The Law of Artificial Intelligence in the EU: a comprehensive framework for the regulation of AI

The industrial and digital revolutions have significantly transformed almost every aspect of our lives. With the rapid advancement of artificial intelligence (AI) technologies, there is a growing need for a regulatory framework to address the challenges posed by these applications. The European Union has responded to this need with the Artificial Intelligence Act (AI Act), a pioneering regulation designed to classify and oversee AI systems. This article explores the key aspects of this new legislation, its legislative process and the practical implications for the development and use of AI in the EU.

Legislative process for the AI Act

The journey towards the AI Act began in December 2018, when the High-Level Expert Group on AI presented a draft of the Ethical Guidelines for Trustworthy AI. Following years of research and consultation, the European Commission published a proposal on 21 April 2021 entitled «Proposal for a Regulation laying down harmonised rules on AI».

Key milestones in the legislative process:

• February 2020: Publication of the European Commission’s White Paper
• October 2020: European Parliament report on ethical principles, civil liability and intellectual property in relation to AI
• June 2023: Proposal for the AI Act and the start of negotiations between EU institutions
• 13 March 2024: Adoption of the AI Act by the European Parliament

The AI Act came into force on 1 August 2024, with most of its provisions taking effect two years later.

Key objectives of the AI Act

The AI Act is not simply a set of restrictions, but a comprehensive framework designed to foster responsible innovation in AI. The main objectives of this regulation are:

1. Ensuring security and legal compliance: To ensure that AI systems placed on the EU market are safe and comply with existing EU legislation.
2. To provide legal certainty: To facilitate investment and innovation in AI by establishing a clear and predictable regulatory framework.
3. Improving governance: To strengthen the effective enforcement of EU legislation on fundamental rights and security requirements applicable to AI systems.
4. To facilitate the development of the single market: To promote the development of lawful, secure and trustworthy AI applications, whilst preventing market fragmentation.

The risk-based approach: classification of AI systems

One of the most notable features of the AI Act is its risk-based approach. This approach classifies AI systems into four tiers, each with different requirements and obligations:

1. AI systems posing an unacceptable risk

These systems are prohibited because of the unacceptable threat they pose to people’s fundamental rights. They include:

• Systems that use subliminal, manipulative or deceptive techniques.
• Systems that exploit vulnerabilities linked to age, disability or socio-economic circumstances.
• Biometric classification systems that infer sensitive attributes.
• Social scoring systems.
• Real-time remote biometric identification systems in public spaces for law enforcement purposes (with limited exceptions).

2. High-risk AI systems

These systems are not banned, but they must meet strict requirements before they can be placed on the market. AI systems used in areas such as the following are considered high-risk:

• Critical infrastructure
• Education and vocational training
• Employment and staff management
• Access to essential private and public services
• Law enforcement
• Migration, asylum and border control management
• The administration of justice and democratic processes

3. Limited-Risk AI Systems

These systems have specific transparency requirements. For example, chatbots must inform users that they are interacting with an AI.

4. AI systems with minimal or no risk

Most AI applications fall into this category and can be used freely.

Requirements for high-risk AI systems

AI system providers classified as high-risk must meet a series of strict requirements:

1. Risk assessment and mitigation: Carry out comprehensive assessments of potential risks and implement mitigation measures.
2. Data quality: To ensure the quality of the datasets used, in order to minimise risks and prevent discriminatory outcomes.
3. Traceability: Keep detailed activity records to ensure the traceability of results.
4. Documentation: Provide comprehensive documentation containing all the necessary information about the system and its purpose for regulatory assessment.
5. User information: To provide clear and comprehensive information to the user or system implementer.
6. Human supervision: Implement appropriate measures for human supervision to mitigate risks.
7. Durability and safety: To ensure a high level of system reliability, security and accuracy.

General-purpose AI (GPAI)

The AI Act also addresses general-purpose AI (GPAI) systems, which are capable of performing generally applicable functions such as image and speech recognition, audio and video generation, pattern detection, question answering, translation, etc.

The law sets out specific requirements for these systems:

• All suppliers of GPAI models must provide technical documentation and instructions for use.
• They must comply with the Copyright Directive.
• They are required to publish a summary of the content used to train the model.

Providers of open-source GPAI models need only comply with copyright requirements and publish the training data summary, unless they pose a systemic risk.

For GPAI models that pose a systemic risk, whether open-source or proprietary, the following is also required:

• Carry out model evaluations
• Conduct adversarial testing
• Tracking and reporting serious incidents
• Ensuring cybersecurity safeguards

Compliance and marketing process

For high-risk AI systems, the compliance and marketing process involves several steps:

1. Conformity assessment: The system must undergo a thorough assessment to ensure that it meets all the requirements set out in the AI Act.
2. Compliance with requirements: The supplier must ensure that the system complies with all the AI requirements set out in the regulation.
3. Registration: The system must be registered in an EU database set up for this purpose.
4. Declaration of Conformity: The supplier must sign a declaration of conformity.
5. CE marking: The AI system must bear the CE marking, which indicates its compliance with the regulations.

Only once these steps have been completed can the AI system be placed on the EU market.

It is important to note that conformity is not a one-off process. Throughout the system’s life cycle, it must undergo continuous assessment. If significant changes occur, the system must undergo the conformity assessment process again, including all subsequent steps.

Practical implications and challenges

The implementation of the AI Act presents both challenges and opportunities for businesses, developers and users of AI:

1. Process adaptation: Companies and developers will need to adapt their development and marketing processes to comply with the new requirements.
2. Investment in compliance: A significant investment in resources will be required to ensure compliance, particularly for high-risk systems.
3. Responsible innovation: The AI Act promotes responsible innovation, which could lead to the development of safer and more reliable AI systems.
4. Global competitiveness: Companies that comply with the AI Act could gain a competitive advantage in the global market, as the EU is setting a standard that could influence regulations in other regions.
5. Transparency and trust: The implementation of the AI Act could increase transparency and public confidence in AI systems, which could accelerate their adoption across various sectors.
   
   The AI Act represents a significant milestone in the regulation of artificial intelligence. By establishing a comprehensive framework for the development and use of AI systems, the EU is laying the foundations for a future in which technological innovation goes hand in hand with the protection of fundamental rights and the safety of citizens.

Whilst the implementation of this regulation will present challenges, it also offers a unique opportunity for Europe to lead the way in the ethical and responsible development of AI. As we move towards an era increasingly defined by artificial intelligence, the AI Act will serve as a crucial model for balancing technological innovation with the protection of society’s fundamental values.

Businesses, developers and legal professionals will need to familiarise themselves thoroughly with these new rules in order to navigate successfully the emerging regulatory landscape for AI in Europe. The AI Act will not only transform the way AI is developed and used in the EU, but could also have a significant influence on regulatory approaches in other regions of the world.