The world’s first legislation on artificial intelligence developments and uses is from the European Union

Brussels – The European Union has done it, although it now has to do the technical work to finalize it. The EU Artificial Intelligence Act – the world’s first legislation on the subject – was agreed by the co-legislators of the EU Parliament and Council after a 36-hour marathon that began on Wednesday (Dec. 6) and continued over two rounds, with final agreement reached late Friday evening (Dec. 8). “This Regulation aims to ensure that fundamental rights, democracy, the rule of law, and environmental sustainability are protected from high-risk artificial intelligence, while stimulating innovation and making Europe a leader in the field,” according to the note from the Eurochamber, the group that pushed hardest for democratic safeguards during the negotiations in the face of intense pressure from the 27 governments.

“The European Union’s Artificial Intelligence Act is a world first, a unique legal framework for the development of AI that can be trusted and for the security and fundamental rights of people and businesses,” exulted European Commission President Ursula von der Leyen after waiting more than two and a half years to see her cabinet’s proposal grounded by co-legislators, “A commitment we made in our political guidelines and that we have kept.” However, the legislative process does not end with the provisional agreement between Parliament and the Council. Work will continue for weeks at the technical level to finalize the details of the Regulations, before the text is submitted to both co-legislators for final approval. With formal adoption and publication in the EU Official Journal,the world’s first artificial intelligence legislation will enter into force two years later.

Since the larger body of provisions, including the requirements on high-risk AI systems, will only be applicable at the end of a transitional period, the EU Commission on Nov 16 launched the Pact on AI  to try to push voluntary industry efforts to begin implementing its requirements before the legal deadline, especially regarding generative AI systems
ahead of the European elections in June next year. In this context, companies that join will sign commitment statements, accompanied by concrete ongoing or planned actions that the EU Commission will publish to give visibility and build further trust. Currently, a call for expressions of interest has been launched, ahead of discussions (expected in the first half of 2024) among stakeholders on preliminary ideas and best practices. After the formal adoption of the Artificial Intelligence Act, the Covenant’s leading organizations will be invited to make public their initial commitments.

Categorization and bans on artificial intelligence

The compromise agreement maintained a horizontal level of protection, with a risk scale to regulate AI applications on four levels: minimal, limited, high, and unacceptable. Systems with limited risk would be subject to very light transparency requirements, such as disclosing that AI generated the content. For those with high risk, there would be an assessment of the impact on fundamental rights before launch on  the market, including a requirement to register in the dedicated EU database and establishing requirements on the data and technical documentation to be submitted to demonstrate product compliance.

The agreement places at an unacceptable level – and therefore bans – cognitive behavior manipulation systems, untargeted collection of facial images from the Internet or CCTV footage to create facial recognition databases, emotion recognition in the workplace and educational institutions, ‘social scoring’ by governments, biometric categorization to infer sensitive data (political, religious, philosophical beliefs, sexual orientation) or religious convictions, and some instances of predictive policing for individuals.

Exceptions for law enforcement

This is the chapter on which discussions threatened to stall during the marathon negotiations and the one on which the most changes from the Commission’s proposal were agreed upon. One of the most substantial is the one that concerns the emergency procedure that will allow law enforcement agencies to use a high-risk artificial intelligence tool that has failed the evaluation procedure, which will have to dialogue with the specific mechanism on the protection of fundamental rights.

Even using of real-time remote biometric identification systems in publicly accessible spaces has some exemptions “subject to judicial authorization and for strictly defined lists of offenses.” ‘Post-remote’ use could be used exclusively for the targeted search of a person convicted or suspected of committing a serious crime, while real-time use “limited in time and location” for targeted searches of victims (kidnapping, trafficking, sexual exploitation), prevention of a “specific and current” terrorist threat and for locating or identifying a person suspected of committing specific crimes (terrorism, human trafficking, sexual exploitation, murder, kidnapping, rape, armed robbery, participation in a criminal organization, environmental crimes).

Governance and foundation models

New provisions have been added to the text of the agreement to take into account situations where artificial intelligence systems may be used for many different purposes (General Purpose Ai) and where general purpose technology is subsequently integrated into another high-risk system. In this context, an AI Office will be established within the European Commission to “oversee the most advanced models, help promote testing standards and practices, and enforce common rules across member states.” In parallel, an advisory forum for stakeholders-such as representatives from industry, small and medium-sized enterprises, start-ups, civil society, and academia will also operate, providing technical expertise to the AI Office.

Considering the wide range of tasks that artificial intelligence systems can perform – generation of video, text, images, side-language conversation, computation, or computer code generation – and the rapid expansion of their capabilities, the ‘high-impact’ foundation models (a type of generative artificial intelligence trained on a broad spectrum of generalized, label-free data) will have to comply with a number of transparency requirements before being released to the market. From drafting technical documentation, to complying with EU copyright law, to disseminating detailed summaries of the content used for training.

Innovation and Sanctions

In terms of supporting innovation, sandboxes (test environments in computing) of artificial intelligence regulation will be able to create a controlled environment to develop, test, and validate  innovative systems even under real-world conditions. To alleviate the administrative burden on smaller companies and protect them from pressure from dominant market players, the agreement provides for “limited and clearly specified” supporting actions and exemptions.

Finally, penalties. Any natural or legal person will be able to file a complaint with the relevant market supervisory authority regarding non-compliance with the EU Artificial Intelligence Act. In the event of a violation of the Regulation, the company will have to pay either a percentage of annual global turnover in the previous financial year or a predetermined amount (whichever is higher): 35 million euros or 7 percent for violations of prohibited applications, 15 million euros or 3 percent for violations of the law’s obligations, 7.5 million euros or 1.5 percent for providing incorrect information. More proportionate ceilings will apply for small and medium-sized enterprises and start-ups.