EU AI Act: navigating the EU's new AI Regulation

The requirements of the EU AI Act vary depending on the classification of the AI system. A system can be a single-purpose AI (SPAI) or a general-purpose AI (GPAI). The requirements laid out in the AI Act can differ according to the role that one fulfils with regard to the AI system.

Single-Purpose AI (SPAI) Systems

• Unacceptable Risk AI Systems: These AI systems are prohibited entirely due to their potential to cause harm or violate fundamental values such as human dignity, freedom, equality, democracy, data privacy, and the rule of law.
• High-Risk AI Systems:
  • Providers: Implement a risk management system and ensure data governance, maintain quality management and technical documentation, ensure transparency, accuracy, and cybersecurity, provide information to deployers, implement human oversight and maintain automatically generated logs.
  • Deployers: Apply the provider's instructions and guarantee human oversight, validate input data and monitor AI system activity, report malfunctions, save logs if possible and conduct fundamental rights impact assessments where necessary.
  • Importers and Distributors: Verify AI system compliance with the EU AI Act, maintain conformity certifications for ten years, withdraw non-compliant AI systems, and cooperate with authorities.

General-Purpose AI (GPAI) Models

• General-Purpose AI Models: Maintain up-to-date technical documentation, protect intellectual property rights, ensure transparency about the model's limitations and capabilities, comply with EU copyright laws, and provide detailed summaries of training content.
• High-Impact General-Purpose AI Models: Comply with all general purpose requirements, conduct comprehensive model evaluations and adversarial testing, assess and mitigate systemic risks, ensure robust cybersecurity protection, report serious incidents to the EU Commission, and report on energy efficiency and consumption during training.

Overall, the EU AI Act aims to ensure that AI systems are developed and used responsibly, with requirements tailored to the potential risks and impacts of each category.

The EU AI Act represents an important step forward in the governance of artificial intelligence, offering organisations a clear framework for deploying AI systems responsibly. Organisations have the following responsibilities:

• Governance Frameworks: Implement robust governance structures that encompass risk management, data transparency, and human oversight.
• Risk Management: Conduct thorough assessments of AI risk classifications and maintain a comprehensive inventory of AI assets to identify and mitigate potential risks.
• System Accuracy and Cybersecurity: Ensure that AI systems are accurate and secure, implementing necessary cybersecurity measures to protect data and operations.
• Quality Management Systems: Maintain high standards through quality management systems that oversee the entire AI lifecycle.
• Impact Assessments: Conduct impact assessments to evaluate the effects of AI systems on fundamental rights, ensuring they align with ethical and legal standards.
• Role Definition: Clearly define the roles and responsibilities of each operator involved in the AI deployment process.
  

By adhering to these responsibilities, organisations can navigate the regulatory landscape with a robust governance framework and a proactive approach to risk management, ensuring that AI systems are deployed responsibly and ethically.

Enforcement will be a collective effort shared by the Member States and the European Commission, where the Commission gets the exclusive power to supervise and enforce rules for General Purpose AI Models. Non-compliance can lead to significant penalties and enforcement actions. The higher the risk, the higher the penalty. Furthermore, member states must consistently consider the interests of small and medium sized enterprises (SMEs) and start-ups. National authorities are mandated to assess the nature, gravity, and duration of each infringement, as well as whether the entity in question is a repeat offender, when determining the amount of each fine.
The AI Act’s penalty regime is structured on the
basis of the severity and nature of the violation, with the fines increasing
according to the risk category of the AI system.

Fines:

• Unacceptable Risk AI Systems: Fines up to 35 million EUR or 7% of the company's global annual turnover (GAT) for deploying prohibited AI systems.
• High-Risk AI Systems: Fines up to 15 million EUR or 3% of the GAT for infringements related to high-risk AI obligations.
• General-Purpose AI Systems: Fines up to 15 million EUR or 3% of the GAT for failing to meet transparency obligations.
  Misinformation/Supplying Incorrect Information: Fines up to 7.5 million EUR or 1% of the GAT for providing incorrect, incomplete, or misleading information.

Enforcement Actions:

• Investigation and Remediation: Authorities can investigate AI systems, halt their operations, and demand necessary changes. Non-compliant AI systems may be forcibly removed from the market.
• Complaints and Transparency: Individuals can lodge complaints about any aspect of the AI Act. Affected persons have the right to clear and meaningful explanations regarding the role of AI systems in decision-making processes.
• Collective Action and Whistleblower Protection: Collective action by groups representing affected persons is possible, and whistleb