Artificial Intelligence Act — Regulation (EU) 2024/1689

Overview

This Regulation establishes harmonised rules for the development, placing on the market, and use of artificial intelligence (AI) systems within the Union. It aims to promote the uptake of human-centric and trustworthy AI while ensuring a high level of protection for health, safety, and fundamental rights. (Art. 1)

This Regulation applies to providers placing AI systems or general-purpose AI models on the Union market, deployers of AI systems established in the Union, and providers/deployers outside the Union if the AI system's output is used within the EU. It does not apply to AI systems used exclusively for military, defence, or national security purposes, for the sole purpose of scientific research and development, or by natural persons in the course of a purely personal non-professional activity. (Art. 2)

Key points

• Certain AI practices are prohibited, including systems that use subliminal or manipulative techniques to distort behaviour causing significant harm, exploit vulnerabilities of specific groups, or are used for social scoring by public or private actors. (Art. 5)
• The use of 'real-time' remote biometric identification systems in publicly accessible spaces for law enforcement is prohibited, except in exhaustively listed and narrowly defined situations, such as searching for specific victims or preventing an imminent terrorist attack, and requires prior authorisation from a judicial or independent administrative authority. (Art. 5)
• High-risk AI systems must comply with strict requirements before being placed on the market, including implementing a risk management system, using high-quality data sets, ensuring appropriate human oversight, and achieving a high level of accuracy, robustness, and cybersecurity. (Art. 8 Art. 9 Art. 10 Art. 14 Art. 15)
• Providers of high-risk AI systems must draw up technical documentation, ensure the system undergoes a conformity assessment, affix a CE marking, and register the system in an EU database before placing it on the market. (Art. 11 Art. 16 Art. 43 Art. 48 Art. 49)
• Providers of general-purpose AI models must draw up and maintain technical documentation, provide information to downstream system providers, establish a policy to respect Union copyright law, and publish a summary of the content used for training. (Art. 53)
• Deployers of certain high-risk AI systems, such as public bodies, must conduct a fundamental rights impact assessment before putting the system into use. (Art. 27)

Structure

The Regulation begins with General Provisions defining its subject matter, scope, and key terms. It then establishes a list of Prohibited AI Practices. A major part is dedicated to High-Risk AI Systems, detailing their classification, requirements, and obligations for various operators, as well as rules for conformity assessment and registration. Subsequent chapters cover transparency obligations for certain systems, rules for General-Purpose AI Models, and measures to support innovation like AI regulatory sandboxes. The governance structure, including the AI Office and Board, is then laid out, followed by provisions on post-market monitoring, market surveillance, and enforcement. The final chapters cover penalties and various amendments to other EU acts.

Related instruments

• Regulation (EU) 2016/679 (32016R0679) — This Regulation (GDPR) on personal data protection applies to data processed in connection with the rights and obligations under the AI Act. The AI Act does not affect the GDPR, but builds upon it, for instance concerning the processing of special categories of data for bias detection.
• Article 10 of Directive (EU) 2016/680 (32016L0680) — This Directive (Law Enforcement Directive) on data protection in the criminal justice sector applies to personal data processing by competent authorities. The AI Act acts as a 'lex specialis' for the use of 'real-time' remote biometric identification for law enforcement purposes.
• Regulation (EU) 2019/1020 — This Regulation on market surveillance and compliance of products applies to AI systems covered by the AI Act, establishing the framework for market surveillance authorities to enforce its rules.
• Regulation (EU) 2022/2065 (32022R2065) — The AI Act does not affect the provisions on the liability of intermediary service providers as set out in this Regulation (the Digital Services Act).