On July 12th, the European Union adopted the Artificial Intelligence regulation (the EU AI Act), set to enter into force on the 1st of August, 2024. While most of the obligations will not come into force for another two years, it is worthwhile for businesses and individuals to be aware of the new requirements, says Toomas Seppel, an attorney-at-law at Hedman Law Firm.
The aim of the AI Act is to ensure the responsible use and development of AI in the European Union, creating the conditions for the responsible development of innovation.
“With the entry into force of the regulation, companies will not have to change their AI-based products and processes immediately, but will be given a transition period of six months to two years, depending on the specific AI model. However, as product development is a time-consuming process, companies should align their processes and products under development today with the future requirements to avoid future disputes and costs,” said Toomas Seppel, an attorney-at-law at Hedman Law Firm.
If a company develops an AI-based product today that will be on the market in two years’ time, it will already have to comply with all the requirements of the regulation in advance.
“For example, the AI Act concerns the choice of data sources used to train AI, and in the future there may be disputes about what it means for a human being to sell their data to train AI models, as has been the case with the social media platform Reddit. For large corporations, the quality of training data is a major issue that needs to be addressed within two years,” said Seppel.
Large corporations should be aware that the obligations and requirements of the AI Act also apply to companies outside the EU if they offer AI-powered products and services in the EU market, such as US company OpenAI, whose GPT series products are also available in the EU.
However, for prohibited AI systems, the AI Act will come into force in six months, which means that the use of such systems will have to be abandoned. Prohibited systems include biometric categorisation systems using sensitive data and facial recognition databases. “The EU will ban the use of systems that manipulate people’s subconscious behaviour and exploit their vulnerabilities,” said Seppel.
However, in a swift change, people may notice that the artificially generated content circulating on the internet needs to be clearly distinguishable. “We are already seeing that it is difficult for the average person to distinguish whether a text, image or video has been created by a human or artificially. Developers of large AI models will have to add watermarks to AI-generated content in the future, and developers of Facebook and Instagram have also promised to put ‘AI-generated’ or similar labels on generated content,” explained Seppel, adding that the new requirement will come into force 12 months after the entry into force of the regulation.
An AI system that interacts with humans will have to inform users that they are interacting not with another human, but with a machine. The notification obligation covers chatbots ranging from customer service in banking to social media such as Snapchat and ChatGPT.
Legal entities can face fines of up to €7.5 million, or 1.5% of the company’s annual turnover, for non-compliance with the AI Act. For global companies, fines could reach €35 million and represent up to 7% of global turnover. No fines are foreseen for individuals under the AI Act. “However, this does not exempt individuals from liability, because if AI-generated content is used to spread false information or to defame a person, the content creator can be held liable on general grounds,” stressed Toomas Seppel.
More information on the AI Act can be found on the website of Hedman: https://hedman.legal/articles/eu-countries-have-just-approved-the-technical-details-of-the-ai-act/
