The first bill aiming to regulate the use and implementation of AI took effect this summer, on the 1st August 2024, termed the European Artificial Intelligence Act (AI Act). EU regulators reached an agreement on the content of the act on the 9th December 2023, however the legislation has only now come into effect, with applications occurring in waves over the next three years, with the final provisions relating to “high risk” systems rounding off the implementation in 2027.
With AI tech termed by the World Economic Forum as “one of the top potential risks of the next decade”, the bill marks a landmark piece of legal infrastructure attempting to control these risks while extracting the full benefit of the technology for EU citizens.
Differing from the UK, and Americas more market-driven approaches to regulation, the EU act is risk focused, creating discrete categories of risk with regulations applied by level. The majority of restrictions sit in the “High Risk” category, covering instances where failure would have severe implications, such as transport, law enforcement, and healthcare, with large swathes of strict requirements being introduced. Above this level is “Unacceptable Risk”, which the act strictly prohibits, including systems considered exploitative, invasive, or where failure would be catastrophic, in which cases such as China’s social credit scoring system would sit. The lowest rung – where the average person would be likely to see the most difference – is, predictably, where ChatGPT would sit. With risk deemed “Limited”, regulations are currently targeting transparency to the user, ensuring they know they are interacting with AI or AI generated content, however there are ongoing discussions in the European parliament regarding such large language learning and image generation models, with the aims of protecting copyrighted data and preventing generation of illegal imagery.
The legal framework applies not just to AI providers based in the EU, but any models which will operate in the Union’s member states.
Penalties for breaching the act include fines of up to 35 million (euros) or 7% of annual worldwide turnover with a two-tiered enforcement system composed of EU bodies, including a new EU “AI Office”, as well as national regulators of the individual member states, such as the already established Spanish body, AESIA.
While the AI industry has widely been pushing for regulation for sometime, there has been polarising receptions to the act, with experts in digital rights such as Daniel Laufer claiming the act is not restrictive enough to prevent the hazards the act is seeking to protect society from. He claims this down to “concessions to industry lobbying” – a criticism not unreasonable, given the delays in agreement of the act caused directly by this, and the displeasure from regions such as France, with a high density of AI start-up companies, also expressing warranted concern that the act would stifle innovation and further push the EU behind on the world stage in terms of technology. It remains to be seen who the outcome of the act will prove right, or if the continued discussion with yield further solutions which satisfy all parties.
Feature photo credited to Unsplash
Leave a Reply