EU breaks new ground with first-of-its-kind AI regulations
13 December 2023
(Image: Shutterstock)
After three days of intensive negotiations, the EU has reached a historic draft agreement on the world's first comprehensive set of rules for AI – the Artificial Intelligence Act.
The landmark proposal aims to strike a delicate balance between fostering innovation and safeguarding fundamental rights, democracy, and environmental sustainability.
This regulation aims to encourage investment and innovation in AI, strengthen governance and the enforcement of current laws on fundamental rights and safety, and streamline the development of a unified market for AI applications.
Carme Artigas, the Spanish Secretary of State for Digitalisation and Artificial Intelligence, lauded the achievement as a monumental step towards fostering innovation while upholding citizens' rights. “This is a historical achievement, and a huge milestone towards the future!” Artigas said.
“In this endeavour, we managed to keep an extremely delicate balance: boosting innovation and uptake of artificial intelligence across Europe whilst fully respecting the fundamental rights of our citizens.”
The draft, a collaborative effort between the European Parliament and the Council, proposes a robust framework that follows a ‘risk-based’ approach, based on AI’s ability to cause harm to humanity. The higher the risk, the stricter the rules.
The Act addresses a range of critical aspects of artificial intelligence, including:
1. Banned applications
The agreement prohibits several high-risk applications of AI that could pose threats to citizens' rights and democracy. This includes the use of biometric categorisation systems based on sensitive characteristics (e.g. political, religious, philosophical beliefs, sexual orientation, and race), untargeted scraping of facial images from CCTV or the internet for recognition databases, and systems that manipulate human behaviour or exploit vulnerabilities.
2. Law enforcement safeguards
Negotiators agreed on a series of safeguards and narrow exceptions for the use of remote biometric identification systems (RBI) in publicly accessible spaces for law enforcement purposes. The agreement outlines conditions for "post-remote" and "real-time" RBI, restricting its use to targeted searches for serious crimes (such as trafficking, terrorism and murder).
3. High-risk obligations
Clear obligations for high-risk AI systems were established, including mandatory fundamental rights impact assessments, particularly in the insurance and banking sectors. These would be applicable in AI systems that threaten safety, fundamental rights, environment, democracy, health, or the law.
Citizens will have the right to launch complaints and receive explanations about decisions made by high-risk AI systems that impact their rights. Specific obligations were outlined for AI systems that could influence elections and voter behaviour.
4. General AI guardrails
To address the diverse capabilities of general-purpose AI (GPAI) systems, transparency requirements were introduced. GPAI models must adhere to technical documentation, comply with EU copyright law, and disseminate detailed summaries of their training data.
High-impact GPAI models face more stringent obligations, such as model evaluations, mitigation of systemic risks, adversarial testing, reporting on incidents, ensuring cybersecurity, and disclosing energy efficiency information.
5. Support for innovation
In a bid to support businesses, especially small and medium-sized enterprises (SMEs), the legislation promotes regulatory sandboxes and real-world testing. These mechanisms, which will be established by national authorities, aim to facilitate the development and training of innovative AI solutions before market placement, reducing undue pressure from industry giants.
6. Penalties
Non-compliance with the regulations may result in fines ranging from 35 million euros, or seven percent of global turnover, to 7.5 million euros or 1.5 percent of turnover, depending on the violation and company size.
Governance architecture
In response to the updated regulations on GPAI, an AI Office will be established within the Commission. It will entrusted with overseeing these advanced AI models, contributing to the development of standards and testing practices of these advanced AI models, and enforcing uniform rules across all member states.
An AI Board comprising member states’ representatives, will serve as an advisory body to the Commission, as will a scientific panel of independent experts and industry stakeholders.
Next steps
The AI Act is expected to apply two years after its entry into force, with some exceptions for specific provisions. Technical work and legal-linguistic revisions will be applied to finalise details before the text is formally adopted by the EU.