European Union achieved a historic breakthrough on Friday by finalizing the world’s first comprehensive set of artificial intelligence (AI) rules. The negotiated agreement, a tentative political deal for the Artificial Intelligence Act, signals a significant step towards establishing legal oversight of AI technologies. The regulations address a wide range of issues, from generative AI to the use of face recognition surveillance by law enforcement.
Negotiations between the European Parliament and the bloc’s 27 member countries concluded with a tweet from European Commissioner Thierry Breton declaring, “Deal! The EU becomes the very first continent to set clear rules for the use of AI.” The negotiations, conducted over marathon closed-door talks, tackled contentious topics such as generative AI and police utilization of face recognition surveillance.
Civil society groups, however, greeted the agreement with caution, emphasizing the need for technical details to be clarified in the coming weeks. Critics argue that the deal does not go far enough in safeguarding individuals from potential harm caused by AI systems.
The EU has been at the forefront of global efforts to establish AI regulations since unveiling the first draft of its rulebook in 2021. The recent surge in generative AI prompted European officials to update the proposal, aiming to provide a blueprint for the world.
While the European Parliament still needs to vote on the act early next year, with the deal in place, this step is considered a formality. The legislation is not expected to take full effect until 2025 at the earliest, threatening substantial financial penalties for violations.
Generative AI, exemplified by technologies like OpenAI’s ChatGPT, has gained prominence for its ability to produce human-like text, photos, and songs. However, concerns about the technology’s impact on jobs, privacy, copyright protection, and even human life have also grown. The EU’s regulatory framework is expected to set an example for other countries, with the U.S., U.K., China, and global coalitions now developing their own AI regulations.
The AI Act, initially designed to mitigate risks associated with specific AI functions, expanded its scope to include foundation models—the advanced systems underlying general-purpose AI services. Negotiators overcame challenges related to foundation models, reaching a tentative compromise that addresses concerns about potential misuse.
One of the most contentious issues was AI-powered face recognition surveillance systems. Negotiators struck a compromise, allowing exemptions for law enforcement use in addressing serious crimes while balancing privacy concerns.
However, rights groups remain cautious, highlighting concerns about loopholes in the AI Act, including exemptions for certain applications and the lack of protection for AI systems used in migration and border control. Despite the victories achieved in the final negotiations, critics argue that significant flaws persist in the legislation. French President Emmanuel Macron has emphasized the need for regulation to focus on uses rather than technologies and to preserve innovation without being overly punitive.
Key Feature of Act
The EU’s approach to AI focuses on a risk-based model, categorizing AI systems into three tiers: minimal risk, high-risk, and unacceptable risk.
Minimal Risk: The majority of AI systems, such as recommender systems or spam filters, fall into this category. These systems enjoy a free pass, with no specific obligations. However, companies can voluntarily commit to additional codes of conduct.
High-Risk: AI systems posing significant risks, especially in critical areas like infrastructure, medical devices, education, law enforcement, and biometric identification, will face stringent requirements. These include risk-mitigation measures, high-quality data sets, user transparency, human oversight, and robust cybersecurity. Regulatory sandboxes will facilitate responsible innovation in this category.
Unacceptable Risk: AI systems deemed a clear threat to fundamental rights will be outright banned. This includes systems manipulating human behavior, ‘social scoring,’ and certain uses of biometric systems.
Specific Transparency Requirements
To ensure transparency, certain AI systems, like chatbots and deep fakes, will have specific labeling requirements. Users interacting with AI should be aware they are dealing with a machine. Additionally, AI-generated content must be marked as such, and users need to be informed when biometric categorization or emotion recognition systems are in use.
Fines for Non-Compliance
Stricter enforcement measures are introduced, with fines for non-compliance. Companies violating AI rules could face fines ranging from €7.5 million to €35 million or 1.5% to 7% of their global annual turnover, depending on the severity of the infringement.
General Purpose AI Governance
Dedicated rules for general purpose AI models ensure transparency along the value chain. For powerful models posing systemic risks, additional binding obligations related to risk management, incident monitoring, model evaluation, and adversarial testing are introduced. Governance will involve a European AI Office coordinating at the EU level and national competent market surveillance authorities.
French President Emmanuel Macron has warned the European Union against overly restrictive regulation of artificial intelligence technologies. He said that the new law should “regulate the uses, rather than the technologies themselves” and “Regulation must be controlled, not punitive, to preserve innovation” 123.
“Regulation must be controlled, not punitive, to preserve innovation,” Macron said of the EU’s efforts. He told a start-up event in Paris via video message that the new law should “regulate the uses, rather than the technologies themselves.”
