EU finalises landmark law to regulate 'high-risk' AI systems

Brussels: EU ministers on Tuesday have unanimously given their final approval to the Artificial Intelligence Act, a major new law regulating the use of transformative technology in "high-risk" situations, such as law enforcement and employment.

The European Union hopes that laying down strict AI rules relatively early in the technology's development will address the dangers in time and help shape the international agenda for regulating AI.

Systems intended for use in "high-risk" situations, listed in the law's annexes, will have to meet various standards spanning transparency, accuracy, cybersecurity and quality of training data, among other things. Some uses, such as Chinese-style social credit scoring, will be banned outright.

High-risk systems will have to obtain certification from approved bodies before they can be put on the EU market. A new "AI Office" will oversee enforcement at the EU level.

There are also more basic rules for "general purpose" systems that may be used in various situations - some high-risk, others not. For example, providers of such systems will have to keep certain technical documents for audit.

However, providers of especially powerful general-purpose AI systems will have to notify the European Commission if the system possesses certain technical capabilities.

Unless the provider can prove that their system poses no serious risk, the commission could designate it as a "general-purpose AI model with systemic risk," after which stricter risk-mitigation rules would apply.

Meanwhile, AI-generated content such as images, sound or text would have to be marked to protect against misleading deepfakes.

The European Commission proposed the first draft of the AI Act in April 2021, having published a "white paper" outlining its plan for a risk-based approach in February 2020.

The European Parliament pushed for much stricter rules - such as a blanket ban on police use of real-time facial recognition in live CCTV feeds.

However, EU member states were reluctant to impose too many restrictions on law enforcement and border security and feared too much red tape would harm economic competitiveness.

Negotiators for the parliament and the member state finally reached a compromise in December after several rounds of gruelling late-night talks.

The final law does impose a general ban on real-time facial recognition in CCTV, however, there are exceptions for law enforcement uses, such as finding missing persons or victims of kidnapping, preventing human trafficking, or finding suspects in serious criminal cases.

Now that the law has been finalised by unanimous vote among ministers, it must be signed by the presidents of the EU legislature and then published in the EU's statute book.

It then technically becomes law 20 days later, but most of its provisions won't take effect until two years after that.