News, views and reports

The latest updates on the EU AI Act

Council of the EU

The Council adopted its position on the EU AI Act in December 2022.

The Council of the EU:

• Narrowed down the definition of AI systems to “systems developed through machine learning approaches and logic- and knowledge-based approaches”;
• Extended the prohibition on using AI for social scoring to private actors;
• Imposed requirements on general-purpose AI systems;
• Simplified the compliance framework;
• Strengthened the role of the European AI Board.

European Parliament

On 14 June 2023, the Parliament adopted its position on the EU AI Act. Most notably, the Members of the European Parliament extended the list of prohibited AI systems and amended the definition of AI systems to align with that of the OECD.

Prohibited AI systems

The European Parliament’s position:

• Fully bans the use of biometric identification systems in the EU for real-time and ex-post use. Exceptions are used in the case of severe crime and pre-judicial authorisations for ex-post use;
• Includes biometric categorisation systems using sensitive characteristics in the prohibitedAI system classification;
• Also includes in this category the predictive policing systems, emotion recognition systems, and AI systems using indiscriminate scraping of biometric data from CCTV footage to create facial recognition databases.

High-risk AI systems

The European Parliament’s position:

• Adds the requirement that systems must pose significant harm to citizens’ health, safety, fundamental rights, or the environment to be considered high-risk;
• Includes systems used to influence voters and the outcomes of elections on the list of high-risk AI systems.

Additionally, the European Parliament wants to facilitate innovation and support for SMEs which might be troubled with the barrage of new rules. Therefore, the Parliament:

• Added exceptions for research activities and components of AI that are provided under open-source licences and promote the use of regulatory sandboxes;
• Wants to set up an AI complaints system for citizens and establish an AI Office for the oversight and enforcement of foundation models and, more broadly, general-purpose AI (GPAI);
• Strengthened national authorities’ competencies.

Lastly, the Parliament also introduced the concept of foundation models in the text and set a layered regulation on transparency requirements, safeguards, and copyright issues.

Foundation models are large machine-learning models, which are pre-trained on large amounts of data sets to learn language patterns, facts and reasoning abilities and generate output based on specific stimuli. GPAI refers to AI systems which can be adapted to a wide range of applications. GPAI, GAI and foundation models are often used interchangeably as the terms overlap and the terminology is still evolving.

Three-way negotiations

With both the Council and the Parliament having adopted their position, the interinstitutional negotiations (trilogues) have now started. The first trilogue of 14 June 2023 was mainly symbolic, while the following proved to be more of substance.

In the trilogue that followed on 18 July the EU Institutions discussed innovation, sandboxes, real-world testing, fundamental rights impact assessment and started with the classification of high-risk AI systems. However, this was just the tip of the iceberg.

Later trilogues on 2-3 October and 24 October were mostly centred around clearing the requirements and obligations for providers of high-risk AI. A new ‘filter approach’ was introduced for the classification for high-risk AI, which would allow exceptions for AI developers to avoid high-risk classification when they would perform “purely accessory” tasks and let them decide whether their AI systems would fall under it. These include:

• A narrow procedural task;
• Merely confirming or improving an accessory factor of human assessment;
• Performing a preparatory task.

A criterion on decision-making patterns that AI systems should not be intended to substitute for or impact a previous human evaluation without “proper human review” was also added to the filter approach. However, AI-systems that use profiling would always be considered high-risk.

Turning to regulatory sandboxes, these were approved with the exception for real-world testing which remains a point of contestation. The EU institutions also made compromises on market surveillance and enforcement, penalties, and fines.

A tiered approach

Additionally, the institutions started shaping a ”tiered approach’ for GPAI, foundation models and “high impact foundation models”. This approach would introduce tighter regulation, with the most powerful ones having a higher potential for systemic risks, such as ChatGPT, and are therefore subject to even stronger market obligations. An AI office would provide centralised oversight. However, the Council and Parliament remained at odds regarding the prohibitions of AI systems and exemptions for law enforcement and national security.

Developments around the EU AI Act continue to evolve quickly. On 6 November it became known that the European Parliament circulated a compromise text scrapping the complete ban on real-time remote biometric identification (RBI) in exchange for concessions on other parts of the file such as a longer list of banned AI applications.

The discussions regarding foundation models and GAI remain a politically charged topic, with concerns that a stalemate might be inescapable. Countries such as France, Italy and Germany are pushing back, fearing overregulation that could kill companies and competition.

What happens next?

The next trilogue is scheduled for 6 December. EU policy makers are intensifying efforts to ensure that the EU AI Act will be closed at the end of this year. The Spanish Presidency of the Council of the EU has underlined the ambition to finalise the file by the end of 2023. There are a few more technical meetings planned to tackle the most complex elements.

After the agreement between the EU institutions, the legislation will be published and come into force about two years later, at the end of 2025 or early 2026. There are still several contentious areas with questions that are yet to be answered. These include: prohibited AI systems and their exemptions for law enforcement and national security, foundation models and GPAI, fundamental rights assessments, the AI Office, the definition of AI, real-world testing of AI systems and the definitive list with high-risk AI systems (Annex III).

The EU AI Act: what are the implications for your business?

The EU AI Act will apply to all the parties involved in the development, deployment, and use of AI. It is therefore applicable across various sectors and will also apply to those outside of the EU if the products are intended to be used in the EU.

Risks and challenges

Member States will enforce the regulation and ensure businesses are compliant. Moreover, penalties may be given for non-compliance with the AI regulation, up to 30 million euros or 6% of the total annual turnover of a company. However, the regulation considers the interests of small-scale providers, start-ups, medium-sized enterprises (SMEs) and their economic viability.

Businesses or public administrations that develop or use AI systems that fall under high-risk, would have to comply with specific requirements and obligations. The risk assessment indicates that compliance with the new rules would cost approximately €6,000 to €7,000 companies for an average high-risk AI system worth €170,000 by 2025. Moreover, additional costs may come for human oversight and verification.

However, businesses that develop or use AI systems that are not high-risk would merely have minimal information obligations.

Opportunities

The EU AI Act will establish a framework that ensures trust in AI for customers and citizens. Additionally, it aims to promote investments and innovations in AI, for example, by providing regulatory sandboxes. These sandboxes establish a controlled environment to test innovative technologies for a limited time under oversight. Special measures are also in place to reduce regulatory burden and to support SMEs and start-ups.

What now?

It is advisable that businesses consider whether they use AI systems or models and asses the risks associated with it. Moreover, businesses should also consider the different obligations and requirements set for AI systems of different risk levels and consider drafting a Code of Conduct. Additionally, businesses could look how to improve AI proficiency by brushing up on AI-related knowledge and competences. Lastly, businesses should actively follow the developments around the EU AI Act and prepare accordingly.

Learn more about our EU AI-related services

Publyon offers tailor-made solutions to navigate the evolving policy environment at the EU level and anticipate the impact of the EU AI-related legislation on your organisation. Would you like to know more about how your organisation can make the most out of the AI legislation in the EU? Make sure you do not miss the latest developments by subscribing to our EU Digital Policy Updates. If you’re intrigued by the EU’s latest efforts to regulate Artificial Intelligence, you can contact our AI expert, Mr. Guillaume Baudour (g.baudour@publyon.com).