.
31. Web site: 2020-02-19 . White Paper on Artificial Intelligence – a European approach to excellence and trust . 2024-01-06 . . en . 5 January 2024 . https://web.archive.org/web/20240105090033/https://digital-strategy.ec.europa.eu/en/consultations/white-paper-artificial-intelligence-european-approach-excellence-and-trust . live .
32. Web site: 9 December 2023. Timeline – Artificial intelligence . 6 January 2024 . . 6 January 2024 . https://web.archive.org/web/20240106182627/https://www.consilium.europa.eu/en/policies/artificial-intelligence/timeline-artificial-intelligence/ . live .
33. Web site: 2024-03-13 . Artificial Intelligence Act: MEPs adopt landmark law . 2024-03-14 . European Parliament . en . 15 March 2024 . https://web.archive.org/web/20240315034359/https://www.europarl.europa.eu/news/en/press-room/20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law . live .
34. Web site: David . Emilia . 2023-12-14 . The EU AI Act passed — now comes the waiting . live . https://web.archive.org/web/20240110235258/https://www.theverge.com/2023/12/14/24001919/eu-ai-act-foundation-models-regulation-data . 10 January 2024 . 2024-01-06 . The Verge . en.
35. Web site: 2023-12-11 . Europe agreed on world-leading AI rules. How do they work and will they affect people everywhere? . 2024-05-31 . AP News . en.
36. Web site: EU parliament greenlights landmark artificial intelligence regulations . 2024-05-31 . Al Jazeera . en.
37. Web site: 2024-03-16 . The EU passed the first AI law. Tech experts say it's 'bittersweet' . 2024-05-31 . euronews . en.