Navigating the EU AI Act: Your Essential Guide to New AI Regulations in the Union

In response, the European Union has adopted Regulation (EU) 2024/1689, commonly known as the Artificial Intelligence Act (AI Act). This landmark legislation aims to create a uniform legal framework for the development, placing on the market, putting into service, and use of AI systems within the Union. Its core purpose is to foster human-centric and trustworthy AI, ensuring a high level of protection for health, safety, fundamental rights, democracy, the rule of law, and environmental protection, while simultaneously supporting innovation.

For businesses and individuals operating or deploying AI in the EU, understanding the nuances of this regulation is paramount. It prevents the fragmentation of the internal market due to diverging national rules and guarantees the free movement of AI-based goods and services, unless explicitly restricted by the Regulation.

What is the EU AI Act?

The AI Act establishes a comprehensive legal framework for AI systems in the EU. Its primary goal is to improve the functioning of the internal market by laying down harmonised rules for AI, promoting the uptake of trustworthy AI, protecting against harmful effects, and supporting innovation. The Regulation applies to providers placing AI systems or general-purpose AI models on the Union market, deployers of AI systems located in the Union, and even providers and deployers located in third countries if their AI system’s output is used in the Union. Certain areas, such as those related to military, defence, or national security purposes, are excluded from its scope.

Ar isk-Based Approach to AI Regulation

Central to the AI Act is its risk-based approach, which tailors regulatory requirements to the potential harm an AI system can generate. The Regulation categorises AI practices into three main tiers: prohibited AI practices, high-risk AI systems, and AI systems subject to transparency obligations.

Prohibited AI Practices: Safeguarding Fundamental Rights

The AI Act explicitly prohibits certain AI practices that are deemed to contradict Union values and fundamental rights. These include:

• Manipulative or Deceptive AI Systems: Those deploying subliminal techniques beyond conscious perception or purposefully manipulative/deceptive techniques that materially distort a person’s behaviour, causing significant harm.

• Exploitation of Vulnerabilities: AI systems that exploit vulnerabilities of specific groups (e.g., due to age, disability, socio-economic situation) to materially distort their behaviour and cause significant harm.

• Social Scoring: AI systems used by public or private actors for evaluating or classifying natural persons based on their social behaviour or predicted personal characteristics, leading to detrimental or unfavourable treatment in unrelated contexts or disproportionate treatment.

• Predictive Policing based on Profiling: AI systems making risk assessments to predict criminal offences based solely on profiling or assessing personality traits. However, this does not apply to systems supporting human assessment based on objective and verifiable facts.

• Untargeted Facial Recognition Databases: Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.

• Emotion Recognition in Sensitive Contexts: AI systems inferring emotions in the workplace and education institutions, except for medical or safety reasons.

• Biometric Categorisation of Sensitive Data: Biometric categorisation systems inferring sensitive attributes like race, political opinions, religious beliefs, or sexual orientation from biometric data. Lawful labelling of lawfully acquired biometric datasets for law enforcement is exempted.

• Real-Time Remote Biometric Identification in Public Spaces: Generally prohibited for law enforcement, with very narrow exceptions for specific objectives such as targeted searches for victims, preventing imminent threats (e.g., terrorist attacks), or identifying suspects of serious criminal offences carrying a maximum custodial sentence of at least four years. Such use requires prior, specific authorisation from a judicial or independent administrative authority and must be strictly necessary and proportionate.

High-Risk AI Systems: Stringent Requirements

High-risk AI systems are subject to stringent mandatory requirements before they can be placed on the EU market or put into service. These systems are categorised as high-risk if they are:

• Safety Components of Products: AI systems intended as safety components of products or which are themselves products covered by existing Union harmonisation legislation requiring third-party conformity assessment (e.g., medical devices, aviation, automotive, toys, lifts, pressure equipment).

• Standalone Systems in Critical Areas: AI systems used in specific predefined sectors that pose a significant risk of harm to health, safety, or fundamental rights. These areas include:

    ◦ Biometrics: Remote biometric identification systems (excluding verification), biometric categorisation based on sensitive attributes, and emotion recognition systems.

    ◦ Critical Infrastructure: AI systems used as safety components in managing critical digital infrastructure, road traffic, and the supply of water, gas, heating, or electricity.

    ◦ Education and Vocational Training: Systems determining access, evaluating learning outcomes, assessing educational levels, or monitoring student behaviour during tests.

    ◦ Employment, Workers’ Management, and Access to Self-Employment: Systems used for recruitment, selection, decisions affecting work relationships, task allocation based on individual traits, or monitoring/evaluation of workers.

    ◦ Access to Essential Private and Public Services and Benefits: Systems used by public authorities to evaluate eligibility for essential public assistance, assess creditworthiness, conduct risk assessment/pricing for health/life insurance, or manage emergency services dispatch/triage.

    ◦ Law Enforcement: Systems assessing victim risk, polygraphs, evaluating evidence reliability, assessing re-offending risk (not solely based on profiling), and profiling in criminal investigations.

    ◦ Migration, Asylum, and Border Control Management: Polygraphs, risk assessment for entry/migration, assisting in asylum/visa applications, and detecting/identifying persons (excluding travel document verification).

    ◦ Administration of Justice and Democratic Processes: Systems assisting judicial authorities in interpreting facts/law, or influencing election/referendum outcomes (excluding administrative/logistical campaign tools).

Requirements for High-Risk AI Systems include:

• Risk Management System: A continuous, iterative process to identify, estimate, evaluate, and mitigate risks throughout the AI system’s lifecycle.

• Data and Data Governance: High-quality training, validation, and testing data sets that are relevant, representative, free of errors, and complete, with practices to detect and mitigate biases.

• Technical Documentation and Record-Keeping: Detailed documentation demonstrating compliance and automatic logging of events for traceability and monitoring.

