Simplifying the new legislation
Part of my own learning on AI has been to understand how legislation will govern the use of AI across all sectors. In this article, I try to break it down for you.
Firstly, it’s fair to say that the EU AI Act represents a groundbreaking milestone as the world’s first comprehensive legal framework for artificial intelligence (AI). It is trying to govern the biggest technological revolution in our lifetime.
It is designed to tackle the risks and opportunities of AI. The Act prioritises areas such as:
- Health
- Safety
- Fundamental rights
- Democracy
- The environment.
But simultaneously, it fosters innovation and competitiveness within the EU’s internal market.
As businesses and government agencies increasingly adopt AI, especially Generative AI (GenAI), to drive efficiencies, they must implement AI responsibly. Yet, determining where to start can be daunting.
Organisations need to understand their AI exposure and develop robust governance frameworks to manage associated risks effectively.
Here’s a closer look at who the EU AI Act applies to, its risk categories, obligations, and the steps businesses can take to ensure compliance.
Who Does the EU AI Act Apply To?
The EU AI Act is far-reaching, applying to businesses that:
- Create or use AI systems.
- Sell, distribute, or import AI systems.
- Operate within the EU or supply AI systems whose outputs are used within the EU.
The Act adopts a risk-based approach, categorising AI systems by potential impact. Specific obligations also extend to providers of large GenAI models like ChatGPT and Bing Chat, though free and open-source models are generally exempt—unless they present systemic risks.
Exemptions include AI systems exclusively for military, defence, or national security purposes, as well as research, development, and prototyping activities.
Risk Categories Under the EU AI Act
The Act classifies AI systems into four categories:
1. Unacceptable Risk
These uses are outright prohibited due to their severe implications for fundamental rights. Examples include:
- Social scoring.
- Exploitation of vulnerable individuals.
- Real-time biometric identification in public spaces (with limited exceptions).
- Emotion recognition in workplaces and schools (except for safety or medical reasons).
2. High Risk
High-risk systems require stringent oversight and compliance. Examples include:
- AI systems in critical services like healthcare and transport.
- Recruitment tools, such as CV-sorting software.
- Systems influencing eligibility for loans, insurance, or public services.
3. Limited Risk
These systems require transparency measures, such as informing users when interacting with AI. Examples:
- Chatbots.
- Easily recognisable deep-fakes.
4. Minimal Risk
AI applications not covered by the above categories face no additional compliance obligations. For instance:
- AI in video games.
Obligations for High-Risk AI Systems
Before deployment, high-risk AI systems must undergo a conformity assessment to ensure they meet standards for:
- Transparency.
- Human oversight.
- Data quality and cybersecurity.
Public authorities using high-risk systems must also register them in a public EU database.
Compliance Timeline
Following its adoption, the EU AI Act will take effect 20 days after publication, with a staggered application schedule:
- 6 months: Prohibited systems must be phased out.
- 12 months: Obligations for general-purpose AI governance begin.
- 24 months: Full compliance for high-risk systems in Annex III.
- 36 months: Compliance for systems in Annex II.
Penalties for Non-Compliance
The penalties are significant:
- Up to €35m or 7% of worldwide annual turnover for prohibited practices.
- Up to €15m or 3% for other non-compliance.
- Up to €7.5m or 1.5% for supplying false information.
Guidelines to harmonise enforcement across the EU will be developed by the European Commission.
Key Actions for Businesses
To prepare for the EU AI Act, businesses can take the following steps:
1. Create an AI Exposure Register
Identify all AI systems within your organisation, including third-party applications and updates integrating AI.
2. Risk-Assess AI Use Cases
Apply the EU AI Act’s risk framework to each identified use case. Implement necessary governance and controls to mitigate risks.
3. Establish AI Governance Structures
Align AI governance with your organisation’s broader governance framework to ensure risks are managed responsibly.
4. Upskill and Raise Awareness
Equip your team with the knowledge to use AI responsibly, ensuring everyone understands its capabilities and limitations.
If you’re ready to deepen your understanding of AI and its implications for public sector marketing, consider enrolling in the Professional Diploma in AI for Public Sector Marketing. This comprehensive course will equip you with the knowledge and skills to navigate AI’s evolving landscape effectively.
The EU AI Act is set to shape the future of AI in Europe, balancing innovation with accountability. By understanding its implications and taking proactive steps, businesses can harness AI’s potential while staying compliant.
Ready to prepare your organisation for the EU AI Act? Start by evaluating your AI exposure and building the foundations for robust AI governance today. Read more here: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
About the Author
Joanne Sweeney is a specialist in public-sector marketing and digital communications. She’s the author of Public Sector Marketing Pro and the creator of the Professional Diploma in AI for Public Sector Marketing. With years of experience training, consulting, and advocating for digital transformation, Joanne provides insight and guidance for government agencies navigating the digital landscape. She is also the host of the award-winning Public Sector Marketing Show podcast.
