Key Notes:
- The EU AI Act is getting close to the final stages of becoming enacted.
- Companies with an EU presence should closely review the terms of the Act.
- All companies, even those without an EU presence, can take guidance from the proposed terms of the EU AI Act and begin to implement practical steps to better manage their use and development of AI.
On Friday, December 8, 2023, the European Union reached a provisional agreement on legislation relating to artificial intelligence (AI), including generative AI, under the Artificial Intelligence Act (the EU AI Act). While this is a critical step in the EU AI Act becoming law, additional work, including finalizing the technical details of the new regulation, will continue. Once finalized, the entire text will need to be confirmed by the EU legislative bodies and formally adopted as law. Companies will then have two years to comply after it is entered into force (with some exceptions for specific provisions).
The EU AI Act is the first legislation of its kind, attempting to strike a balance between allowing innovation and mitigating risks posed by the new technology. The EU AI Act takes a risk-based approach: the higher the risk, the stricter the proposed rules. Summarized here are some of the changes agreed upon in the compromise proposal and the text provisionally approved last week.
Classification of Risk of AI Uses
The definition of AI is narrowed in the compromise proposal to mean “systems developed through machine learning approaches and logic- and knowledge-based approaches.” (Article 3(1).) This narrower definition aims to distinguish AI from more traditional software systems. The compromise text then provides requirements and obligations relating to the use of AI technology, or completely prohibits some uses, based on the risk presented by the AI system.
Unacceptable and Prohibited AI Practices
The compromise text broadened some prohibitions of using AI and narrowed others. In the approved text, the following uses of AI are prohibited under the EU AI Act (Title II, Article 5):
- Subliminal manipulation of persons that results in physical or psychological harm;
- Exploitation of children or mentally disabled persons resulting in physical or psychological harm;
- General purpose social scoring that leads to either or both:
- detrimental/unfavorable treatment in social contexts unrelated to the context in which the data was originally generated or
- detrimental/unfavorable treatment that is unjustified/disproportionate to their social behavior;
- Real-time remote biometric identification systems in publicly accessible spaces by or on behalf of law enforcement unless strictly necessary (as specifically delineated in Article 5).
High-Risk AI Systems
The EU AI Act intends to provide regulation regarding AI systems that pose a risk of harm to the health and safety of individuals or that pose a risk of adverse impact on fundamental rights. The compromise text removed some of the high-risk use cases, added two new ones, and fine-tuned others. In the compromise text, the following uses and practices using AI technology are considered high-risk under the EU AI Act (Title III (and Annexes II and III)) and require varying levels of requirements and obligations for a technology to gain access to the EU market.
- Safety components of regulated products (such as medical devices and machinery);
- Remote biometric identification systems;
- Management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating, and electricity;
- Education and vocational training (including determining access and admission as well as evaluating learning outcomes);
- Employment, worker management, and access to self-employment, including:
- Recruiting or selecting individuals for jobs, including placing targeted job advertisements, analyzing and filtering job applications, and evaluating candidates; and
- Making decisions on promotions and terminations, allocating tasks based on individual behavior or traits, and monitoring and evaluating performance;
- Access to and enjoyment of essential private services and public services and benefits, including:
- Evaluating eligibility for, granting, reducing, revoking, or reclaiming benefits or services;
- Evaluating creditworthiness and established credit score (with specific exceptions);
- Dispatching or establishing priority in dispatching emergency first response services; and
- Assessing risk and establishing pricing for life and health insurance (with specific exceptions).
- Law enforcement use cases;
- Migration, asylum, and border control management use cases; and
- Administration of justice and democratic processes, including use by a judicial authority to interpret facts or law and apply law to a concrete set of facts.
