Today marks the entry into force of the EU Artificial Intelligence Act (the “AI Act”), a landmark regulation that sets out a comprehensive framework for the development, deployment, and use of AI systems and AI-generated outputs in the European Union. As we previewed in our client update back at the end of 2023, this is a broad-reaching regulation, covering both traditional and generative AI. The AI Act applies to any person or company that develops, sells, or uses AI systems in the EU, as well as any output from an AI system that is used in the EU, regardless of where the AI systems are developed or used.
The AI Act introduces a number of obligations and prohibitions for AI systems and general-purpose AI models, with obligations varying based on the amount of risk associated with the AI system and use case. It also establishes a governance structure at the EU level, as well as market surveillance and enforcement mechanisms to ensure compliance and address potential risks. Non-compliance faces potentially significant penalties, which can reach up to the greater of €35 million or 7% of the total worldwide annual turnover. Below is an overview of the scope of the AI Act and key compliance dates to be tracked.
What Is an AI System Under the AI Act?
Before diving into some details behind the AI Act, the following definitions are critical to understanding and evaluating the potential applicability of the regulation on an organization.
- An AI system is “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” (AI Act Art. 3(1).)
- A general-purpose AI model is “an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market.” (AI Act Art. 3(63).)
Who Does the AI Act Apply To?
The AI Act has a broad reach, applying to:
- Providers: any person, public authority, agency, or company that develops an AI system or has an AI system developed that is under its authority
- Deployers/Users: any person, public authority, agency, or company that uses an AI system under its authority
- Importers: any person or company established in the EU that places on the market or puts into service an AI system from a person established outside the EU
- Distributors: any person in the supply chain, other than a provider and importer, that makes an AI system available in the EU
Most broadly, the AI Act applies to any output produced by an AI system and used in the EU.
How Are AI Systems Categorized Under the AI Act?
The AI Act utilizes a risk-based approach in regulating AI systems, distinguishing between four levels of risk:
-
Unacceptable risk (prohibited): AI systems that include unacceptable risk are specifically enumerated in Article 5. Examples of unacceptable risk are if an organization is using an AI system for:
- Social scoring for public and private purposes
- Biometric categorization of people to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, or sexual orientation
- Subliminal manipulation to influence a person’s decisions or behavior
- Emotion recognition in the workplace and education institutions unless for medical or safety reasons (e.g., monitoring tiredness levels of a pilot would be an exception to this prohibition)
-
High-risk (extensive compliance requirements): High-risk AI systems are those that may pose significant risks to the health, safety, or fundamental rights of persons or the environment (including AI systems used in biometrics, educational training, recruitment, law enforcement, and migration). Examples of high risk are if an organization is using an AI system:
- To evaluate learning outcomes, steer the learning process, or monitor cheating
- To analyze and filter job applications or evaluate candidates
- In critical infrastructure (e.g., road traffic or the supply of water, gas, heating, and electricity)
- To provide access to essential private and public services and benefits (e.g., healthcare), evaluate creditworthiness for individuals, or to conduct risk assessment and pricing relating to life and health insurance
-
Limited risk (transparency requirements): Limited risk AI systems are those where AI use is not prohibited or high-risk, but still presents a risk due to a potential lack of transparency of the presence/usage of AI. Examples include AI systems where there is a clear risk of manipulation, such as:
- Chatbots: AI systems that are designed to converse with human beings; humans should be aware when they are interacting with machines.
- Deepfakes: AI systems that can generate or manipulate content such as audio or video must be marked and identifiable.
-
Minimal risk (no obligations): AI systems that pose little or no risk to the health, safety, or fundamental rights of people or the environment. The EU anticipates that the vast majority of AI systems will fall into this category. Examples of minimal risk include
- AI-enabled video games
- AI-enabled spam filters
- AI-enabled text editors where the substance/content is not automatically altered
Both developers and users of high-risk AI systems have the most cumbersome compliance journey, as they must comply with strict requirements for risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness, recordkeeping, among others.
Important Dates
Among the various dates within the AI Act, below are important milestones and deadlines:
- July 20, 2024: Publication date of the AI Act in the Official Journal of the European Union
- August 1, 2024: AI Act enters into force (20th day following publication in the Official Journal)
- February 2, 2025: Any AI systems or tools that are prohibited under the AI Act must be modified to no longer contain prohibited practices or removed from the EU market by this date. There are no exceptions to this deadline in the AI Act for preexisting AI systems, models, or tools that contain prohibited AI practices.
- August 2, 2025: The development and use of general-purpose AI models must be compliant with the AI Act by this date. Additionally, the EU AI Office will begin creating codes of practice for high-risk AI systems, with an aim for such codes of practice to be ready by May 2, 2025.
- Exception: General-purpose AI models that are in place on the EU market before August 2, 2025 will have until August 2, 2027 to comply.
- August 2, 2026: Date the majority of the provisions of the AI Act go into effect. Developing and using any AI, except for high-risk AI, must be compliant by this date.
- August 2, 2027: Obligations for high-risk AI systems go into effect. All development and use of high-risk AI systems must be compliant by this date.
- Exception: High-risk AI systems that are in place on the EU market before August 2, 2026 will have until August 2, 2030 to comply.
FOR MORE INFORMATION
This is a quickly evolving area which includes recent state legislative activity in the United States, and we will be providing further updates. If you have questions as to whether you are covered under the AI Act or ready to start developing your compliance strategy as either a developer or user of AI, please reach out to Julie Honor or any member of our AI practice.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgement of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2024 THOMPSON HINE LLP. ALL RIGHTS RESERVED.