‘Narrow exception’ for biometric law-enforcement use, foundation models to have ‘additional binding obligations’
Following marathon discussions last week, the European Union has secured a tentative agreement on the terms of the AI Act, bringing the landmark regulation closer to enactment.
While missing the original deadline for Wednesday, lawmakers managed to thrash out a deal late on Friday, just in time for the weekend. If they had not, the law would have been delayed until next year, potentially after the EU-wide elections in June.
It has not been easy trying to hit a moving target.
Billed as the world’s first comprehensive legislation for artificial intelligence, the Act was first proposed in 2021. In the years since then, the rapid development of AI has caused various divisions in the bloc’s regulatory plans.
The latest rift emerged after the explosive launch of ChatGPT last year. The OpenAI chatbot sparked panic and excitement about the power of foundation models, which are sometimes referred to as “general purpose” AI systems. EU nations were split over the best way to oversee them.
France, Germany, and Italy opposed plans for binding rules, which they feared would impede innovation and their domestic businesses. The trio proposed to instead follow codes of conduct.
Another sticking point was the restrictions on biometric surveillance. EU legislators had wanted an outright ban, while governments had called for a national security exemption.
At the 11th hour, lawmakers clinched a provisional deal on the Act’s principles, centred around what they call a risk-based approach. This follows a tiered category structure:
As per usual for EU tech regulations, hefty fines will be doled out to those failing to comply. These will range from €35mn (or 7% of global annual turnover, whichever is higher) for violations on banned applications, to €7.5mn (or 1.5%) for supplying incorrect information.
In addition, the Act introduces specific rules for general purpose AI models. For very powerful models that could pose systemic risks, there will be “additional binding obligations” that will be “operationalised through codes of practices developed by industry, the scientific community, civil society, and other stakeholders together with the Commission.”
While enforcement will be up to individual member states, the Act also determines the establishing of a new European AI Office within the European Commission. Meanwhile, the bloc’s industry chief Thierry Breton stated that the Act was not only a rulebook, but a “launchpad for EU startups and researchers to lead the global AI race.”
The provision will now require further negotiation — and there’s still time for more lobbying. But there’s also now a strong chance of a full agreement before next year’s European parliamentary elections.
Still, the law is unlikely to take effect for at least 18 months. By that point, the world of AI could be a very different place.