The EU AI Act passed. Now the real work begins
Hello and welcome to Eye on AI.
Yesterday marked a giant leap for AI regulation. The European Parliament passed the EU AI Act with 523 members voting in favor and 46 voting against. First proposed in 2021—what feels like a decade ago in the current world of AI—the already hotly debated act had to be reimagined to account for the commercial availability and rapid progress of “general-purpose AI systems” like ChatGPT that upended the landscape in late 2022.
As I reported in December when representatives of EU countries agreed on the terms, the act lays out guardrails and stringent transparency requirements for general-purpose AI (GPAI) systems, particularly for applications it deems high risk. Examples of high-risk areas spelled out in the act include critical infrastructure, education, employment, health care, banking, migration and border management, justice and democratic processes, and “certain systems in law enforcement.” It also bans several applications entirely including untargeted scraping of facial images, emotion recognition in the workplace and schools, biometric categorization systems that use sensitive characteristics, and other AI systems that could be used to manipulate people or exploit their vulnerabilities. Additionally, the act imposes limitations on, but doesn’t ban, the use of biometric identification systems in law enforcement.
The AI Act is not technically at the finish line, as the legal language of the text still needs to go through a final vote in the Council of Ministers—which has already said it will approve if it passes parliament and is largely seen as a formality. But in many ways, the EU AI Act is approaching a new starting line. Now that it has been enacted, it has to be executed and actually be enforced, and that’s easier said than done.
“The EU Artificial Intelligence Act may be the most consequential legislation for the digital economy since the GDPR. Yet the temptation to move on to the next challenge after the formal adoption of the AI Act must be resisted. Laws are not self-executing. The AI Act will require ongoing engagement by civil society,” wrote the Center for AI & Digital Policy in a report, prepared for the European AI & Society Fund, examining the challenges ahead.
Specifically referencing the competition between the U.S., Europe, and China to control the digital economy, the report calls out how tech industry lobbying and corporate philanthropy are squeezing out vital voices advocating for the needs of people and society when it comes to AI. “It is essential that these groups are resourced effectively so that the victories gained in legislation thus far can be enacted in practice,” the report concludes.
Others such as Gartner analyst Avivah Litan have also questioned how the EU plans to actually enforce these rules, telling TechTarget “the enforcement is going to be really difficult” and that high-risk algorithms in particular are going to be “impossible to regulate.” The EU plans to set up the European AI Office to oversee all things AI across the union and play a key role in executing the act, but there will still be challenges around enforcement consistency across the 27 member states.
Another factor is whether the penalties will actually do enough to deter companies from breaking the rules. Depending on the violation, the EU AI Act will enable regulators to fine AI providers between $8.2 million and $38.2 million, or between 1.5% and 7% of the company’s global turnover, whichever is higher. But as we’ve seen before, EU fines on tech giants have often amounted to little more than a slap on the wrist or have been considered just a cost of doing business—even when they have amounted to billions of dollars. Last year, the EU fined Meta $1.3 billion for violating privacy laws, and yet the company closed out the year with a blockbuster financial report that sent its stock soaring 20%.
Enforcement is set to roll out in waves, with prohibitions of the banned use cases starting in six months, obligations on providers of general-purpose AI systems going into effect in a year, and most other provisions taking effect in two to three years. That’s a lot of time in the world of AI, where it feels like there’s a new breakthrough and a more capable model rolling out every day. By the time many of these provisions kick in, a lot will have happened, and we may even be dealing with a whole new landscape. So while the EU AI Act is officially here, it’s really just beginning.
And with that, here’s more AI news.
Sage Lazzaro
sage.lazzaro@consultant.fortune.com
sagelazzaro.com
This story was originally featured on Fortune.com