On December 9, 2023, the European Union (EU) reached a provisional agreement on the EU Artificial Intelligence Act (AI Act), a groundbreaking regulation that aims to shape the future of AI regulation. The AI Act, set to apply two years after it enters into force, seeks to ensure the safety of AI systems in the EU and uphold fundamental rights and values.
In a bid to promote safe and trustworthy AI development, the AI Act introduces a risk-based approach to regulation, with stricter rules for higher-risk AI systems. The EU aspires to be a global leader in AI regulation, comparable to the impact of the General Data Protection Regulation (GDPR) on global data protection and privacy laws.
Canadian organizations, both developers and users of AI tools, are advised to familiarize themselves with the AI Act and monitor its implementation. This recommendation aligns with the developments surrounding Canada’s proposed Artificial Intelligence and Data Act (AIDA).
While Canada has already released a Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, further advancements are underway. The Office of the Privacy Commissioner of Canada (OPC) has issued a joint statement with other provincial privacy commissioners emphasizing the responsible use of generative AI.
Defining AI systems is crucial in determining the scope of the AI Act. The EU has based its final definition on the latest version from the Organisation for Economic Co-operation and Development (OECD), showcasing the EU’s commitment to aligning with global standards. Conversely, Canada’s AIDA proposes a different definition, as noted by François-Philippe Champagne, the Minister of Innovation, Science and Industry of Canada.
The AI Act’s scope is limited to areas within EU law, with no impact on EU Member States’ competencies in national security. Moreover, the AI Act does not apply to systems used solely for military or defense purposes, or those dedicated to research, innovation, or personal/non-professional use.
To safeguard against potential risks, the Provisional Agreement categorizes AI systems based on their potential risk levels. AI systems with low risk will only require light transparency obligations, enabling users to make informed decisions regarding AI-generated content. However, high-risk AI systems will face stricter requirements and obligations to access the EU market. These requirements will be refined for technical feasibility and reduced burden, particularly for small and medium-sized enterprises (SMEs).
The agreement also identifies specific uses of AI that pose unacceptable risks, which will be banned within the EU. These practices include certain surveillance activities and social scoring.
Law enforcement requirements are also addressed in the agreement, recognizing their unique needs while ensuring respect for fundamental rights. High-risk AI tools may be allowed in urgent situations where law enforcement is involved, with strict conditions for real-time remote biometric identification in public spaces.
Additionally, the agreement introduces provisions for versatile general-purpose AI (GPAI) systems, allowing their integration into other high-risk systems. Transparency obligations are established for these systems, with a stricter regime for high-impact foundation models carrying significant systemic risk potential.
Establishing a new governance structure, the AI Act will create an AI Office within the Commission to oversee advanced AI models. This will be supported by a scientific panel and an AI Board comprising member state representatives. The AI Board will serve as an advisory body and coordinate the implementation of the regulation.
Non-compliance with the AI Act carries significant penalties, including fines based on a percentage of the company’s global annual turnover or a predetermined amount, whichever is higher. Proportional penalties will be applied for SMEs and startups. Complaints regarding non-compliance can be filed by individuals and legal entities, which will be handled by relevant authorities.
Transparency is a key aspect of the AI Act, with a requirement for a fundamental rights impact assessment prior to deploying high-risk AI systems. Increased transparency is also expected from public entities using high-risk AI systems, including informing individuals when they are subject to emotion recognition systems.
Furthermore, the Provisional Agreement has modified provisions to foster innovation and create a more innovation-friendly legal framework. This includes the establishment of AI regulatory sandboxes for real-world testing of AI systems under specific conditions and safeguards. Measures are outlined to support smaller companies, with specific derogations aiming to reduce administrative burdens.
As the EU secures a groundbreaking agreement with the AI Act, it is evident that the regulation aims to shape the future of AI regulation, prioritizing safety, trustworthiness, and adherence to fundamental rights and values. The EU’s aspirations to become a global leader in AI regulation are reminiscent of the impact the GDPR has had on global data protection and privacy laws. Canadian organizations should closely monitor the implementation of the AI Act and the developments surrounding Canada’s proposed AIDA to ensure compliance and stay informed of key regulatory changes in the AI landscape.
