EU Regulation: the Artificial Intelligence Act

The European Parliament and the European Commission are now aiming for fall 2023 to reach an agreement on the final version of the new AI Act. The AI Act will be the first law on this technology and is meant to set a global standard for AI regulation worldwide. The goal of the AI Act is to enable the benefits of AI to develop even further, and to mitigate the risks that accompany the development of AI. The AI Act is all about finding the right balance between both innovation and regulation.

The AI Act will have a great impact on businesses as it defines a new legal framework for AI. The AI Act consists of a risk-based approach. It defines different cases of AI use based on certain risk levels:

1. Unacceptable risk
2. High risk to health, safety, or the fundamental rights of individuals
3. Transparency risk
4. Low or minimal risk

Based on these levels of risk the commission proposes different levels of regulatory measures. Firstly, AI applications that create an unacceptable risk will be prohibited under the AI Act. One example of this would be the government-run AI surveillance in China, where facial recognition AI is used to fine and shame jaywalkers. For obvious reasons this is a very undesirable application of AI and will be banned by the EU’s AI Act.

Secondly, applications that create a high risk to health, safety, or fundamental rights, such as AI systems in medical devices, will be permitted. However to ensure the safety of the AI application, the AI Act contains various compliance measures with certain mandatory requirements, such as risk and quality management systems, data governance of data sets, and a conformity assessment prior to its placement on the market.

Thirdly, transparency risk in the Act covers AI applications like chatbots or deepfakes. The proposed AI Act states that they are permitted subject to certain information obligations. Providers of such AI systems need to notify users that they are interacting with AI systems and that the data are recognised or generated through automated means. This could be a warning on Instagram, for example, when scrolling through so-called “reels” which predict what content the user might like.

Lastly, the low or minimal risk category faces no new restrictions in the new AI Act. However, providers of such AI systems are encouraged to voluntary implement codes of conduct so they meet the requirements as set forth for high risk AI systems as well.

Considering the proposed AI Act is still in the legislative progress and needs to be reviewed by the European Commission and the European Parliament, we will have to wait on the final version of the text. However, we recommend that companies developing or using AI systems to anticipate and take proactive steps to comply with the requirements in the upcoming AI Act.

---

Photo: phonlamaiphoto - stock.adobe.com