Requirements for High-Risk AI Systems
If you are using or developing a high-risk AI system, the compromise text has clarified and adjusted the requirements and responsibilities of various actors within the AI ecosystem (Chapter 2, Articles 8-15). These requirements provide detailed obligations surrounding:
- Implementing, documenting, and maintaining a risk management system, including risks to health, safety, and fundamental rights (Article 9);
- Data and data governance, including specific practices on data quality, training, validation, and testing (Article 10);
- Technical documentation of the high-risk AI system (Article 11);
- Automated record-keeping that ensures a level of traceability of the AI system’s functioning (Article 12);
- Transparency to end-users of the AI system (Article 13);
- Human oversight of the design, development, and use of the AI system (Article 14); and
- Accuracy, robustness, and cybersecurity of the AI system (Article 15).
The EU AI Act will further provide specific guidance to providers of high-risk AI systems beyond those listed above, including quality management and record-keeping requirements, and then break down responsibilities throughout the AI supply chain, with requirements and obligations on importers, distributors, and users of high-risk AI systems. The Act further imposes additional transparency obligations for certain AI systems, including a requirement to inform users if the AI system includes capabilities of identifying or inferring emotions, psychological states, or intentions of the user.
General Purpose AI and Foundation Models
The compromise text adds a new section to the EU AI Act regarding general-purpose AI that has uses not considered prohibited or high risk. Under the compromise text, the law will take into account that a general-purpose AI system could be used as high-risk or as a component of high-risk AI systems, and an additional implementing act will address the specific requirements the general-purpose AI will need to follow based on further consultation and detailed impact assessments that take into account the specific characteristics of the AI systems under consideration. For other general-purpose AI systems, the compromise text notates the sections of the provider obligations that are relevant for compliance purposes (including conformity assessment procedures, registration obligations, appointing an authorized representative, and post-market monitoring proportion to the risks of the AI system).
With the proliferation of AI tools such as ChatGPT, the recent negotiations included significant discussions of how large language models that can generate new content (generative AI), also called foundation models, will be regulated under the Act. In the compromise text, specific rules have been agreed upon relating to these foundation models similar to those for high-risk AI uses, including technical documentation requirements, transparency obligations, including summaries of copyrighted material included in training data, and disclosure requirements where foundational models have been used in creating content.
Governance Over the EU AI Act and Penalties for Violations
The EU AI Act will establish an AI Office, advised by a panel of independent experts, to advise on developing methodologies for evaluating AI systems’ foundation models and possible related risks, as well as a European Artificial Intelligence Board to advise on and assist consistent and effective application of the EU AI Act. The EU AI Act also contains fines for violations set as a percentage of the offending company’s worldwide annual turnover for the preceding financial year: the greater of up to €35 million or 7% for violations of the prohibited AI applications; up to €15 million or 3% for violations of the AI Act’s obligations; and up to €7.5 million or 1.5% for the supply of incorrect, incomplete, or misleading information. These caps are reduced for small and medium enterprises, including startups.
Actions to Take
While the details of the EU AI Act will be further refined and finalized, there are steps companies can begin taking now, depending on their relationship with AI.
All Companies with EU presence: Review and understand which AI use cases are prohibited and which AI use cases are considered high-risk and assess how they relate to the development and use of technology within your organization. Closely review the EU AI Act with an attorney to develop a compliance strategy.
Companies with EU presence that will use AI in high-risk use cases: Review the requirements found within the EU AI Act to understand the requirements and obligations that will apply to your use cases, and conduct a gap assessment of your practices for documenting current technology and evaluating new technology to identify where process changes might be needed.
Companies that develop AI technology: If you ultimately intend for your technology to be available within the EU, closely review the proposed regulation with an attorney to develop a compliance strategy.
All companies: The EU AI Act provides a framework for evaluating and assessing AI technology and offers a glimpse at the types of documentation, impact assessments, and record requirements that might come into play as other governing bodies begin to create their AI legislation. If you haven’t already done so, consider amending your internal policies to address and set guidelines surrounding the development and usage of AI technology within your company.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.
© 2023 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
