On March 13, 2024, the European Parliament formally adopted the EU Artificial Intelligence Act (“AI Act”) with a large majority of 523-46 votes in favor of the legislation. The AI Act is the world’s first horizontal and standalone law governing AI, and a landmark piece of legislation for the EU.

Brief Recap of the AI Act

On April 21, 2021, the European Commission had first proposed the EU AI Act. Throughout the legislative process, the AI Act has undergone significant amendments – in particular to address the risks presented by foundation, generative and general-purpose AI (which was not a technology considered at the time of the Commission’s drafting of the proposal). Key principles, along with the AI Act’s risk-based approach, were however maintained. Fast-forward to December 8, 2023 – following three days of intensive negotiations – the EU legislators reached historical agreement on the AI Act followed by technical discussions to finalize the text (see our blog post here which also sets out the key requirements imposed on AI providers, product manufacturers, deployers and other relevant actors). On January 26, 2024, the final compromise text of the AI Act was published (see our blog post here) and has now been adopted by the European Parliament. The adopted AI Act can be reviewed here.

Landmark Law

The EU considers the AI Act as one of its key pieces of legislation and fundamental to the EU. More specifically, the EU is aiming for the AI Act to have the same ‘Brussels effect’ as the GDPR — in other words, to have a significant impact on global markets and practices and to serve as a potential blueprint for other jurisdictions looking to implement AI legislation.

However, the story does not end here. Over the next few months and years, the AI Act will be specified and supplemented further by secondary EU legislation – implementing and delegated acts to be adopted by the EU Commission. The EU is also finalizing amendments to the EU Product Liability Directive to bring it in line with the EU AI Act and has proposed a new EU AI Liability Directive which will facilitate redress claims by consumers for harm caused by AI.

In addition, EU officials have already commented that the EU would be looking to develop additional, more targeted AI laws following the EU elections in June 2024, for example, to regulate the use of AI in employment. Although the AI Act already partially addresses the use of AI in the context of employment, EU officials have indicated that this could be “further enhanced” by introducing specific legislation on this topic. Furthermore, due to the highly debated issues and concerns related to copyright and AI, it is expected that the EU will issue legislation to address copyright concerns in AI.

In summary, organizations inside and outside the EU – in particular those that are implicated by the “unacceptable” and/or “high-risk” use cases and industries – should get used to navigating a highly complex regulatory landscape, with the EU AI Act at the center.

Enforcement

Non-compliance with the EU AI Act can result in regulatory fines of up to 7% of global worldwide turnover, as well as civil redress claims and reputational damage.

The AI Act is mainly enforced at an EU Member State national level, with the exception of general-purpose AI models, which are enforced by the European AI Office. The European AI Office has recently been formally established by a Commission decision of January 24, 2024 (interestingly, it has been established even prior to the formal adoption of the AI Act).

In addition, the EU AI Act establishes an AI Board which is competent to ensure the consistent application of the EU AI Act throughout the EU and is responsible, for instance, for issuing recommendations and opinions, developing codes of conduct/codes of practice, and technical standards.

Next steps

Following this official adoption, the AI Act will be subject to the Council’s formal endorsement before becoming law. The AI Act is likely to enter into force at the end of April or early May of this year. Following entry into force, the AI Act will not be immediately enforceable but will be subject to a gradual and phased transition and implementation period whereby it will become fully applicable 24 months after entry into force, except for: bans on prohibited practices (6 months after the entry into force), codes of practice (9 months after entry into force), general-purpose AI rules (12 months after entry into force), and obligations for high-risk systems (36 months after entry into force).

For more practical information on how to prepare for the AI Act, please see our webinars and blog posts here and here.