Enforcement of the AI Act: A Comprehensive Overview
The European Union Artificial Intelligence Act (AI Act) came into force on August 1, 2024. This legislation introduces a risk-based approach to the regulation of artificial intelligence (AI), prohibiting certain unacceptable practices while imposing specific requirements on high-risk AI systems, such as those utilized in health, employment, and law enforcement.
Introduction
As the AI Act takes effect, one of the foremost challenges is the enforcement of its provisions in practice. This article delves into the enforcement structures established by the AI Act, focusing on the roles of various authorities and highlighting the complexities that may arise in implementation.
1. Centralized and Decentralized Enforcement Structures
The enforcement of the AI Act relies on both centralized and decentralized structures, with the primary actors being:
- National Market Surveillance Authorities
- The European Commission, through the AI Office
- The European Data Protection Supervisor (EDPS)
2. Market Surveillance Authorities
Each EU Member State is required to designate at least one notifying authority and one market surveillance authority, which together constitute the national competent authorities.
- Notifying Authorities: Responsible for the pre-implementation phase of AI systems, these authorities establish and apply conformity assessment frameworks. They certify compliance of high-risk AI systems with the AI Act.
- Market Surveillance Authorities: These authorities supervise AI systems after they are placed on the market. They possess the power to impose sanctions for non-compliance, including administrative fines for various infringements.
Sanctions for non-compliance can be significant, including:
- Administrative fines of up to EUR 35 million for non-compliance with prohibited AI practices.
- Fines of up to EUR 15 million for non-compliance with operator obligations.
- Fines of up to EUR 7 million for providing incorrect or misleading information.
3. The Role of the European Commission and AI Office
The European Commission has exclusive powers to supervise and enforce obligations for general-purpose AI models. This responsibility is delegated to the AI Office, which can act on its initiative or upon receiving complaints.
The AI Office is equipped with investigative and corrective powers, including:
- Requesting documentation and information from providers of general-purpose AI models.
- Conducting evaluations to assess compliance and investigate systemic risks.
- Imposing fines of up to 3% of annual worldwide turnover or EUR 15 million for non-compliance.
4. The European Data Protection Supervisor (EDPS)
The EDPS serves as the competent market surveillance authority for EU institutions, agencies, and bodies. They hold similar powers to national market surveillance authorities but with lower fines:
- Fines of up to EUR 1.5 million for non-compliance with prohibited AI practices.
- Fines of up to EUR 750,000 for other infringements.
5. Cooperation Mechanisms
The AI Act includes mechanisms to ensure cooperation among national competent authorities and the European Commission. Key points include:
- Market surveillance authorities must inform the Commission and other Member States if non-compliance extends beyond their national territory.
- Provisional measures can be taken against operators not taking adequate corrective action.
6. Challenges in Enforcement
The enforcement framework of the AI Act presents several challenges:
- The lack of a one-stop shop mechanism for operators dealing with multiple authorities across Member States.
- Diverse procedural aspects may lead to inconsistencies in enforcement, as these are largely subject to national law.
- The dual role of the AI Office may affect its impartiality.
- Variation in expertise among market surveillance authorities could result in differing interpretations of the AI Act.
Conclusion
The enforcement of the AI Act is a complex endeavor that necessitates collaboration among various authorities. As the EU seeks to regulate AI effectively, addressing the challenges in its enforcement framework will be crucial for the successful implementation of the AI Act and the protection of citizens against potential risks associated with AI technologies.
