On 13 March 2024, the European Parliament passed AI Act, and it is currently awaiting formal approval by the EU Council. The regulation will be applied directly by EU member states.
What is the AI Act?
The AI Act sets out rules for the use, monitoring and transparency as well as supervision of AI. Thus, it is as much about the requirements for bringing a system or model of AI to market as it is about its further use. The requirements and rules will vary depending on the role, but mainly on the category of AI solution and the risks that will be assigned to that category.
Categories of risk of using systems based on artificial intelligence
The AI Act defines risk categories associated with the use of artificial intelligence. There are four categories of risk: unacceptable risk, high risk, limited risk, and minimal risk. All categories have specific requirements and restrictions on the use of artificial intelligence.
High-risk artificial intelligence systems
High-risk artificial intelligence systems is listed in Appendix III of the AI Act, and include biometric identification systems, systems used as part of critical infrastructure, or those intended for recruitment purposes, including filtering job applications or evaluating candidates.
Under the AI Act, entities using high-risk systems will be required to assess the operation of such systems in terms of their impact on individuals’ fundamental rights (known as FRIA – fundamental rights impact assesment), in addition to implementing appropriate security measures. The AI Act also grants individuals whose rights have been violated by a decision made using AI the right to file a complaint with the relevant state authority, and to challenge the decision (or inaction) of such an authority in court.
Administrative penalties in the AI Act
The AI Act establishes a general framework and guidelines for the imposition of penalties, including a maximum amount, however, it will be up to member states to establish national laws to regulate the issue in more detail.
For the most serious violations of the AI Act, there is a maximum fine of up to €35,000,000 or, if the violation is committed by a company, up to 7% of its total annual worldwide turnover from the previous fiscal year, with the higher amount applying.
When will the AI Act come into effect?
The AI Act will come into force 20 days after it is published in the EU’s official journal, but the great majority of the provisions will not take effect until another 24 months have passed. This means that there will be a two-year period to comply with the regulations.
However, it is worth pointing out that some provisions will already take effect earlier, i.e. 6 or 12 months after the AI Act comes into force. This applies, for example, to prohibited uses of AI or selected administrative penalties.