EU AI Act: The wording of the act is finalised

The European Parliament and Council negotiators announced they have reached a provisional agreement on the Artificial Intelligence Act. This effectively cements the EU AI Act, paving the way to legislation. The agreed text still has to be formally adopted by both Parliament and Council to become EU law.

Co-rapporteur Brando Benifei (S&D, Italy) said: “It was long and intense, but the effort was worth it. Thanks to the European Parliament’s resilience, the world’s first horizontal legislation on artificial intelligence will keep the European promise – ensuring that rights and freedoms are at the centre of the development of this ground-breaking technology.”

Among the significant areas covered by the EU Act are so-called high-risk systems that can have a negative impact on EU citizens. The act includes a mandatory fundamental rights impact assessment, among other requirements, which is applicable to sectors including insurance and banking. AI systems used to influence the outcome of elections and voter behaviour are also classified as high-risk. The act gives EU citizens the right to launch complaints about AI systems and receive explanations about decisions based on high-risk AI systems that affect their rights.

The AI Act also includes guardrails for general purpose AI, meaning that developers of such systems need to draw up technical documentation, ensure the AI complies with EU copyright law, and share detailed summaries about the content used for training.

Along with these guardrails, the EU AI Act has attempted to limit the use of biometric identification systems by law enforcement. Biometric categorisation systems that use sensitive characteristics (e.g. political, religious, philosophical beliefs, sexual orientation, race) are prohibited. The untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases is also banned, as is emotion recognition in the workplace and educational institutions and social scoring based on social behaviour or personal characteristics.

Fines for non-compliance range €35m or 7% of global turnover to €7.5m or 1.5% of turnover.

Co-rapporteur Dragos Tudorache (Renew, Romania) said: “The EU is the first in the world to set in place robust regulation on AI, guiding its development and evolution in a human-centric direction. The AI Act sets rules for large, powerful AI models, ensuring they do not present systemic risks to the European Union, and offers strong safeguards for our citizens and our democracies against any abuses of technology by public authorities.

“It protects our SMEs, strengthens our capacity to innovate and lead in the field of AI, and protects vulnerable sectors of our economy. The European Union has made impressive contributions to the world; the AI Act is another one that will significantly impact our digital.”

Discussing the data privacy issues covered in the AI Act, David Dumont, who heads up the data privacy practice at Hunton Andrews Kurth in Brussels, said: “AI-driven products and services typically require the processing of a significant amount of personal data creating a clear tension between use of that data and some of the GDPR’s key data protection principles.

“However, it should be possible to develop and deploy AI products and services in a GDPR-compliant manner, which is why the EU AI Act is so important as it creates a more robust legal framework for businesses to work within going forward.”

The German AI Association also issued a statement raising its concerns over the guardrails the EU AI Act puts in place around general purpose AI systems. While the text of the EU AI Act refers to more robust and durable criteria, such as the number of business users in the EU, the German AI Association said that it does not yet satisfactorily address the need for a predictable, future-proof framework.