The EU AI Act was passed, becoming the first regulation on artificial intelligence in the world

Executive Summary

• On 9 December 2023, the European Parliament and the Council Presidency agreed on the final version of the Artificial Intelligence Regulation, the so-called “EU AI Law”.
• This regulation establishes harmonized standards for the commercialization, commissioning and use of Artificial Intelligence, which is intended to be a prototype of regulations that would influence the development of laws in other jurisdictions.
• There are still a number of legislative steps pending before this law comes into force, which will be applicable two years later, potentially in 2026.

On 9 December 2023, the European Parliament and the Presidency of the Council agreed on the final version of the Artificial Intelligence Regulation, the so-called “EU AI Law”.

This regulation establishes harmonized standards for the marketing, commissioning and use of Artificial Intelligence (“AI”), through a risk-based approach, in which the higher the risk of rights violation, the stricter the restrictions.

The EU AI Act is intended to be a prototype for AI legislation, which would influence lawmaking in other jurisdictions, the so-called “Brussels Effect”. However, there are still a number of legislative steps pending before the EU AI Act comes into force, which will be applicable two years later, potentially in 2026.

The EU AI Law will apply to AI systems used, marketed and/or put into service, except for those intended for scientific research and development. The EU AI Law divides AI systems into four risk categories, based on their intended use and purpose, which are as follows:

1. Unacceptable Risk:
   • Dark patterns
   • Handling
   • Social Score
   • Biometric identification, for law enforcement (with some exceptions)

2. High risk:
   • Biometrics
   • Critical information infrastructures, road traffic, and the supply of water, gas and electricity
   • Education
   • Job vacancies
   • Essential private and public services
   • Application of the law
   • Migration, asylum, and border control management
   • Administration of justice and democratic processes

3. Limited Risk:
   • “Chatbots”
   • Biometric categorization systems and emotion identification systems
   • “Deep fakes”

4. Minimum Risk:
   • Other AI systems

AI systems will have to comply with the requirements and obligations applicable to their risk category. In a top-down analysis, Unacceptable Risk technologies are prohibited, except for biometric identification systems, provided that they meet certain conditions for their use. As for High Risk tools, they will have to obtain a conformity assessment from a third party, which means that the third party will verify whether the requirements established for high-risk AI systems are met. As for Limited Risk systems, they will have to ensure that users understand and use the system properly; this is the transparency standard. As for Minimal Risk technologies, they are encouraged to voluntarily comply with certain requirements established in the Codes of Conduct that will be drafted and published by the European Commission.

To whom will the EU AI Law apply?

The EU AI Law will apply, regardless of their physical location or place of establishment, to users, importers, distributors, product manufacturers and suppliers who place AI systems on the market or put them into service, only if the AI ​​system is used or produces its effects in the European Union.

Sanctions

Failure to comply with the provisions contained in the EU AI Act may be subject to administrative fines of up to €35 million or 7% of the total annual worldwide business of the previous fiscal year.

Important considerations

The EU AI Act is a milestone in the race to protect people's rights in the face of this new technology that is often not understood by most people. Differentiating between types of AI and their respective risks is a wise approach, given the variety of aspects that AI systems can have, so their legal treatment and corresponding requirements should not be the same.

However, this industry itself is highly complex to understand and is evolving day by day, which could lead to potential difficulties when implementing this legislative proposal, due to some original errors derived from the lack of specialization of legislators and adjudicators (judges). While it was a challenge for the former to understand the object to be regulated through this law, it will be a challenge for adjudicators to decide on a case-by-case basis. Even with the help of people specialized in the subject, it will be a challenge to overcome these circumstances; sometimes not even the developers understand how their own AI systems work, which is called a “black box.”

On the other hand, although the EU AI Law aims to influence and export its provisions to foreign legislations, it is true that this does not have to be the case, at least not in its entirety. The reason for the latter is that each jurisdiction or region has different situations and needs, and it may even be that some of the country's innovative goals are not aligned with parts of the content of the law under study.

In our opinion, establishing a series of requirements and obligations for technology developers may discourage them from creating and launching new programs, and may be a blow to their innovative capacity, considering that many of them do not have sufficient resources to comply with such a complex regulatory framework or to pay for legal services in this area.

That said, it might be prudent to monitor the state of the tech industry in Europe after the EU AI Law comes into force and becomes applicable. The effects of this body of legislation will tell us what benefits and drawbacks it brings to the practical world.

Publication link:
https://ec.europa.eu/commission/presscorner/detail/es/ip_23_6473.