What is the EU's new AI Act and how will it affect the industry?

Non-compliance with regulations to protect against 'high-risk AI' will lead to hefty fines

The rise of generative artificial intelligence, led by OpenAI's ChatGPT, sent EU officials scrambling to hasten the forming of their landmark AI legislation. Getty

The EU on Friday approved regulations for the artificial intelligence sector designed to cut the risks from the growing and increasingly powerful technology.

The Artificial Intelligence Act is the culmination of efforts made by the EU after it released the first draft of its rule book in 2021, allowing it to take the early lead in safety standards for the technology.

Officials, however, were jolted by the emergence of generative AI, the technology made popular by Microsoft-backed OpenAI.

“It was long and intense, but the effort was worth it. Thanks to the European Parliament’s resilience, the world’s first horizontal legislation on artificial intelligence will keep the European promise – ensuring that rights and freedoms are at the centre of the development of this ground-breaking technology,” said Brando Benifei, Italian MEP and co-rapporteur of the legislation.

“Correct implementation will be key – the Parliament will continue to keep a close eye, to ensure support for new business ideas with sandboxes and effective rules for the most powerful models.”

Why target generative AI?

AI gained momentum with the introduction of generative AI, which rose to prominence thanks to ChatGPT.

Its sudden rise has also raised questions about how data is used in AI models and how the law applies to the output of those models, such as a paragraph of text, a computer-generated image, or videos.

“There's a lot of work that has to be done in terms of reinforcement to play down things that you don't want, like bias and [copyright] infringement,” Nigel Vaz, chief executive of global tech consultancy Publicis Sapient, recently told The National.

What is the Artificial Intelligence Act?

According to the EU, the act was written to ensure that fundamental rights, democracy, the rule of law and environmental sustainability are protected from high-risk AI.

At the same time, it will try to ensure that it will boost innovation in Europe and help make the continent a leader in the sector.

“The rules establish obligations for AI based on its potential risks and level of impact,” it said.

What are the banned applications?

EU legislators agreed to prohibit specific apps, “recognising the potential threat to citizens’ rights and democracy posed by certain applications of AI”.

These include biometric categorisation systems that use sensitive characteristics, including political, religious, philosophical beliefs, sexual orientation and race.

The law also prohibits the untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases, as well as emotion recognition in the workplace and educational institutions, and social scoring based on social behaviour or personal characteristics.

AI systems that manipulate human behaviour to circumvent their free will are also banned, as well as the use of AI to exploit the vulnerabilities of people because of their age, disability, social or economic situation.

Are there penalties for non-compliance?

Non-compliance can lead to fines ranging from to €7.5 million ($8 million), or 1.5 per cent of turnover, to €35 million, or 7 per cent of a company's global turnover.

All penalties will depend "on the infringement and size of the company”, the EU said.

As such – given the size of these tech companies and the turnover they produce – they potentially stand to pay fines well into the billions the more they fall afoul of the EU's regulations.

Are others reining in AI?

While the EU's act is considered the first landmark and sweeping legislation on AI, there are, in fact, a number of countries that have AI regulations in place.

The most notable are Australia, Brazil, Canada, China, India, Israel, Japan, New Zealand, Saudi Arabia, Singapore, South Korea, the UAE, the UK and the US, according to data from the International Association of Privacy Professionals.

“Countries worldwide are designing and implementing AI governance legislation commensurate to the velocity and variety of proliferating AI-powered technologies,” the IAAP said.

“Legislative efforts include the development of comprehensive legislation, focused legislation for specific use cases, and voluntary guidelines and standards.”

What would the act's effect be?

Romania's Dragos Tudorache, a member of the EU Parliament and co-rapporteur of the legislation, said the act will be a boon for the EU's economy and businesses.

“It protects our SMEs, strengthens our capacity to innovate and lead in the field of AI, and protects vulnerable sectors of our economy. The EU has made impressive contributions to the world; the AI Act is another one that will significantly impact our digital future,” he said.

However, certain groups are already concerned about the act, flagging what they perceive as negative consequences for the bloc.

DigitalEurope, a Brussels-based business group, criticised the legislation as another burden for companies – especially for the smaller ones.

“The new requirements – on top of other sweeping new laws like the Data Act – will take a lot of resources for companies to comply with, resources that will be spent on lawyers instead of hiring AI engineers,” its director general Cecilia Bonefeld-Dahl said in a statement on its website.

“We particularly worry about the many SME software companies not used to product legislation – this will be uncharted territory for them.”

European Digital Rights, a privacy rights group, was also critical, arguing some points were not enough.

“It’s hard to be excited about a law which has, for the first time in the EU, taken steps to legalise live public facial recognition across the bloc,” its senior policy adviser Ella Jakubowska said, Reuters reported.

“While the Parliament fought hard to limit the damage, the overall package on biometric surveillance and profiling is at best lukewarm.”