12 July 2024 marks an important step forward in the regulation of Artificial Intelligence with the publication in the European Official Journal (OJEU) of Regulation no. 1689 of 13 June 2024. This important moment puts Europe at the forefront of the challenge posed by AI and provides an opportunity to review the steps that will follow the entry into force and the timeframes for the adaptation of the addressees of the new AI obligations.
The aims and key principles of the AI Act
By promoting the use of safe, reliable and responsible systems, and by protecting and upholding the fundamental rights of individuals, the AI Act finally provides a regulatory framework in response to the disruptive phenomenon of artificial intelligence in our lives.
As is now well known, the AI Act adopts a risk-based approach, distinguishing between high-risk and unacceptable systems, and establishing criteria for the systemic risk compliance of general-purpose AI models. In this sense, for each category there are different requirements and obligations that suppliers and users of AI systems must now comply with in order not to be in breach of European law.
To strengthen the EU's leadership in the field of safe and reliable AI, the Office for AI has been established within the EU Commission to ensure consistent implementation of the new legislation in Member States and to assist the Commission in the correct application of the AI law.
The version of the AI Act published in the Official Journal of the European Union contains innovations, not at the level of definitions, but in the clarity of certain articles, such as Article 111, entitled "Artificial Intelligence Systems already placed on the market or put into service and Artificial Intelligence Models for general use already placed on the market". Of relevance within this provision is the introduction of defined expiry dates for high-risk AI systems already in use.
What is the timeframe for compliance by the recipients of the AI Act?
Following its publication in the Official Journal of the EU, the AI Act will definitively enter into force on 2 August 2024.
As a general rule, the regulations will only be applicable from 2 August 2026, i.e. twenty-four months after their entry into force. However, the AI Act provides, quite exceptionally, for a progressive timetable for the entry into force of certain specific chapters and provisions under Art. 113; and indeed:
- Chapters I and II (definitions and prohibited practices) will apply from 2 February 2025 (the anticipation of the entry into force of these provisions is justified in the light of Recital 179 "given the unacceptable risk associated with the use of AI in certain ways").
- Chapter III, Section 4 (notifying authorities designated by Member States), Chapter V (AI templates for general purposes), Chapter VII (EU database for high-risk systems), Chapter XII (sanctions) and Article 78 (confidentiality of data processed under the Regulation) shall apply from 2 August 2025, with the exception of Article 101 (financial penalties for providers of AI templates for general purposes).
- Article 6 paragraph 1 (classification of high-risk systems), and the corresponding obligations under the Regulation, apply as from 2 August 2027.
Review and update of the Regulation
Precise timeframes have also been set for the steps following the publication of the AI Act in the Official Journal: Recital 174 states that "in view of the rapid technological developments and the technical expertise required for the effective application of this Regulation, the Commission should evaluate and review this Regulation by 2 August 2029 and every four years thereafter and report to the European Parliament and the Council".
Another milestone is 2 August 2028, the date by which and after which the Commission "should" assess and report to the European Parliament and the Council every four years on the need to amend the list of high-risk items (Annex III), the IA systems for transparency obligations, the effectiveness of the monitoring and governance system and the progress in developing standardisation outcomes for energy efficient development.
In addition, over a three-year period, the Commission "should" also assess the impact and effectiveness of voluntary codes of conduct in promoting the implementation of requirements for high-risk systems. These timeframes thus reflect the Commission's focus on monitoring developments in this area.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.