AI Act published in the Official Journal of the EU

Following the European Commission's initial proposal in April 2021, the AI Act has finally been published in the Official Journal of the EU after more than three years of negotiations. The AI Act will enter into force on 1 August 2024 and shall apply from 2 August 2026. However, specific parts of the AI Act will become effective earlier, and some not until later:

• 2 February 2025: From this date on, the general provisions of the AI Act shall apply. Providers and deployers must also ensure their staff and persons dealing with the operation and use of AI systems on their behalf have a sufficient level of AI literacy. Moreover, the provisions on prohibited AI practices shall apply, so that companies must identify before this date whether they use computer systems that qualify as prohibited AI practices.
• 2 August 2025: From this date on the provisions on general-purpose AI models shall apply. In addition, the provisions on penalties shall apply, with the exception of provisions on fines for providers of general-purpose AI models.
• 2 August 2027: The provisions on high-risk AI systems and the corresponding obligations shall apply.

Purpose

The AI act aims to improve the functioning of the internal market by laying down a uniform legal framework in particular for the development, market placement, implementation and use of AI systems in the EU.

To introduce a proportionate and effective set of binding rules for AI systems, the AI Act follows a risk-based approach. The AI Act prohibits unlawful (in terms of the AI Act: unacceptable) AI practices and imposes rigid requirements for high-risk AI systems. It also lays down transparency obligations for certain AI systems (e.g., emotion recognition systems, deep fakes, chatbots).

Obligations

The AI Act imposes different obligations on different actors, such as providers, distributors, deployers, etc. The core obligations to be implemented by the respective actors involve ensuring transparency, providing information and maintaining documentation.

Penalties

• up to EUR 35m or (if the offender is an undertaking) up to 7 %of its total worldwide annual turnover for the preceding financial year, whichever is higher, for non-compliance with the prohibition of AI practices
• up to EUR 15m or (if the offender is an undertaking) up to 3 %of its total worldwide annual turnover for the preceding financial year, whichever is higher, for non-compliance with certain obligations under the AI Act, including non-compliance with the relevant provisions on general-purpose AI models

What's next?

As the AI Act enters into force on 1 August 2024, institutions should assess whether and to what degree they will be affected by the AI Act. They should also determine the risk category of their AI use and their corresponding obligations. It should be noted that the use of AI imposes not only legal challenges but also asks for a skilful interpersonal use, so that a holistic implementation approach is key.

Check out our practical guide on the use of existing GDPR tools to ensure AI Act compliance here and contact us to get started with the necessary steps.

Stay up-to-date on the latest developments in the field of data protection and subscribe to our data protection monitor here.