The world’s first-ever comprehensive legislation for artificial intelligence (AI) has been passed by the European Union. The EU AI Act, as it is known, signifies a sea change in official approaches to the rapidly evolving technology, and could affect your business.
Here’s what you need to know:
What is the EU AI Act?
The EU hopes to standardise the development of AI. The technology has rapidly expanded in both scope and application, and without regulation could cause serious harm to the job market, as well as people’s safety and security.
The act applies a risk framework to AI, which will in turn standardise the risk-based approach to it. For example, machine learning will be put into one of four categories and ranked in terms of risk – those deemed to be high risk will be subject to more stringent rules.
Additionally, according to PwC, the Act is supposed to facilitate innovation, as long as companies implement the new requirements early and in a user-friendly way. The EU says the act should foster “collaboration, innovation, and research in AI among various stakeholders”.
Also according to the EU, the Act is part of a wider approach that includes other supportive measures, such as the AI Innovation Package and the Coordinated Plan on AI.
When will the EU AI Act come into effect?
The Act, which is expected to be finalised in April 2024, will come into force in two years – though parts of it will come into effect sooner.
What are the four risk categories?
The Act divides AI into four risk categories:
- unacceptable risk, which is prohibited,
- high risk
- limited risk, such as AI systems intended for individuals
- minimal and/or no risk, which falls outside the scope of the AI Act, according to Active Mind Legal.
AI systems that pose an unacceptable risk will be regulated after six months. General codes of practice will come in after nine months, and “general purpose” AI systems will need to comply after 12 months.
High-risk systems have more time – they will have to comply with the EU AI Act after 36 months. They will be under the oversight of national authorities, supported by the AI office inside the European Commission.
What is general purpose vs high-risk AI?
The EU defines “general purpose” as generally applicable services such as image/speech recognition, audio/video generation, pattern detection, question answering, translation, etc which can have multiple (intentional and unintentional) purposes.
“High-risk” includes infrastructure and transport and covers anything that could cause injury or death – educational tools, medical equipment and procedures and law enforcement also fall under this.
Who is affected by the AI Act?
Anyone who is part of the development or use of AI is affected. The act is far-reaching.
Providers, importers, distributors, product manufacturers and other users all fall under this.
Providers (who create an AI system and/or put an AI system on the market) are the most heavily regulated part of the AI ecosystem.
For clarity, importers do the same but from a separate country; and distributors bring AI solutions to market on behalf of a provider or importer.
Importers in particular might be surprised to find themselves under scrutiny – providers located outside the EU (i.e. Switzerland or the UK) who intend to put AI systems on the market in the EU (for free or a fee) will be subject to the same laws.
The AI Act, one way or another, will hold them all accountable.
While it is a complex field, Penta is on hand to help you if needed. We can:
- Assess your AI risk and see how the EU AI Act applies to you
- Conduct an impact assessment
- Create a governance framework specific to your company
- Guide you through the adoption process so the AI Act facilitates innovation within your company
The AI Act will have far-reaching implications, so the time to start preparing is now. Leaving it too late means the Act could stifle your potential – early adoption will stand you in good stead to leverage the Act to create a productive, innovative workspace.