European Parliament approves AI Act

On March 13, the European Parliament passed a draft of the Artificial Intelligence Act, voting 523-46 in favor of passage, with 49 members abstaining. This vote follows a political agreement between the European Parliament, Commission and Council regarding the AI Act in December 2023 and a unanimous vote from European Union member states in February approving the AI Act.

The AI Act imposes obligations on U.S. businesses with respect to their activities in the EU or impacting EU subjects, and it may herald a wave of similar laws across numerous jurisdictions. As a result, the AI Act is likely to play a significant role in influencing U.S. businesses’ compliance posture with respect to AI systems. An overview of the Act’s structure, application, and key governance and enforcement provisions is below.

Structure and application

The AI Act is both broad in scope and extraterritorial. The Act defines an AI system as any “machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”[1] The AI Act applies to:

1. “providers” to the EU of AI systems or general-purpose AI models;
2. “deployers” of AI systems established or located in the EU;
3. providers and deployers of AI systems where the output of the applicable AI system is used in the EU; and
4. importers and distributors of AI systems, amongst others.[2]

The AI Act prohibits AI systems that present an unacceptable degree of risk [3] and sets forth specific and strict requirements for high-risk AI systems,[4] lesser transparency obligations for low-risk AI systems,[5] and certain obligations for providers of general-purpose AI models that present systemic risks.[6]

Governance

The AI Act establishes both an EU Artificial Intelligence Office to oversee general-purpose AI models and enforce the AI Act across member states,[7] as well as an EU Artificial Intelligence Board to facilitate cooperation and the sharing of best practices among the European Commission and member states.[8]

The AI Act also directs the member states to establish “regulatory sandboxes” designed to encourage innovation by facilitating development and testing of AI systems under the supervision and guidance of member state authorities, with priority access being given to small-scale AI system providers and startups.[9]

Enforcement

The AI Act sets forth certain penalties to be administered by member states, including three tiers of fines of up to the greater of:

1. €35 million or 7% of worldwide annual turnover for the prior year for violations related to offering prohibited AI systems;
2. €15 million or 3% of worldwide annual turnover for the prior year for most other violations under the Act including those related to the requirements for high-risk AI systems; and
3. €7.5 million or 1.5% of worldwide annual turnover for the prior year for violations related to supplying incorrect, incomplete, or misleading information to the EU and member state authorities.[10]

Coming next

The Act will now be subject to final linguistic checks and formal endorsement by the European Council, and will enter into force 20 days after its publication in the Official Journal of the EU.[11] The first provisions of the Act that will become effective are its prohibitions regarding AI systems that present unacceptable risks, which will take effect six months after the Act’s entry into force.[12] The AI Act will be fully applicable 24 months after its entry into force, with codes of practice becoming effective nine months after entry into force, requirements for general-purpose AI systems becoming effective 12 months after entry into force, and obligations for high-risk AI systems becoming effective 36 months after entry into force.[13]