Understanding the European Artificial Intelligence Act (AI Act)

Is your business ready for the latest AI regulations? Does it affect you?

The European Union (EU) is rolling out the EU Artificial Intelligence Act, a comprehensive piece of legislation for regulating the use of AI systems. As businesses continue to innovate using artificial intelligence, staying up to date with new laws is another consideration. This post provides insights into the AI Act and its implications for organizations developing or deploying AI.

What is the EU AI Act?

The EU AI Act is the first of its kind, setting up a regulatory framework for artificial intelligence systems within the European Union. The Act outlines who needs to comply and outlines the risks associated with various AI use cases.  It’s goal is to promote responsible, ethical AI use while safeguarding fundamental rights, public safety, and trust.

The AI Act categorizes AI systems by risk levels. High-risk systems, such as those used in healthcare or transportation, are subject to tighter regulations. Meanwhile, minimal-risk AI systems, like search engines or chatbots, have fewer obligations.

Why do we need rules on AI?

The incredibly fast rise of artificial intelligence across sectors, from healthcare to finance, has brought with it the need for clear guidelines to ensure safe and ethical use. The AI Act addresses several key concerns:

Safety

AI systems, especially those impacting human lives, need human oversight to prevent harm and ensure that risk management protocols are in place.

Human Rights

Unregulated AI can infringe on privacy, equality, and individual freedoms. The Act ensures AI respects these fundamental rights, similar to the protection offered by the General Data Protection Regulation (GDPR).

Trust

A transparent regulatory framework promotes public trust in AI systems and reassures people that requirements and standards are in place, which is vital for widespread adoption and responsible innovation.

Market Fairness

The AI Act helps create a level playing field, allowing businesses to compete fairly while adhering to ethical standards.

Who has to comply with the AI Act?

The AI Act doesn’t just affect businesses within the EU. Both EU-based and international businesses placing AI on the EU market must comply. Key parties include:

• Providers: Entities offering AI systems or general-purpose AI models for the EU market.

• Deployers: Organizations that use AI systems within the EU.

• Importers and Distributors: Businesses importing or distributing AI systems into the EU.

• Manufacturers: Companies producing AI-integrated products under their brand.

• Authorized Representatives: Representatives for non-EU providers.

• Affected Persons: Individuals or entities within the EU impacted by AI systems.

Classifying different levels of AI Risk

The AI Act classifies AI systems based on their potential risks, following a tiered approach:

Unacceptable Risk AI Systems

These are systems deemed too dangerous, such as those violating personal rights or posing a threat to public safety. Unacceptable risk AI systems, like those used for social scoring or manipulative decision-making, are generally prohibited. However, certain AI practices—such as emotion recognition for medical purposes—may be allowed under strict regulations.

High-Risk AI Systems

High-risk AI systems face stricter rules. These systems, usually used in sectors like healthcare, finance, or law enforcement, must comply with requirements such as transparency, human oversight, and risk mitigation. Organizations that use high-risk systems must ensure they meet the obligations outlined in the Act to avoid penalties.

Limited Risk

For limited-risk AI systems, the regulation focuses primarily on transparency. Users need to be informed when interacting with AI and made aware of the system’s limitations. Customer service chatbots and AI tools for content moderation are examples of limited-risk systems.

Minimal Risk

Minimal-risk AI systems face the lightest regulatory burden. Some examples are recommendation engines or spam filters, which are seen to have lower risks to safety or privacy. Personal use AI systems also fall under this category, requiring minimal compliance measures.

Exclusions and Special Cases

Not all AI systems fall under the EU AI Act. Specific use cases are exempt, including:

• National Security and Defense: AI systems that are used exclusively for military or defense purposes.

• Scientific Research: AI systems developed purely for research and development are excluded unless they are commercialized.

• Open-Source AI: Open-source AI models are typically exempt unless they are classified as high-risk or fall under other specified restrictions.

• Personal Use: Individual persons using AI for non-commercial purposes are exempt from the Act.

• Worker Protection: EU member states can introduce additional laws to protect workers impacted by AI in the workplace.

Enforcement and implementation

The enforcement of the AI Act will be overseen by the European AI Office along with national regulators across EU member states. The main strategies for enforcement are:

1. Audits and Assessments: High-risk AI systems need to have regular audits to make sure they are compliant. 

2. Penalties: Non-compliance could result in heavy fines, similar to GDPR. Penalties will depend on the severity of the violation and the harm caused.

3. AI Database: The EU will maintain a central database of high-risk AI systems, providing transparency and enabling monitoring by regulators and the public.

How to ensure compliance with the AI Act

If your business is involved in AI development or deployment, the AI Act introduces critical changes that must be addressed. Here are actionable steps to help ensure compliance:

1. Assess Your AI Systems: Classify your AI models based on the risk levels outlined by the AI Act. This will determine the level of regulatory scrutiny required.

2. Develop a Compliance Plan: For high-risk systems, create a detailed strategy that includes regular risk assessments, compliance with transparency requirements, and human oversight.

3. Ensure Transparency: For limited-risk systems, make it clear to users when they are interacting with AI and what the system’s limitations are.

4. Conduct Audits: Regular audits should be conducted for high-risk AI systems to ensure continued compliance with the AI legislation.

5. Appoint a Compliance Officer or Representative: Non-EU businesses deploying AI in the EU should appoint an Authorized Representative to ensure local compliance.

6. Stay Informed: Keep up with updates from the European Parliament and European AI Office regarding new guidelines or changes to the Act. The regulatory landscape for AI is evolving, and staying informed is crucial.

7. Educate Your Team: Provide training for team members on AI compliance, safety, and ethical guidelines to ensure that they understand the importance of meeting these regulatory requirements.

The EU AI Act is a big step in regulating artificial intelligence. Businesses should assess their systems, develop a compliance plan, and stay informed about regulations. Being proactive will help companies to align with the AI Act and provide trust and innovation in the AI space.

Stay On Track With AI Compliance Through SecureFlag

The EU AI Act brings about a significant change for organizations working with AI and staying ahead of compliance requirements. That’s where SecureFlag can help. Our AI labs and ThreatCanvas, a powerful threat-modeling tool, give your teams the hands-on skills they need to identify risks, address compliance challenges, and keep your AI projects secure and on track. 

Want to learn more? Get in touch with us today!