On August 1st, the European Union’s landmark AI Act officially came into effect, setting the stage for how artificial intelligence (AI) will be regulated across Europe—and beyond. This comprehensive legal framework, the first of its kind, aims to ensure that AI systems entering the EU market are safe, ethical, and trustworthy. With its far-reaching scope, the AI Act is poised to influence AI practices worldwide, making it a critical regulation for businesses and governments alike.
While AI was not entirely unregulated in the EU before this Act, thanks to the General Data Protection Regulation (GDPR), the new legislation introduces a risk-based framework that categorizes AI systems based on the level of risk they pose to individuals’ rights and safety. This regulation is a game changer for corporations globally and it sets new standards for AI usage and compliance.
Precedents in AI Regulation
Before the AI Act, several notable enforcement actions had already occurred under the GDPR. These included the Italian ban of the ReplikaAI chatbot, the temporary ban of ChatGPT over concerns related to data privacy, the temporary suspensions of Google’s Bard AI in the EU, and fines imposed on companies like Deliveroo for improper use of AI algorithms. Clearview AI, a company known for its controversial facial recognition technology, also faced fines under GDPR. These cases demonstrated that AI-related compliance was already a concern in Europe. However, the AI Act now expands and formalizes the regulatory framework, creating a more structured approach to managing AI technologies.
The Risk-Based Framework of the AI Act
The AI Act introduces a tiered system of regulations based on the risk level posed by AI systems:
- Minimal Risk AI Systems: These include low-impact systems such as email spam filters. Minimal risk AI does not require specific compliance, though companies can voluntarily adhere to codes of conduct to enhance trustworthiness.
- High Risk AI Systems: These systems must comply with stringent requirements, including risk mitigation, high data quality, detailed documentation, human oversight, and robust cybersecurity measures. Examples include AI systems in critical infrastructures, medical devices, education, law enforcement, and systems used for biometric identification. Companies that develop and deploy these systems must appoint an authorized representative in the EU and register their AI technologies under Article 49 of the Act. This registration is reminiscent of the Data Protection Representative (DPR) rules established under GDPR. The Data Protection Representative, often referred to as the EU Representative, is a concept established under Article 27 of the GDPR, that requires certain organizations that are based outside of the European Union (EU) but process personal data of individuals within the EU to designate an EU-based representative. This representative acts as a local contact point for data protection authorities (DPAs) and data subjects on issues related to GDPR compliance.
- Unacceptable Risk AI Systems: Certain AI applications pose such severe threats to fundamental human rights that they will be outright banned. These include AI systems that manipulate human behavior, such as toys that encourage dangerous actions, or social scoring systems used by governments and corporations. Emotion recognition systems and real-time biometric identification for law enforcement in public spaces will also face heavy restrictions, with limited exceptions.
- Specific Transparency Risk AI Systems: These systems must meet transparency requirements to ensure that users are aware they are interacting with AI. For example, chatbots must disclose their machine nature, and AI-generated content like deepfakes must be clearly labeled. Additionally, providers must ensure that synthetic media is detectable by automated systems, reducing the risk of malicious manipulation.
- Systemic Risk and General Purpose AI: General-purpose AI models (GPAI), such as large language models and systems used for image recognition, fall under specific transparency and risk management rules. These models, with their broad capabilities and high-impact potential, face additional binding obligations, including adversarial testing, monitoring, and risk management. These provisions are designed to mitigate the unique risks posed by powerful AI systems that can influence public health, safety, and security on a large scale.
Learn more about DELTA Data Protection Manager Courses: DELTA Academy & Consulting
Enforcement and Oversight
Enforcement of the AI Act will be carried out by Market Surveillance Authorities (MSAs) at the national level within each EU member state. These authorities must be appointed by August 2025 and will supervise compliance within their respective countries. Although it’s not guaranteed that each country’s Data Protection Authority (DPA) will assume responsibility for enforcing the AI Act, the European Data Protection Board has pushed for DPAs to take on this role.
At the EU level, a new European AI Office will be established within the European Commission. This office will coordinate enforcement activities across member states and will be responsible for overseeing compliance with general-purpose AI models. The system is similar to the way competition law is enforced in the EU, with a mix of national enforcement and centralized coordination.
The AI Act also grants MSAs the power to conduct unannounced inspections—both remote and on-site—to verify compliance, particularly for high-risk AI systems. Additionally, competition authorities may conduct dawn raids if AI-related activities raise concerns about market competition.
Penalties for Noncompliance
Noncompliance with the AI Act will result in significant penalties. The fines are designed to scale with the severity of the violation:
- Violations related to banned AI applications can result in fines of up to €35 million or 7% of global annual turnover.
- Violations of other obligations, such as those related to high-risk and general-purpose AI systems, carry fines of up to €15 million or 3% of global turnover.
- Companies that provide false or misleading information to regulators could be fined up to €7.5 million or 1.5% of their global turnover.
Smaller penalties are foreseen for small and medium-sized enterprises, while larger companies could face even higher fines depending on their revenue.
Global Implications of the AI Act
Much like GDPR, the AI Act has an extraterritorial reach, meaning that businesses outside of the EU may also be subject to the regulations if their AI systems or AI-generated outputs are available in the EU market. For instance, a U.S. company with a chatbot accessible to EU users would need to comply with the AI Act. Similarly, media companies distributing AI-generated content to European audiences would also fall under the Act’s jurisdiction.
This broad applicability means that companies worldwide must pay close attention to the EU AI Act, even if they do not have a physical presence in Europe. The Act is likely to influence AI regulations in other regions, as countries such as the UK, the U.S., and China are developing their own AI policies in response to the rapidly evolving technology landscape.
Learn more about DELTA Data Protection Manager Courses: DELTA Academy & Consulting
The Future of AI Regulation: What Comes Next?
Although the AI Act officially took effect on August 1, 2024, its full enforcement won’t begin until 2026, allowing companies two years to prepare for compliance. Key provisions, such as the ban on unacceptable risk AI systems, will take effect in February 2025. Meanwhile, companies working with general-purpose AI models are required to establish codes of practice by May 2025.
In anticipation of full enforcement, the European Commission is launching an “AI Pact” to encourage voluntary compliance ahead of the deadlines. Over 550 organizations have expressed interest in participating, and the Commission is set to formally introduce the pact in October 2024. This voluntary initiative aims to ease the transition into the new regulatory environment and promote responsible AI practices across industries.
As AI continues to revolutionize industries, the EU AI Act sets a precedent for responsible AI governance. With its focus on risk management, transparency, and human rights protection, the AI Act seeks to build trust in AI technologies while ensuring that they are developed and deployed ethically. As other jurisdictions, including the U.S. and China, formulate their own AI regulations, the EU AI Act stands as a model for balancing innovation with accountability.
For businesses worldwide, understanding and adhering to the EU AI Act will not only be critical for compliance but also for staying competitive in an increasingly regulated global AI marketplace.
DELTA Data Protection & Compliance, Inc. Academy & Consulting – The DELTA NEWS – Visit: delta-compliance.com
