Last week, the EU Parliament voted for the approval of the Law on Artificial Intelligence, which was first presented three years ago — in fact, the document has passed the last bureaucratic round and is now approaching official implementation.
The law will come into force sometime in May, and people living in the EU will see the first changes by the end of the year. A regulatory body is yet to be set up to monitor compliance with the rules, and companies will have three years to adapt. So what exactly will the new legislation change (and what will not)?
This refers to artificial intelligence that is classified as «high-risk systems» (i.e., those that pose a high risk to fundamental human rights, such as in the areas of healthcare, education, and police), as well as systems with «unacceptable risk» (e.g., artificial intelligence systems that use «subliminal, manipulative, or deceptive methods to distort behavior and prevent informed decision-making» or exploit vulnerable people).
The Artificial Intelligence Law also prohibits the use of real-time facial recognition software in public places, as well as the creation of facial recognition databases by scanning the Internet using Clearview AI technology.
At the same time, law enforcement agencies are still allowed to use confidential biometric data as well as facial recognition software in public places to combat serious crimes such as terrorism or kidnapping.
Tech companies will be required to label deepfakes and content created by artificial intelligence, as well as to notify people when they interact with a chatbot or other artificial intelligence system.
This requirement is aimed at combating disinformation, but current research still lags behind the legislation. For example, the proposed watermarks — this is still an experimental technology that can be easily faked.
However, there are several potentially effective ways — such as the C2PA specification based on cryptographic methods that will allow sites to identify images created by AI and mark them in one way or another.
The EU will establish a European Office for Artificial Intelligence, where citizens will be able to file complaints against artificial intelligence systems in case of harm and demand explanations from companies.
Companies that develop «generic AI models» such as language models will have to create and maintain technical documentation showing how they built the model, whether they comply with copyright law, and publish a summary of what training data was used for the model.
Companies with the most powerful AI models, such as GPT-4 and Gemini, will be subject to slightly more onerous requirements, such as assessing the models and its risks, ensuring cybersecurity, and reporting any incidents where the AI system has been compromised. Companies that fail to comply will face heavy fines or a complete ban in the EU.
Fines fluctuate up to €7.5 million or 1.5% of the company’s total global turnover (whichever is greater) for providing incorrect information to regulators; up to €15 million or 3% of global turnover for violating certain provisions of the law, such as transparency obligations; up to €35 million or 7% of turnover for deploying or developing prohibited AI tools.
Source: MIT Technology Review