AI has surprised everyone in recent years, including policymakers. Because AI already has such a big impact on society, the European Parliament has passed a law to change that: the AI Act. The AI Act is a European law that limits the use of AI, algorithms, and machine learning and requires that risks to humans and society be minimized.
What is the AI Act and from when must it be complied with?
The AI Act is a European regulation that sets strict rules in the EU for all autonomously acting computer systems that make decisions, generate content or assist people. With the AI Act, the EU wants people and businesses to be able to rely on safe, transparent, traceable, non-discriminatory and environmentally friendly AI systems supervised by humans. It is expected that by 2026, anyone working with AI will have to comply with the requirements.
If violated, the AI Act imposes high fines. The maximum fine is 40 million, or 7% of your total worldwide annual sales for the prior fiscal year, whichever is higher.
Who is subject to the AI Act?
The AI Act applies to all sectors, such as healthcare, government, finance, education, and entertainment. It is therefore not limited to a specific industry. The new rules apply to anyone who develops, uses, or imports AI into the EU and sells it there. Examples include:
- Producers of AI systems;
- Integrators incorporating AI into their own software services;
- Importers getting AI from outside the EU;
- Users deploying such services.
If you are using AI, you must be able to demonstrate compliance yourself and will therefore need to seek clarity from the supplier.
The risk levels
The AI Act imposes certain obligations on providers and users. These obligations depend on the risk of the AI application. In many AI systems, the risk is minimal, but all AI systems must be assessed. There are three risk levels for this:
- Unacceptable risks: if an AI does something that is contrary to European fundamental norms and values. In that case, it must not be used in the European market. For example: facial recognition in public spaces and predicting criminal behavior.
- High risks: AI systems that pose a high risk to health, safety, fundamental rights or the environment. These are permitted under strict conditions. There must be clarity about where the data comes from, human oversight is required, and the technical documentation must be in order.
- Low risk: AI systems that do not fall under the categories mentioned above are allowed to enter the European market without too much trouble. The AI must be transparent, so that no one thinks they are dealing with a human being. Furthermore, the AI must not make autonomous decisions.
What do you need to comply with under the AI Act?
The AI Act places most obligations on AI systems in the high category. For these systems, the following must be in place:
- Risk Management System;
- System of data management;
- Technical Documentation;
- Transparency;
- Human supervision;
- Specific conformity assessment tailored to the characteristics of the AI.
Low-risk AI systems must meet minimum transparency requirements. Users must be able to make informed decisions. It must be clear to the user than they are dealing with an AI system. This includes AI systems that generate image, audio or video material, such as deepfakes.
What does the AI Act mean for you?
If you or your organization works with AI or algorithms, or is considering doing so, take the following steps in advance:
- Inventory: Inventory the type of AI, the vendor, and the information you need from them. Do not forget to also include the AI services that employees have purchased on their own initiative.
- Research: Research what your role is and what responsibilities that entail. Then assess whether your contracts align with that. Think about liability, termination periods, and the possibility of demanding documentation about operations and the like.
- Evaluate: Evaluate the output of the AI system. Provide protocols for evaluating output and make policies regarding periodic audits.
- Determine the risk level of the AI system.
The relationship between the AI Act and the AVG
The premise of the AVG is the fundamental right to data protection. As a citizen, you can exercise your right against organizations that process your data. The AI Act views AI systems as products and regulates them from this perspective. This means that the security of the AI system is checked in advance. Citizens are indirectly protected from faulty AI systems, but they have no direct role in the AI Act. They cannot exercise their rights directly as under the AVG. This is not necessarily necessary if faulty AI systems are kept off the market and individuals can retain their rights under the AVG. In other words, if you suspect that personal data is being processed by a faulty AI system, you can still exercise your rights under the AVG. Importantly, this only applies to AI systems that process personal data. Therefore, the relationship between these two regulations must be transparent.
Why the AI Act is so important right now
Some AI technologies have been around for more than 50 years, but computers are getting stronger and stronger, and with the vast amount of data available today, AI can do more and more. As a result, AI is having a major impact on society. That is precisely why it is reassuring that artificial intelligence will be regulated. The goal is that people and businesses in the EU can count on safe AI systems that are supervised by humans.