EU: AI Act is published in the EU Official Journal

ai ai act ai regulation litt institute Jul 15, 2024

On 12 July 2024, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act), was published in the Official Journal of the European Union. This Regulation is commonly referred to as the "EU AI Act". Here is a link to the final text of the Act.

Entry into force and application

According to Article 113 of the Act, the Act comes into force 20 days after its publication, which is on 1 August 2024. However, the obligations in the Act will only start to apply over the next 6 to 36 months in the following stages:

Stage One: 6 month deadline

On 2 February 2025, 6 months after the Act comes into force, Chapters I and II will apply. Chapter I sets out the General Provisions and contains Articles 1 to 4 of the Act.

Article 1 sets out the subject matter of the Act:
- The Act Promotes the use of safe, trustworthy AI, prohibits certain AI practices, regulates high-risk AI systems and sets rules for how AI is sold, used and monitored in the EU.
Article 2 sets out the scope of the Act:
- The Act applies to providers, deployers, importers, distributors, product manufacturers, authorised representatives and affected persons in the EU.
- The Act does to apply to national security, military, or persons using AI purely in a personal non-professional capacity, and does not apply outside EU law.
Article contains 68 definitions introduced by the Act, including:
- "AI System" which means a "machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."
Article 4 introduces an AI literacy obligation for "providers" and "deployers".
- "AI Literacy" means skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.
- Providers and deployers of AI system must take measures to ensure a sufficient level of AI literacy of their staff and others involved with their AI systems, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in.

Chapter II contains Article 5 which deals with prohibited practices.

What is a prohibited practice?

subliminal techniques or purposefully manipulative or deceptive techniques
exploiting the vulnerabilities of a person due to their age, disability or social or economic situation
categorisation based on biometric data to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation
social scoring systems leading to detrimental or unfavourable behaviour
'real-time' remote biometric identification systems in public spaces for purpose of law enforcement
predicting the risk of a natural person committing a criminal offence based solely on profiling or assessing personality traits and characteristics
untargeted scraping of facial images from the internet or CCTV footage to create or expand facial recognition databases

What should you be doing now?

Step one: determine if you fit the definition of "provider" or "deployer"

If yes: Start complying with your Article 4: AI Literacy obligations NOW!

Step two: determine if you carry out or plan to carry out any of the prohibited practices set out in Article 5?

If yes: STOP!

To determine if you are a "provider" or a "deployer" you need to read the definitions set out in Article 3, as well as the scope of the Act set out in Article 2.

Are you a "provider"?

"Provider" means a natural or legal person, public authority, agency or other body that develops an AI system or general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name and trademark, whether for payment or free of charge (Article 3).

The Act applies to providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the EU, irrespective of whether those providers are established or located within the EU or in a third country, and providers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the EU (Article 2).

You are a provider:

if you develop an AI system or general-purpose AI model and place it onto the market or put it into service in the EU under your name (it also applies if you have the system or model developed for you), or
if you develop an AI system outside the EU, but use the output of that AI system in the EU.

("placing on the market" means the first to make it available in the EU, and "putting into service" means the supply of an AI system for first use directly to deployer or own use in the EU)

Are you a "deployer"?

"Deployer" means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity (Article 3).

The Act applies to deployers of AI systems that have their place of establishment or are located within the EU and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used within the EU (Article 2).

You are a deployer:

if you use an AI system under your authority in the EU, or
if you are based outside the EU, but you use the output of an AI system in the EU
and NOT for personal non-professional activity.

AI Literacy requirement for providers and deployers

From 2 February 2025, providers and deployers of AI systems must take measures to ensure a sufficient level of AI literacy of their staff and others involved with their AI systems, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in (Article 4 read with Recital 20).

Stage Two: 12 month deadline

On 2 August 2025, 12 months after the Act comes into force, various sections will apply:

Chapter III Section 4 (Articles 28 to 39) requiring Member States to establish notifying authorities and procedures for conformity assessment bodies.
Chapter V Sections 1 to 4 (Articles 51 to 56) regulating General-Purpose AI Models, including classification, obligations, and codes of practice (which must be published by the AI Office by 2 May 2025).
Chapter VII Section 1 to 2 (Articles 64 to 70) deals with governance at an EU level and national level and includes the establishment of the AI Office, European AI Board, Advisory Forum, and a Scientific Panel of Experts.
Only Article 78 from Chapter IX dealing with confidentiality obligations for the EU Commission, market surveillance authorities and notified bodies and any other person involved in the application of the Act.
Chapter XII (Articles 99-100, excluding 101) dealing with the penalties (Article 99) and administrative fines (Article 100) for non-compliance with the Act, but excluding fines for general-purpose AI models (Article 101).

The focus of the 12 month deadline is mostly for the providers of general-purpose AI models, and the establishment of various EU authorities.

Stage Three: 24 month deadline

On 2 August 2026, 24 months after the Act comes into force, the remaining obligations apply, except Article 6(1).

Chapter III Section 1, 2, 3 and 5 (except Art6(1)) dealing with classifications, obligations and standards for high-risk systems.
Chapter IV (Article 50) setting out transparency obligations for providers and deployers of certain AI systems.
Chapter VI (Articles 57 to 63) deals with measures in support of innovation, including the establishment of AI regulatory sandboxes.
Chapter VIII (Article 71) requires creation of a database for high-risk AI systems.
Chapter IX Section 1 to 5 (Articles 72 to 77, and 79 to 94) deals with post-market monitoring, information sharing and market surveillance.
Chapter X (Articles 95 to 96) requirements for codes of conduct and guidelines.
Chapter XI (Articles 97 to 98) sets out delegation of power conferred on the EU Commission and establishment of a Committee to assist the Commission.
Article 101 dealing with the fines for providers of general-purpose AI models.

According to Article 111(2), operators of high-risk AI systems that have been placed on the market or put into service before 2 August 2026 only need to comply with the Act if those systems are subject to significant changes in their designs post-2 August 2026. This exclusion does not apply to prohibited practices set out in Article 5.

Stage Four: 36 month deadline

On 2 August 2027, 36 months after the Act comes into force, the final Article applies:

Article 6(1) deals with the classification of high-risk AI systems used as a safety component of a product.

In addition, according to Article 111(3), providers of general-purpose AI models that were placed on the market before 2 August 2025 must only comply with the Act by 2 August 2027.

Stage Five: 2030 deadline

According to Article 111,

Providers and deployers of high-risk AI systems intended to be used by public authorities must take steps to comply with the requirements of the Act by 2 August 2030.
obligations for large-scale AI systems placed on the market or put into service before 2 August 2027 in terms of existing EU law, must comply with the Act by 31 December 2030.

What's next?

Get to grips with the EU AI Act to understand what it deals with, whether it applies to you and what timelines are relevant to your compliance. Feel free to reach out to book an in-house training session for your team or join the waitlist for our upcoming EU AI Act Lab by emailing [email protected].

This is the first part in our series of blogs on the EU AI Act. Stay tuned!

Join the next cohort of #GenAI Legal Accelerator.