• Transparency and Information to Deployers: Clear and comprehensive instructions for use, including the system’s capabilities, limitations, and foreseeable risks.

• Human Oversight: Design and development that allows natural persons to effectively oversee functioning, detect anomalies, interpret outputs, and intervene or stop the system. For certain biometric identification systems, this requires separate verification by at least two natural persons.

• Accuracy, Robustness, and Cybersecurity: Systems must achieve appropriate levels of accuracy, robustness against errors, and resilience against cyberattacks and vulnerabilities.

• Conformity Assessment: High-risk AI systems must undergo a conformity assessment procedure (either internal control or involving a notified body) before market placement.

• CE Marking and Registration: High-risk AI systems must bear the CE marking and be registered in an EU database (with a secure, non-public section for law enforcement, migration, and justice systems).

• Fundamental Rights Impact Assessment: Deployers who are public authorities or private entities providing public services must perform an assessment of the impact on fundamental rights before deployment.

General-Purpose AI Models (GPAI): New Obligations

The AI Act introduces specific rules for general-purpose AI models, including large generative AI models. These models, defined by their generality and capability to perform a wide range of distinct tasks, require additional scrutiny.

Providers of GPAI models must:

• Draw up and maintain technical documentation covering training, testing, and evaluation.

• Provide information and documentation to downstream providers to help them understand capabilities and limitations and comply with the Regulation.

• Implement a policy to comply with Union copyright law, specifically identifying and adhering to reservations of rights for text and data mining.

• Publish a sufficiently detailed summary of the content used for training the model.

Exceptions apply to GPAI models released under free and open-source licences if their parameters, architecture, and usage information are publicly available, unless they pose a systemic risk.

General-purpose AI models with systemic risk (e.g., those with high-impact capabilities or significant market reach, such as models trained with a cumulative amount of computation greater than 10^25 floating point operations) face further obligations, including:

• Performing model evaluations and adversarial testing to identify and mitigate systemic risks.

• Continuously assessing and mitigating systemic risks.

• Reporting serious incidents to the AI Office and national competent authorities.

• Ensuring an adequate level of cybersecurity protection for the model and its physical infrastructure.

Transparency Obligations for Other AI Systems

Beyond high-risk systems, the AI Act imposes transparency obligations on certain other AI systems, irrespective of their risk classification:

• AI Systems Interacting with Humans: Users must be informed when interacting with an AI system, unless it’s obvious.

• Generative AI Systems: Outputs generating synthetic audio, image, video, or text content must be marked in a machine-readable format as artificially generated or manipulated. For “deep fakes” that resemble existing persons, objects, or events, deployers must clearly disclose their artificial origin. AI-generated text published for public interest must also be disclosed, unless human-reviewed.

• Emotion Recognition and Biometric Categorisation Systems: Deployers must inform individuals about the system’s operation.

Governance, Enforcement, and Innovation

The AI Act establishes a robust governance framework, including the AI Office (a Commission function for expertise and implementation), the European Artificial Intelligence Board (comprising Member State representatives to ensure consistent application), and an Advisory Forum (for stakeholder input).

National competent authorities, including market surveillance authorities, are designated to oversee the application and enforcement of the Regulation. The AI Office also has exclusive powers to supervise and enforce obligations for providers of general-purpose AI models.

To foster innovation, Member States are required to establish AI regulatory sandboxes—controlled environments for developing, training, testing, and validating innovative AI systems under strict regulatory oversight. The Regulation also allows for testing of high-risk AI systems in real-world conditions outside sandboxes, subject to specific safeguards and informed consent (with exceptions for law enforcement).

Key Application Dates

The AI Act entered into force on 12 July 2024. However, different provisions apply at different times:

• Prohibitions (Chapters I and II): Apply from 2 February 2025.

• GPAI Models, Governance, and Penalties (Chapter III Section 4, Chapter V, Chapter VII and Chapter XII, and Article 78): Apply from 2 August 2025.

• High-Risk AI Systems (Article 6(1) and corresponding obligations): Apply from 2 August 2027.

• General Application: The entire Regulation will apply from 2 August 2026.

——————————————————————————–

Oversight and Sanctions: What You Need to Know

To ensure compliance with the regulation, a comprehensive governance framework has been established. It includes the European AI Office, the AI Board (composed of representatives from EU Member States), a stakeholder advisory forum, and an expert group. At the national level, Member States are required to designate national competent authorities, including notifying bodies and market surveillance authorities.

Sanctions for non-compliance are substantial. Prohibited AI practices may result in administrative fines of up to EUR 35,000,000 or 7% of the company’s annual global turnover, whichever is higher. Failure to meet other obligations and requirements may lead to fines of up to EUR 15,000,000 or 3% of turnover. Providing incorrect or misleading information is also subject to penalties. SMEs and startups benefit from proportionally lower fines.

——————————————————————————–

Conclusion

The EU AI Act represents a significant step towards responsible and ethical AI development and deployment. Its comprehensive framework addresses the complex risks and opportunities presented by AI, ensuring that technology serves humanity while upholding fundamental rights and Union values. Compliance with this intricate regulation is not just a legal obligation but a strategic imperative for any entity involved in AI within the EU. Understanding the classification of AI systems, the prohibited practices, and the extensive requirements for high-risk AI and general-purpose AI models is crucial for successful navigation of the new regulatory environment.

——————————————————————————–

(Please note that this blog post is informational and does not constitute legal advice. For specific cases, please consult a qualified legal professional.

About Slavchev & Vasilev Law Firm

Slavchev & Vasilev Law Firm are expert consultants in the AI Act and available to offer legal support to any individuals and companies operating in the field of AI, ensuring full compliance and strategic guidance in this evolving regulatory landscape.