Today, on 21 May, the European Council gave its final approval to the Artificial Intelligence (AI) Act, a pioneering legislation aimed at harmonizing rules on AI across the EU. The law adopts a risk-based approach, meaning the stricter the regulations, the higher the potential harm to society. As the first comprehensive AI regulation globally, it sets a new standard for AI governance.

Objectives of the AI Act

The AI Act aims to promote the development and adoption of safe and trustworthy AI systems within the EU's single market. This includes both private and public sector applications. It seeks to safeguard the fundamental rights of EU citizens while encouraging investment and innovation in AI across Europe. The act applies exclusively to areas within EU jurisdiction, with exemptions for military, defence, and research purposes.

Key provisions of the AI Act

Classification of AI systems by risk

The AI Act categorises AI systems based on their risk levels. Low-risk AI systems will face minimal transparency requirements, whereas high-risk AI systems must meet stringent criteria to be approved for use in the EU. Certain AI applications, such as cognitive behavioural manipulation and social scoring, are banned outright due to their unacceptable risks. The legislation also prohibits AI use in predictive policing based on profiling and systems that categorise individuals by biometric data, such as race, religion, or sexual orientation.

General-purpose AI models

The regulation also addresses general-purpose AI (GPAI) models. GPAI models that do not pose systemic risks will be subject to limited transparency requirements. However, those deemed to have systemic risks must adhere to stricter regulations.

Governance and enforcement

To ensure effective implementation, the AI Act establishes several governing bodies:

• An AI Office within the European Commission to enforce the rules.
• A scientific panel of independent experts to support enforcement activities.
• An AI Board consisting of representatives from member states to advise on the consistent application of the AI Act.
• An advisory forum for stakeholders to provide technical expertise.

Penalties for non-compliance

Infringements of the AI Act will result in fines based on a percentage of the offending company's global annual turnover from the previous financial year or a predetermined amount, whichever is higher. Small and medium-sized enterprises (SMEs) and start-ups will face proportional administrative fines.

Transparency and fundamental rights protection

Before deploying high-risk AI systems in public services, entities must assess their impact on fundamental rights. The regulation mandates increased transparency in the development and use of high-risk AI systems. These systems, along with certain public entities using them, must be registered in the EU database for high-risk AI systems. Users of emotion recognition systems are required to inform individuals when such systems are in use.

Next Steps

The legislative act will be signed by the presidents of the European Parliament and the Council. It will then be published in the EU's Official Journal and will enter into force twenty days later. The new regulation will become applicable two years after its entry into force, with specific timelines for various provisions: prohibited practices will apply six months after the entry into force date; codes of practice will be implemented nine months after the entry into force; rules and governance for general-purpose AI will take effect twelve months after the entry into force; and obligations for high-risk systems will be enforced thirty-six months after the entry into force.