The European Union is having an ongoing debate about the first laws to regulate AI. Leaders like ... [+]
European Parliament negotiators reached a consensus late last Friday on language for the long-debated AI Act—the first major artificial intelligence legislation in the European Union. The draft law emerges amidst rising concerns among EU member states about the impact that regulations will have on innovation. As a result, the tentative deal could still unravel due to infighting.
The AI Act’s journey began about two and a half years ago, when the first version of the law was made public in 2021. This was before the release of cutting-edge AI models like ChatGPT. With the rise of “foundation models”—versatile AI systems capable of a wide range of applications—has come a shift in the EU’s legislative approach toward a focus on the most advanced technologies. These “general purpose” AI models will have their own sets of rules tailored to them.
The pivot to single out foundation models has been one of the areas that has sparked the most intense debate. Emmanuel Macron of France criticized the draft legislation, arguing it could kill innovation on the continent. The language still needs to be approved by EU member countries and the European Parliament before it becomes law, a process that could take months. With attacks from heads of state like Macron, the AI Act could easily still get derailed, creating considerable uncertainty.
As the law stands now, AI applications will be categorized by risk, with “high-risk” AI systems subjected to the most stringent rules. Requirements include pre-market testing, mandated risk-mitigation systems, standards surrounding the datasets used to train AI systems, and human oversight.
For now, companies will be expected to self-assess whether their models meet the compliance threshold for general purpose foundation models. The models will initially be classified based on the computing power required to run them, but this is subject to change as other metrics and benchmarks become available.
The AI Act also introduces a number of transparency measures, including requiring companies to notify users when they are interacting with AI systems like chatbots or emotion recognition systems, mandating the labeling of deepfakes and other AI-generated content, and various other disclosure and documentation requirements. EU copyright law must also be obeyed.
The Act exempts more mundane AI applications from strict rules, leaving a significant portion of AI technologies relatively free from regulatory oversight. However, it bans AI uses deemed to pose “unacceptable” risks. These include biometric systems that identify individuals based on sensitive biological data, scraping of facial images from online databases, emotion recognition systems at work or in schools, social scoring systems such as exist in China, AI systems that manipulate human behavior, and most forms of predictive policing.
One source of contention has come from countries that see potential to use AI in the fight against terrorism. To address these concerns, the draft law gives countries considerable latitude to use AI in a national security context. However, questions remain related to the operational and compliance burdens placed on companies under the law. Concerns echo those surrounding the EU’s data privacy law, the General Data Protection Regulation, which some argue has led to a competitiveness gap between the American and European technology sectors.
The draft law also establishes a new European AI Office for enforcement, and a stringent penalty system with fines ranging from 1.5% to 7% of a company’s global sales turnover. Looking ahead, the AI Act probably won’t come into force until 2026, offering a two-year window for companies to come into compliance. On the one hand, this creates flexibility for businesses. On the other, the AI landscape has changed so much in the past two years, the new law could easily be outdated before it goes into effect.
Proponents of the AI Act are hoping it sets the global standard for regulation of AI. They should be careful what they wish for. If the new law stifles innovation in the way many expect, this will further relegate the EU to the technological sidelines, along with any countries that decide to follow its lead.
