The European Union has reached a historic agreement on the world's first comprehensive set of rules to regulate AI. The legislation, known as the AI Act, sets a new global benchmark for countries seeking to harness the potential benefits of AI while trying to protect against its possible risks.

The main new elements of the provisional agreement can be summarised as follows:

General purpose AI (GPAI) systems: The agreement specifies that GPAI must follow the transparency criteria outlined by Parliament. These encompass creating technical documents, abiding by EU copyright regulations, and distributing comprehensive overviews of the content utilised for training these models.

When it comes to the high-impact GPAI models with systemic risk, they will face extensive obligations, including evaluation, risk assessment, cybersecurity, and energy consumption reporting. At the same time, lawmakers agreed that the codes of conduct would serve as supplementary guidelines for GPAIs with systemic risk until technical standards are harmonised.

High-Risk Use Cases:A consensus was reached on the roster of high-risk AI applications, with a focus on safeguarding individuals' safety and fundamental rights, with a mandatory fundamental rights impact assessment. Citizens will have the right to fail complaints regarding AI systems and to receive clarifications about decisions influenced by high-risk AI systems that affect their rights.

National security: The act will not apply to systems that are used for military or defence purposes.

Governance:An EU AI office will be established within the commission to enforce foundational model rules, with national authorities overseeing AI systems through the European Artificial Intelligence Board (EAIB) for consistent application of the law. An advisory forum will gather feedback from stakeholders. A scientific panel of independent experts will advise on enforcement, identify systemic risks, and contribute to classifying AI models.

Prohibited Practices:The AI Act prohibits applications posing risks to citizens rights such as:

• Biometric categorisation systems that use sensitive characteristics ( including political, religious, philosophical beliefs, sexual orientation, and race),
• Untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases,
• Emotion recognition in the workplace and educational institutions,
• Social scoring based on social behaviour or personal characteristics;
• AI systems that manipulate human behaviour to circumvent their free will, and
• AI used to exploit the vulnerabilities of people (due to their age, disability, social or economic situation).

Law Enforcement Exceptions:Narrow law enforcement exceptions were introduced in terms of real-time remote biometric identification (RBI). These exceptions will be subject to judicial authorisation primarily and for strictly defined lists of crimes including:

• Targeted searches of victims (abduction, trafficking, sexual exploitation),
• Preventing terrorism, and
• The localisation or identification of a person suspected of having committed one of the specific crimes mentioned in the regulation such as terrorism, trafficking, sexual exploitation, murder, kidnapping, rape, armed robbery, participation in a criminal organisation, and environmental crimes.

The AI Act is expected to come into force no earlier than 2025, requiring EU countries to formalise or create a national AI regulator on top of a European watchdog.

Why does it matter?

The legislation needs to go through a few final steps for final endorsement, but the political agreement means its key elements have been approved. The AI Act is a significant step in the EU's efforts to bring a new level of oversight to tech, akin to regulation of the healthcare or banking industries. With the EU being the first to set rules on AI, this legislation could represent a standard and a model to follow for many other jurisdictions around the world, which could fuel another Brussels effect.