The EU AI Act: a roadmap for a responsible AI future in Europe
In a world where artificial intelligence (AI) increasingly permeates our daily lives, questions of ethics, transparency and accountability in developing and using AI technologies are crucial. The European Union has taken a pioneering step to address these questions and shape the future of artificial intelligence in Europe. The "EU AI Act" is an ambitious legislative package with the potential to fundamentally change the AI landscape in Europe.
In this blog article, we dive deep into the EU AI Act to understand what it means, how it affects companies and how it sets the course for ethical AI in the EU. From strict regulation to visionary goals, we'll shed light on the key aspects of this law and analyze how it will influence the way AI technologies are developed and used in Europe.
Join us on this journey into the world of the EU AI Act to learn how the EU is setting the course for a responsible and ethical AI future in Europe.
What is the EU AI Act?
The European Union (EU) recently proposed the EU AI Act (also known as the AI Regulation), which is meant to govern the development and use of artificial intelligence (AI) systems across the EU. The EU has been working on this legislative project, the Artificial Intelligence Act (AIA), for some time. But technological developments are rapid and sometimes simply overtake the discussion process, which has made finalizing the AIA difficult.
The AI law has now been passed by the European Parliament and still has to be agreed with the EU Commission and the member states in the so-called trilogue before it officially enters into force. An agreement is expected by the end of the year. After that, companies will have two years to adapt to the changed framework.
The goal of the EU AI Act is to create a trustworthy framework in which companies can benefit from developing AI systems while protecting people's rights and safety.
You can find the draft law and its annexes here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52021PC0206
AI regulation in Germany
No German law on AI is currently planned (see also: https://www.bundestag.de/resource/blob/ 940164/51d5380e12b3e121af9937bc 69afb6a7/WD-5-001-23-pdf-data.pdf).
AI regulation is currently being discussed intensively at government level – it was reportedly also a topic on the sidelines of a meeting between Olaf Scholz and Emmanuel Macron in early October 2023.
The risk classes of the EU AI Act
The AI law takes a risk-based approach to classify AI by its field and scope of application and regulate it accordingly. However, the rules aren't final yet, so the list below is for guidance only.
.jpg)
1 Unacceptable risk
Areas where AI is perceived as a threat to people are to be classified as unacceptable risk. The use of AI is prohibited here.
These include areas such as:
- cognitive behavioral manipulation and control: when AI encourages dangerous behavior
- social scoring: when AI ranks people by their behavior, social status and personal characteristics
- real-time remote biometric identification: e.g. facial recognition
2 High-risk AI systems
Two areas need to be distinguished here:
a) Use in devices covered by European product safety laws: toys, aviation, vehicles, medical devices and elevators.
b) AI systems in other specific areas:
- biometric identification and categorization of natural persons;
- management and operation of critical infrastructure;
- education and vocational training;
- employment, worker management and access to self-employment;
- access to and enjoyment of essential private and public services and benefits;
- law enforcement;
- migration, asylum and border control management;
- assistance in the interpretation and application of the law.
The scope of b) may be extended further – the use of AI on social media and in shaping public opinion, for example, has been discussed.
The use of AI in this context must be monitored continuously and its risk assessed by the responsible party to avoid negative consequences for people.
3 Limited-risk AI
This primarily covers generative AI – AI models that can generate content.
Additional transparency requirements apply to these:
- labeling content as AI-generated
- designing the AI so that it can't generate illegal content
- publishing summaries of copyrighted data used for training
4 Minimal-risk AI
Minimal-risk AI (i.e. all areas of application not covered by 1–3) is subject only to minimal transparency requirements.
As the table shows, the regulatory system clearly focuses on high-risk AI systems, which is why this risk level is subject to most of the EU AI Act's requirements.
It's also striking that AI systems whose risk is assessed as minimal generally have free access to the European market. In other words, minimal-risk AI systems aren't subject to any additional obligations beyond existing legislation.
The aim of the negotiations within the EU is to reach an agreement with the member states by the end of the year.
How does the EU AI Act affect melibo?
In our view, melibo's core business (chatbots) falls only under categories 3 and 4. If melibo is used on social media or in other special areas of application, additional requirements could arise, but these aren't yet sufficiently clear.
Given the relevance of this topic, our CEO and founder, Felix Stelzer, wanted to take a stand and share his assessment with us:
.jpg)
Coverage by data protection laws
Because of its wide range of applications, AI is covered and partly regulated by other German legislation.
All data protection requirements arise from the GDPR and the German Federal Data Protection Act (BDSG). AI is therefore subject to the general rules on processing personal data just like any other processing.
Some rules also specifically address "automated decision-making". For example, under Art. 22 GDPR, a data subject has the right to have an AI decision reviewed by a human if the decision has significant consequences for them.
The German Data Protection Conference (DSK) has set out further data protection requirements in a position paper. It's available at https://www.lda.brandenburg.de/sixcms/media.php/9/Positionspapier_TO-Massnahmen_KI-Systeme.pdf and deals in particular with the technical and organizational measures (TOMs) required for operating AI.
Further decisions and positions from supervisory authorities on this topic can be expected in the near future.
Decisions by authorities
The Italian supervisory authority banned the use of ChatGPT, the best-known AI tool, in Italy and ordered it to be blocked.
A number of reasons were given for the decision, e.g. the lack of a legal basis for data processing, a lack of transparency toward users about data processing and the export of personal data to the US.
However, OpenAI had clearly made no effort to design its data processing in line with applicable data protection laws.
So neither can the Italian authority's decision be applied to Germany, nor can the ChatGPT example be used to conclude that applicable data protection law and AI are incompatible.
An outlook: what can we expect from the EU AI Act?
Regulating AI is a suitable tool for ensuring the security, robustness, data protection, compliance and ethics of AI systems. All these measures help increase trust in and acceptance of AI systems. However, regulating AI is a complex task that requires a balanced consideration of technological development, social impact and legal aspects.
The European Union is taking significant steps to be the first in the world to set rules for companies that use artificial intelligence (AI). It hopes to set global standards and even overtake the US.
Given how fast AI technologies are developing, the EU AI Act could become the basis for how we work with AI systems in the future. Clear boundaries could also reduce the uncertainty many people feel about AI.
However, the EU faces the challenge of keeping pace with rapid advances in AI and drafting the AI law so that it's universally applicable and can work in the long term.
The AI Regulation probably won't be adopted until mid-2025, and it will then likely only take effect in 2026 or 2027.
.avif)
.avif)
