EU Set to Put Landmark AI Legislation into Law

The European Parliament has approved the Artificial Intelligence Act, a sweeping new law that would bring safeguards to protect citizens and democracy without stifling innovation in the new landscape of generative AI.

The act introduces outright bans on certain types of AI applications, including scraping internet or CCTV footage to build facial recognition databases and biometric categorization based on “sensitive characteristics” such as race or political leaning. In some limited and clearly defined cases, judicial authorizations can grant law enforcement exceptions.

The legislation sets out clear obligations for those building high-risk AI systems – that is, systems that can potentially cause harm to “health, safety, fundamental rights, environment, democracy, and the rule of law.” For example, such systems could exist in healthcare, banking, education, or critical infrastructure.

Those building such AI systems must track and provide transparency on risks and mitigation plans, use logs, and ensure there is “human oversight.” They must also provide citizens with a means to submit complaints and respond to them, giving clear explanations about “decisions based on high-risk AI systems that affect their rights.”

There will also be a higher level of transparency required, including publishing summaries of the content used for training models and labeling altered or generated video, audio, or image content.

The legislation makes room for innovation, requiring sandboxes and testing capabilities to be set up at a national level and made accessible for startups and small and medium enterprises.

Since the first proposal in 2021, the EU has been working on this new legislation. Negotiations with the member states concluded in December 2023, and now the European Parliament has approved it with 523 votes in favor, 46 against, and 49 abstentions.

Going forward, the Council needs to endorse the law and then will enter into force 20 days after its official publication. It will become fully applicable over the next two years with staggering dates for different aspects of the Act. For example, bans on specific practices will apply in six months and governance related to AI rules must be in place within 12 months.