The AI Act is Here
The European Union enabled the Artificial Intelligence Act, the first-ever legal framework on AI, addressing its risks and positioning Europe as a leader in AI legislation.
August 1st, 2024, marked a milestone for politics and Artificial Intelligence (AI). It was the day that the European Artificial Intelligence Act (AI Act) entered into force—the first comprehensive regulation of AI in the world.
Anything related to AI restrictions receives a divided reception in social networks and AI circles, and the AI Act was no exception. Some people viewed it as an unnecessary rein for development and integration, while others welcomed it as much-needed control over systems operating "lawlessly."
__
What is the AI Act?
The Artificial Intelligence Act (AI Act) is a comprehensive regulation by the European Union with the goal of ensuring safe and trustworthy Artificial Intelligence (AI) development. It has a focus on protecting people’s interests over corporation’s interests.
This piece of legislation is part of a larger effort to prioritize human rights and fairness in developing and deploying AI systems within the European Union borders.
It intends to bring a balance between the many benefits that AI potentially brings and the new risks that this technology entails. Embrace the societal benefits and economic growth while preventing an abuse that could risk the safety (including physical safety) and rights of the people.
__
Risk Classification
The AI Act sets rules to address different AI risks and how providers and developers should handle them. It categorizes the risks into four types (ordered by severity):
Minimal or no risk AI
Limited risk AI
High-risk AI
Unacceptable risk AI
In the following sections, we'll review each risk, explain their meanings, and provide some examples.
Minimal or No Risk
These AI systems pose little to no risk to people's rights and safety and can operate without additional obligations, although companies could voluntarily adopt codes of conduct to provide more transparency.
Some examples of minimal-risk AI:
Spam filters
AI-enabled video games
AI-enabled recommendation systems
According to the European Union Commission, most of the AI systems currently operating in the EU would fall under this category.
Limited Risk
The limited risk is associated with information and (lack of) transparency in AI usage. Providers must disclose the origin and nature of the content and identify what is/was AI-generated in a way that is readable by humans and machines.
The idea is to give people the choice to continue interacting with AI or step back from it. People should be aware if they are dealing with AI or another person, and AI-generated/modified videos and images must be clearly identified as such.
Some examples of limited-risk AI:
Artificially-generated text
AI Chatbots
Deep-fake videos
Biometric categorization
Emotion recognition systems
Notice how this category applies to more than artificially generated text; it also covers audio, video, images, and other media.
High Risk
This is the largest focus in the AI Act: more complex apps and systems that imply a bigger safety risk and that must meet strict requirements to ensure they include risk-mitigation systems, high-quality datasets, activity logging, detailed documentation, clear user information, human oversight, and high levels of robustness, accuracy, and cybersecurity.
Because of the nature of these systems and the impact they can have in society, they will be under larger scrutiny by the authorities and undergo an approval process to access the European market after development and after every substantial change it goes through.
Some examples of high-risk AI:
Remote biometric identification systems.
AI systems to handle critical infrastructure.
Migration, asylum and border control management.
Programs to determine admission to education at all levels.
Apps to be used by a judicial authority for researching and interpreting facts and the law.
Recruitment systems to analyze and filter job applications, and to evaluate candidates.
AI systems intended for influencing the outcome of an election or referendum or the voting behavior of people.
Some of the high-risk systems may look similar to the unacceptable risks from the next section. Sometimes the line may be a bit blurry and some companies will try the limits.
Unacceptable Risk
The AI Act bans AI systems and applications that are considered a clear threat to people’s fundamental rights. These are systems that try to manipulate human behavior, shun free will, or police indiscriminately.
Some examples of unacceptable-risk AI:
Emotion recognition systems at the workplace.
Toys that encourage dangerous behavior in children.
AI systems that create ‘social scores’ by governments or companies.
Real time remote biometric identification in public spaces for law enforcement purposes.
Indiscriminate scraping of Internet or CCTV content for facial images to build-up or expand databases and training sets.
As you may have noticed, the targets of these requirements are not only companies or private entities, but also governments and public institutions.
A heavy criticism for the AI Act online has been that it allows for “narrow exceptions” to what is considered “unacceptable”, leaving a door open for governments to abuse the Act.
__
What's Next?
While the AI Act entered into force on August 1st, that doesn't mean all companies must comply with all requirements immediately. Some adjustment times and deadlines need to be met.
Here's a timeline of key deadlines and events:
August 1st, 2024: the AI Act enters into force.
February 2nd, 2025: prohibition on AI systems that present unacceptable risks.
August 2nd, 2025: deadline for EU Member States to designate authorities to oversee and carry out market surveillance activities.
August 2nd, 2025: rules for General-Purpose AI models apply.
August 2nd, 2026: most of the regulations in the AI Act apply.
August 2nd, 2027: rules for high-risk AI systems embedded in regulated products apply.
As highlighted by the dates, the AI Act doesn't mean immediate enforcement. It provides companies and developers with a 2–3 year cushion to comply with all the regulations.
To help developers adapt to the AI Act, the European Commission has launched the AI Pact, an initiative that facilitates the adoption of key obligations of the AI Act ahead of the legal deadlines.
__
More Information and Bibliography
Read more about the new European AI policies on these links: