The EU AI Act: Ten Key Things to Know
The European Union’s Artificial Intelligence Act (the EU AI Act) was published in the Official Journal of the EU on 12 July 2024 and entered into force on 1 August 2024. This act provides a comprehensive framework of rules governing the development, deployment, and use of AI technologies. Various Codes of Practice will be published, supplementing the “on the face” interpretation of the EU AI Act, with a deadline set for 1 June 2025.
This article offers a high-level overview of the 10 key points concerning the EU AI Act, along with links to more detailed analyses.
Key Point One: Distinction Between AI Systems and AI Models
The EU AI Act differentiates between AI Systems and General-Purpose AI Models, outlining compliance obligations specific to each category. An AI System is defined as:
“a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, inferring from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence environments.”
Conversely, while the act does not specifically define “AI Models,” it does identify General-Purpose AI Models, characterized by their capacity to perform a wide range of tasks.
Key Point Two: A Tiered Approach Based on Risk Level
The EU AI Act adopts a tiered approach for AI Systems based on perceived risk levels:
- Prohibited AI Systems: Certain design techniques and use cases are prohibited, including those that manipulate behavior or exploit vulnerabilities.
- High-Risk AI Systems: A range of use cases are designated as high-risk, necessitating stringent compliance measures.
- Low-Risk AI Systems: Systems that do not fall into the above categories are considered low risk.
The act also establishes a compliance regime specifically for General-Purpose AI Models, with additional rules for those categorized as having systemic risk.
Key Point Three: Broad Territorial Scope
The EU AI Act applies to operators outside the EU, affecting businesses that host or utilize AI tools accessible to users within the EU. Key definitions include:
- “Placing on the market”: Refers to the first making available of an AI System or General-Purpose AI Model in the EU market.
- “Putting into service”: The first use of an AI System for its intended purpose in the EU.
Key Point Four: Limited Exemptions
The EU AI Act does not apply in specific instances, including:
- Military, Defence, or National Security: AI Systems developed exclusively for these purposes are exempt.
- Research and Development: AI Systems created for scientific research and development are not covered.
- Open Source: AI Systems released under free and open-source licenses are excluded from the act.
Key Point Five: Staggered Implementation
The EU AI Act will be implemented gradually, with different requirements coming into effect at various times:
- 2 February 2025: Prohibited AI regime and rules around AI literacy.
- 2 August 2025: Rules governing General-Purpose AI.
- 2 August 2026: Rules for high-risk AI Systems listed in Annex III.
- 2 August 2027: Rules for AI integrated into products subject to safety regulations.
Key Point Six: Compliance Across the AI Value Chain
The EU AI Act establishes a value chain that maps compliance obligations across different operators, focusing primarily on:
- Providers: Operators who develop or deploy AI Systems.
- Deployers: Users of AI Systems in professional contexts.
Understanding one’s role within this value chain is crucial for compliance.
Key Point Seven: Transparency Obligations
All providers and deployers of AI Systems must adhere to certain transparency obligations, regardless of risk classification. Key requirements include:
- Informing Users: If an AI System interacts with individuals, users must be informed of this interaction.
- Marking AI-Generated Content: Synthetic content must be marked to indicate it is artificially generated.
Key Point Eight: AI Literacy Requirements
The EU AI Act mandates a level of AI literacy for all personnel involved with AI Systems, ensuring they understand the technology’s opportunities and risks. This requirement came into effect on 2 February 2025.
Key Point Nine: Open Source AI
AI Systems released under open-source licenses are exempt from the EU AI Act unless they are categorized as high-risk or prohibited. However, General-Purpose AI Models released under open-source licenses may still face certain obligations.
Key Point Ten: Fundamental Rights Impact Assessments (FRIA)
Deployers of high-risk AI Systems must conduct a Fundamental Rights Impact Assessment before utilizing the system. This assessment evaluates potential risks to individuals and must be updated as necessary.
In conclusion, the EU AI Act represents a significant step towards regulating AI technologies within the EU, establishing a framework that balances innovation with necessary safeguards for individuals and society.
