The Current Status of the EU AI Act (or Making Sure Your Toaster Doesn’t Take Over the World)

Overview

On 21 May 2024, the Council of the European Union (the “EU”) formally adopted the Artificial Intelligence Act (the “AI Act”). The AI Act is the world’s first piece of comprehensive legislation on artificial intelligence (“AI”) in the world and was officially published in the Official Journal of the EU on 12 July 2024. The AI Act will enter into force on 01 August 2024 and from then, the provisions of the AI Act will be phased-in over a 36-month period as follows:

• 6 months after entry into force: the ban on prohibited AI systems will become binding on both providers and deployers of AI.
• 9 months after entry into force: codes of practice covering compliance obligations for Member States must be ready for publication by the AI Office.
• 12 months after entry into force:
  • Member States must have their governance structure in place;
  • all national competent authorities (namely, at least one notifying authority, at least one market surveillance authority and a single point of contact) must be fully operational within 24 months of entry into force;
  • obligations for providers of general-purpose AI models kick in;
  • provisions on confidentiality will apply; and
  • enforcement measures and penalties for breach of these provisions must be in place.
• 24 months after entry into force: the remaining provisions will apply (with the notable exception of Article 6(1), which deals with AI systems that are ‘high-risk’ because they are subject to specified EU product safety legislation (such as regulations governing vehicles, machinery and toys).
• 36 months after entry into force: Article 6(1) and the corresponding obligations on those specific ‘high-risk AI systems’ will apply.

It is worth noting, however, that some of the above-mentioned obligations will not apply to certain AI systems in existence prior to the date of the AI Act until later than the timelines provide for. This applies specifically to AI systems already on the market i.e., in use prior to the date of the Act. This is detailed in Article 111 of the Act, which outlines three ‘grandfathering rules’ for AI systems and general-purpose AI models already on the market or in service. These include:

(i) high-risk AI systems that are components of large-scale IT systems;
(ii) operators of other high-risk AI systems; or
(iii) general purpose AI models.

There is up to a 36-month compliance grace period depending on design or usage changes, while certain components must comply by the end of 2030.

From its inception, the AI Act has received mixed reactions across government agencies and “big tech” companies. Whilst Dara Calleary, Minister of State for Trade Promotion, Digital and Company Regulation, has welcomed the regulation as a way to “ensure ethical AI development and prevent potential misuse”, some industry experts have raised concerns about the potential impact of the provisions on smaller startups and on the overall competitiveness of the EU in the global AI market. Earlier this year, Meta expressed concerns about the EU falling behind in AI innovation and advocated for less stringent regulations to enhance development. Despite this, the French start-up Mistral AI recently received financial support from investors, raising €600 million in funding. Meta’s and Minister Calleary’s contrasting statements both underscore the ongoing debate around AI regulation i.e., how best to harness the potential of new technologies while safeguarding against potential risks.

Whilst the debate will continue, the AI continues its march towards application. Following the adoption of the text, the Department of Enterprise, Trade and Employment in Ireland (“DETE”) launched a public consultation on 21 May 2024 on the national implementation of the AI Act. The consultation is intended to guide DETE in the future implementation of the AI Act and Ireland’s overall compliance obligations. Participants’ submissions are guided by four questions:

1. What considerations should the Department have regard to when devising the configuration of national competent authorities for implementation?
   DETE is considering different approaches for national implementation (ranging from a centralised model to a more distributed, sector-based approach) to determine the optimal national enforcement of the AI Act.
2. Are there potential synergies between the implementation of the act and the implementation of other EU regulations applying to digital markets, services, and infrastructures?
   The AI Act forms part of a wider package of regulations aimed at protecting consumers, strengthening the internal market, and ensuring that the EU remains at the leading edge of innovation and advanced technologies. Hence, DETE seeks to gather views on how the Act might operate with those existing regulations and infrastructure.
3. How can Ireland’s implementation of the AI Act bolster Ireland’s position as a leading digital economy increasing investment and accelerating innovation in AI? What would excellence in AI regulation look like?
   The Digital Ireland Framework sets the goals for Ireland to be a digital leader globally and in Europe and to be a centre of regulatory excellence in Europe. The AI Act requires promoting innovation, having regard to SMEs that are providers or deployers of AI systems.
4. How can Ireland’s implementation of the AI Act drive support and accelerate progress from each of these perspectives while meeting our regulatory obligations?
   The implementation of the AI Act seeks to be in line with the National Artificial Intelligence Strategy for Ireland (“the Strategy”). The latter aims to position Ireland as a leader in using AI for economic and societal advancement. The Strategy emphasises a people-center, ethical approach to AI development and use. It considers AI from various perspectives: building public trust in AI, leveraging AI for economic and societal benefit and enablers for AI.

Deadline for submissions is 16 July 2024. Given Ireland’s growing standing as a centre of AI innovation and policy development in the EU (and further afield), the importance of the approach taken by the State to the application of the AI Act here should not be ignored; the myriad of interested parties, from all sides of the AI debate, should take their opportunity to contribute to public discussion and help shape our legislative approach.

However, if we can offer any broader takeaway from the this Insight at this point, it is this: whilst the application deadlines set out above might seem to be quite far in the distance, if you or your business are either already engaging with AI systems, or are evaluating how and where AI might be implemented in the short or medium term to add value to your service, operations or otherwise, now is the time to start preparing for the AI Act’s application by making it the cornerstone of your governance framework. We urge you to take steps now, which may include (amongst many others) reviewing existing policies and systems in light of the AI Act’s requirements, considering the obligations on you or your service providers/vendors, starting to provide for AI and compliance with the AI Act, where necessary, in your contractual relationships with all relevant service providers/vendors, and, if you are an AI system provider, developing a strategy for bringing your products and operations within the strictures of the AI Act as it applies to you. A failure to get your AI affairs in order, in a timely manner, will create business risks that can ill be afforded in these ‘interesting’ times. RDJ's AI team are here to assist where needed.