Corporate Compliance under the EU Artificial Intelligence Act: Legal Framework and Strategic Implications
The European Union Artificial Intelligence Act (AI Act) represents the first comprehensive legal framework aiming to regulate the use of Artificial Intelligence (AI) in the EU. Its extraterritorial scope and broad definitions make it essential for companies within and outside the EU to assess and adjust their compliance frameworks. For companies operating in or entering the European market, compliance with the AI Act is not only a legal obligation but also a strategic necessity.
Overview of the AI Act
The AI Act adopts a risk-based approach, shaping the obligations that providers and deployers of AI systems must comply with. Companies are expected to implement a risk management process and a data governance strategy. Furthermore, comprehensive documentation must be prepared before the AI system is placed on the market and transparency obligations must be met.
Operators are also expected to monitor the performance of AI systems after deployment and report serious incidents and malfunctions to the competent authorities. The Act encourages companies to conduct AI Impact Assessments to evaluate potential legal, ethical, and societal risks, particularly focusing on fundamental rights.
Implementation Timeline
The AI Act follows a phased implementation schedule designed to allow stakeholders—particularly legal and compliance teams—to progressively adapt to its requirements. Below is a structured overview of the key milestones:
- August 1, 2024 – Entry into Force: The AI Act formally enters into force, initiating transitional compliance planning for providers and users of AI systems.
- February 2, 2025 – Applicability of Provisions on Prohibited AI Practices: Legal entities must ensure the immediate cessation or avoidance of deploying AI systems that fall under prohibited use cases.
- May 2025 – Deadline for the Adoption of Codes of Conduct: Industry actors must develop and adopt voluntary codes of conduct.
- August 2025 – GPAI and Enforcement Provisions Become Applicable: Obligations for General-Purpose AI providers commence.
- August 2026 – Full Applicability of the Regulation: All actors in the AI value chain must ensure complete compliance with relevant obligations.
- Post-August 2026 – Ongoing Compliance and Regulatory Evolution: The AI Act anticipates ongoing monitoring and updates.
Compliance Obligations
The compliance framework for high-risk AI systems is extensive and includes:
- Risk Management Process: Companies must document and update their risk management strategies in light of system modifications or post-market evidence.
- Data Governance Strategy: High-risk AI systems must be trained on high-quality datasets, ensuring that the data is relevant, complete, and free of errors.
- Documentation: Comprehensive documentation must include system architecture, intended purpose, and risk management procedures.
- Transparency Obligations: High-risk AI systems must provide clear instructions for use, including capabilities, limitations, and known risks.
- Conformity Assessment: Compliance activities involve a conformity assessment procedure that results in the CE marking of the AI system.
Post-Market Monitoring and Incident Reporting
Providers must actively monitor the performance of AI systems after deployment. Similar to other EU regulations, serious incidents and malfunctions must be reported to the relevant authorities within 15 days of becoming aware.
Responsibilities of Other Actors
The AI Act outlines obligations for other stakeholders, including deployers, importers, and distributors. Deployers must follow the provider’s instructions for intended use and must monitor the system’s performance during operation.
Penalties for Non-Compliance
The AI Act introduces substantial fines for non-compliance:
- Up to €35 million or 7% of global turnover for prohibited practices.
- Up to €15 million or 3% of turnover for high-risk system non-compliance.
- Up to €7.5 million or 1% of turnover for incorrect or incomplete documentation.
AI Impact Assessments
Companies are encouraged to conduct AI Impact Assessments to evaluate potential legal, ethical, and societal risks, following structured methodologies. These assessments must be completed before high-risk systems are put into use for the first time.
Conclusion
The AI Act ushers in a new era of AI governance with far-reaching implications for companies. Its risk-based lifecycle approach requires businesses to adopt comprehensive compliance frameworks addressing legal, technical, and ethical dimensions. While the AI Act presents challenges, it also offers opportunities for companies to build trust and contribute to responsible innovation.
