The European Parliament has officially adopted the Artificial Intelligence Act, a landmark law aimed at ensuring safety and compliance with fundamental rights in the AI landscape. The regulation, agreed upon in negotiations with member states in December 2023, was endorsed with an overwhelming majority, signaling a strong commitment to protect citizens' rights while fostering innovation in AI.
The AI Act takes a risk-based approach, with different levels of obligations for AI systems based on their potential for harm. Certain high-risk applications, such as the use of biometric identification systems by law enforcement and AI-based social scoring, will be banned outright. Other high-risk systems, including those used in critical infrastructure, education, employment, and essential services, will face strict requirements like risk assessments, human oversight, and the use of high-quality data.
The law also addresses the growing field of general-purpose AI (GPAI), like the models underpinning ChatGPT. GPAI systems must meet transparency requirements, such as complying with EU copyright law and publishing summaries of their training data. The most powerful GPAI models, deemed to pose systemic risks, will face additional obligations like model evaluations, risk mitigation, and incident reporting.
To support innovation and assist SMEs, the AI Act mandates the establishment of regulatory sandboxes and real-world testing at the national level. It also includes measures to ensure that AI-generated content, or "deepfakes," are clearly labeled as such.
While the AI Act only applies within the EU, it is expected to have a global impact as companies adapt their practices to maintain access to the bloc's substantial market. Other jurisdictions may also look to the EU's framework as a model for their own AI regulations.
The law will enter into force twenty days after its publication in the official Journal and be fully applicable 24 months after, except for certain provisions. The prohibitions in the legislation are expected to become enforceable later this year, while rules for general-purpose AI systems like chatbots will start applying a year after the law takes effect. By mid-2026, the complete set of regulations, including requirements for high-risk systems, will be in force.
Violations of the AI Act could draw fines of up to 35 million euros ($38 million), or 7% of a company's global revenue, ensuring a strong deterrent against non-compliance. Each EU member state will set up its own AI watchdog to handle complaints, while the European Commission will establish an AI Office to oversee the regulation of GPAI systems.