The European Parliament granted final approval of the EU Artificial Intelligence Act on March 13, 2024, by a vote of 523 for passage, 46 against, and 49 abstaining. The Act faces a final hurdle – approval by EU member states – before its provisions gradually take effect. The goal of this Act is to “ensure a high level of protection of health, safety, fundamental rights, democracy and rule of law and the environment from harmful effects of [AI].”

The Act marks the first governmentally enacted, comprehensive regulation of AI technology and is likely to spur on other countries to follow suit, just as the EU’s enactment of General Data Protection Regulation (GDPR) acted as a catalyst for other countries to pass analogous regulations.

Scope and Possible Penalties

The Act covers developers, distributors, importers, manufacturers, and providers within the EU. Additionally, the Act has extraterritorial application, to providers and “deployers” of AI, if the output is intended for use in the EU.

The EU AI Act provides detailed rules for AI systems depending on the level of risk. For example:

• The AI Act bans the use of “Unacceptable” AI. Examples of “Unacceptable” AI include the use of real-time facial recognition in public areas and social scoring systems.
• “High-risk” use is considered AI that could lead to safety impacts or negatively affect fundamental rights. While “High-risk” models are permitted, these systems will be required to pass assessment before being introduced to the public. Examples include AI dealing with the management and operation of “critical infrastructure,” AI systems used to “influence the outcome of an election,” and AI used to evaluate the credit score of natural persons.
• For AI systems of limited or minimal risk, providers will need to comply with certain transparency requirements like disclosing that content was generated by AI and allowing users to an informed decisions when engaging with the AI. The AI Act would also require safeguards preventing AI systems from generating illegal content.

Companies involved in the development stage of AI would also have to publish detailed summaries in the models used to train their AI systems.

Violations of the Act could result in high monetary penalties – up to €35 million, or 7% of the offending actor’s global revenue. Additionally, the Act mandates that EU member states “shall lay down the rules on penalties and other enforcement measures, which may also include warnings and non-monetary measures, which…shall be effective, proportionate, and dissuasive.” The Act does not provide any further guidance on what from these non-monetary penalties may take.

Next Steps for the Act

The Act has gone through several iterations since the European Parliament began work on the Act in 2018. Since the first public draft in early 2021, the Parliament added the risk categorizations and has worked to strike a balance between innovation and protection. This enactment comes amidst the backdrop of global calls for regulation of AI and fears that the technological advances are outpacing our current understanding of its potential risks.

Having passed the Act, the European Parliament will now send it to the member states for their final approval, which many see as a formality. Given the Act’s history, and its overwhelming passage in Parliament, the Member States will likely approve the Act as early as May. Once approved by the Member States, the Official Journal of the European Union will publish the Act and it “shall enter into force on the twentieth day” thereafter.

The Act contains a phased rollout, setting benchmarks along the way. For instance, within six months of its enactment, the “prohibitions” take effect. Thereafter, the Member States must establish a regulatory body to oversee the enforcement of the Act – identifying violations and imposing penalties – within 24 months of the Act’s enactment.