Looking ahead to the EU AI Act

Setting the scene

As the world’s groundbreaking comprehensive horizontal legal framework for AI regulation, the AI Act stresses the EU’s commitment to defining and managing the risks and unlocking opportunities inherent in AI technology.

The reason for establishing an EU regulation is to ensure unified action among all Member States, positioning the EU as a major player worldwide. As indicated in the preamble of this regulation, differing national rules could lead to fragmentation of the internal market, threatening EU competitive advantage, and also decrease legal certainty for operators that develop, import or use AI systems within the EU.

This indeed fits the EU strategy ‘A Europe fit for the digital age’, determined to strengthen the EU’s digital sovereignty on its territory and take the regulatory lead, rather than adopting a “following others’” strategy. Drawing inspiration from past successes of the “Brussels effect” such as GDPR, the AI Act is intended to serve as a pioneering endeavour to set standards for third countries. 

According to the European Commissioner for Internal Market, Thierry Breton, the result is “a balanced and futureproof text, promoting trust and innovation in trustworthy AI”. Indeed, the rationale behind this regulation is to provide confidence to end users while still fostering innovation.

General provisions

(Chapter I , Art. 1-4)

Article 1 opens the AI Act by outlining the objectives of the regulation, giving away the ambitious purpose of the text. While bolstering the functioning of the internal market stands out once again as a fundamental objective of the EU, the true emphasis given in the Article appears to lie in ensuring responsible and ethical AI development and deployment. This involves a multi-faceted approach focused on:

• Prioritizing Human-Centered AI: the AI Act calls for the development and use of human centric and trustworthy AI that respects human values.
• Balancing Innovation with Safety and Ethics: innovation in the AI field is encouraged while recognising the potential risks inherent in such powerful technologies. The AI Act outlines measures to mitigate these risks, by deeming specific requirements for high-risk AI systems, harmonised transparency rules for certain AI systems and the straight prohibition of certain artificial intelligence practices.
• Mitigating Harmful Effects: The AI Act also acknowledges the potential harms associated with AI misuse, such as bias, discrimination, and privacy violations. It implements safeguards to address these concerns, including transparency requirements that allow individuals to understand how AI systems work and make decisions, along with rules on market monitoring, market surveillance governance and enforcement.

Article 2 clarifies the scope of the AI Act and identifies who and what it regulates. Specifically, the AI Act applies to three main categories:

1. providers placing on the market or putting into service AI systems or placing on the market general-purpose AI (General Purpose AI) models in the Union, irrespective of whether they are based in the Union or not;
2. deployers of AI systems that are established or located in the Union; and
3. providers and deployers of AI systems that have their place of establishment or who are located in a third country, where the output produced by the system is used in the Union.

In addition to these three categories of entities regulated by the AI Act, the provisions of this regulation also apply to importers and distributors of AI systems, product manufacturers who integrate AI systems into their products under their own name or trademark, and authorized representatives of providers not established in the Union. The AI Act also applies to affected persons located within the Union.

Article 2 gives away the activities to which the AI Act applies only in a very limited way, referring to the systems classified as high-risk under Article 6 that are already covered by certain EU harmonisation legislation listed in Annex II, as well as the ones to whom the AI Act does not apply, such as:

• AI systems used solely for scientific research and development, recognising the importance of fostering innovation in this critical field; and
• Activities outside the scope of EU law, including military, defence, and national security concerns, regardless of who conducts them.

The AI Act is designed to complement, rather than interfere with, existing legislation such as the EU General Data Protection Regulation (GDPR) and the EU e-Privacy Directive. This ensures that the powers of supervisory authorities and the rights of data subjects under these laws are preserved.

Article 3 is dedicated to defining key terms that are essential for understanding the implementation of the AI Act. Understanding these terms is essential for stakeholders to navigate the regulatory landscape and implement compliant AI practices.