EU Formally Adopts World’s First AI Law

On March 13, 2024, the European Parliament formally adopted the EU Artificial Intelligence Act (“AI Act”) with a large majority of 523-46 votes in favor of the legislation. The AI Act is the world’s first horizontal and standalone law governing AI, and a landmark piece of legislation for the EU.

Brief Recap of the AI Act

On April 21, 2021, the European Commission had first proposed the EU AI Act. Throughout the legislative process, the AI Act has undergone significant amendments – in particular to address the risks presented by foundation, generative and general-purpose AI (which was not a technology considered at the time of the Commission’s drafting of the proposal). Key principles, along with the AI Act’s risk-based approach, were however maintained. Fast-forward to December 8, 2023 – following three days of intensive negotiations – the EU legislators reached historical agreement on the AI Act followed by technical discussions to finalize the text (see our blog post here which also sets out the key requirements imposed on AI providers, product manufacturers, deployers and other relevant actors). On January 26, 2024, the final compromise text of the AI Act was published (see our blog post here) and has now been adopted by the European Parliament. The adopted AI Act can be reviewed here.

Landmark Law

The EU considers the AI Act as one of its key pieces of legislation and fundamental to the EU. More specifically, the EU is aiming for the AI Act to have the same ‘Brussels effect’ as the GDPR — in other words, to have a significant impact on global markets and practices and to serve as a potential blueprint for other jurisdictions looking to implement AI legislation.

However, the story does not end here. Over the next few months and years, the AI Act will be specified and supplemented further by secondary EU legislation – implementing and delegated acts to be adopted by the EU Commission. The EU is also finalizing amendments to the EU Product Liability Directive to bring it in line with the EU AI Act and has proposed a new EU AI Liability Directive which will facilitate redress claims by consumers for harm caused by AI.

In addition, EU officials have already commented that the EU would be looking to develop additional, more targeted AI laws following the EU elections in June 2024, for example, to regulate the use of AI in employment. Although the AI Act already partially addresses the use of AI in the context of employment, EU officials have indicated that this could be “further enhanced” by introducing specific legislation on this topic. Furthermore, due to the highly debated issues and concerns related to copyright and AI, it is expected that the EU will issue legislation to address copyright concerns in AI.

In summary, organizations inside and outside the EU – in particular those that are implicated by the “unacceptable” and/or “high-risk” use cases and industries – should get used to navigating a highly complex regulatory landscape, with the EU AI Act at the center.

AI Liability

In addition, just one day before adopting the AI Act, the European Parliament also formally adopted on March 12, 2024 the revamped Product Liability Directive, which makes targeted changes to the EU rules and procedure for consumers to obtain compensation for damage caused by defective products, including in order to ensure the Directive operates effectively to regulate new technologies such as AI. The EU Product Liability Directive provides that manufacturers of defective products are the first point of redress for consumers. The revisions to this EU Directive clarify that a “provider” of an AI system as defined in the AI Act is considered a “manufacturer” under the Directive, meaning that an AI system provider within the meaning of the AI Act will be primarily liable for harm caused by AI systems. Perhaps most significantly, the EU Directive also simplifies the burden of proof on consumers in relation to (complex or ‘blackbox’) AI, i.e. where the consumer has difficulties proving the product is defective because of the “technical or scientific complexity” of the product. The Directive will now be formally adopted by the Council and will then be published in the EU Official Journal. The new rules will apply to products placed on the market 24 months after entry into force of the Directive (by virtue of EU Member State national implementing law).

Enforcement

Non-compliance with the EU AI Act can result in regulatory fines of up to 7% of global worldwide turnover, as well as civil redress claims and reputational damage.

The AI Act is mainly enforced at an EU Member State national level, with the exception of general-purpose AI models, which are enforced by the European AI Office. The European AI Office has recently been formally established by a Commission decision of January 24, 2024 (interestingly, it has been established even prior to the formal adoption of the AI Act).

In addition, the EU AI Act establishes an AI Board which is competent to ensure the consistent application of the EU AI Act throughout the EU and is responsible, for instance, for issuing recommendations and opinions, developing codes of conduct/codes of practice, and technical standards.

Next steps

Following this official adoption, the AI Act will be subject to the Council’s formal endorsement before becoming law. The AI Act is likely to enter into force at the end of April or early May of this year. Following entry into force, the AI Act will not be immediately enforceable but will be subject to a gradual and phased transition and implementation period whereby it will become fully applicable 24 months after entry into force, except for: bans on prohibited practices (6 months after the entry into force), codes of practice (9 months after entry into force), general-purpose AI rules (12 months after entry into force), and obligations for high-risk systems (36 months after entry into force).

For more practical information on how to prepare for the AI Act, please see our webinars and blog posts here and here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.