AI news: EU reaches landmark agreement on Artificial Intelligence Act

The European Union (EU) has taken a major step towards regulating artificial intelligence (AI) and is set to become the first region in the world to have comprehensive and harmonised rules for AI, after the European Parliament and the Council reached a provisional agreement on the proposed Artificial Intelligence Act on 9 December 2023 (the Act).

How the Act works

The Act will introduce a risk-based approach to AI, with different levels of obligations depending on the potential impact of the AI system on human rights, safety and fundamental values. It also seeks to foster innovation and competitiveness by creating a single market for AI products and services.

The Act will apply to providers, users and third parties of AI systems, whether they are located in the EU or outside. It will classify AI systems into four categories of risk: unacceptable, high, limited and minimal.

Unacceptable risk AI systems, such as those that manipulate human behaviour or exploit vulnerabilities, will be banned. High-risk AI systems, such as those used for critical infrastructure, education, employment or law enforcement, will be subject to strict requirements, such as quality, safety, transparency and human oversight. Limited risk AI systems, such as chatbots or voice assistants, will have to inform users that they are interacting with an AI system. Minimal risk AI systems, such as video games or spam filters, will be largely unregulated, but encouraged to follow voluntary codes of conduct.

One of the most controversial aspects of the Act is the regulation of real time biometric identification systems (RBI), such as facial recognition or gait analysis, which pose significant risks to privacy and dignity. The Act will prohibit the use of RBI in public spaces, except for a few narrowly defined purposes, such as finding missing children, preventing terrorism or prosecuting serious crimes. The use of RBI for these purposes will be subject to strict safeguards, such as prior authorisation, proportionality, necessity and human intervention.

Another key feature of the Act is the introduction of rules for general-purpose AI (GPAI) systems and the GPAI models that they are based on. GPAI systems are AI systems that can perform multiple tasks across different domains, such as natural language processing, computer vision or speech recognition. The Act will require GPAI systems to comply with transparency obligations, such as disclosing their capabilities, limitations and sources of data. GPAI models will have to be summarised and documented, to ensure traceability and accountability. Some GPAI models that pose systemic risks, such as those that affect large segments of the population or critical sectors, will have to undergo additional testing, mitigation and reporting measures.

The provisional agreement on the Act is a major milestone for the EU's digital agenda, but it is not the final step. The Act still needs to be formally adopted by the European Parliament and the Council, which is expected to happen in early 2024. 

Key takeaways

• The Act will create a risk-based framework for AI regulation, banning unacceptable risk AI systems, imposing strict requirements on high-risk AI systems, informing users of limited risk AI systems and leaving minimal risk AI systems largely unregulated.
• The Act will address some of the most contentious issues in AI, such as the use of real time biometric identification systems in public spaces and the regulation of general-purpose AI systems and models.
• The Act will foster innovation and competitiveness in the EU's AI sector, by creating a single market for AI products and services, providing legal certainty and trust, and supporting research and development.

Our views

• We welcome the provisional agreement on the Act, as it represents a balanced and proportionate approach to AI regulation, that respects human rights and values, while promoting innovation and growth.
• We believe that the Act will set a global standard for AI governance, and encourage other regions and countries to follow suit, or to cooperate with the EU on creating a common framework for AI ethics and law.
• The Act will pose some challenges and costs for AI providers, users and third parties, especially those that operate across different jurisdictions and markets.

Read the other topical articles from our Winter Data Protection Update:

• Information Commissioner’s Office launches consultation on Generative AI
• European Commission publishes first review of pre-GDPR EU adequacy decisions
• EDPB Rules Meta’s Advertising Practices Unlawful
• ICO Opens Consultation on Draft Recruitment and Employee Records Guidance