Prepared For Landing — The EU Artificial Intelligence Act Has Found Its Final Form
Yesterday, after 35 hours of negotiations¹, the drama was over. The three branches of the European Union, the Commission, the Council and Parliament have agreed on the last questions of the EU Artificial Intelligence Act², the regulatory framework that has been in the making for over two years. With this agreement, the most important milestone has been achieved³.
It was long and intense, but the effort was worth it. (Brando Benifei MEP, EU Parliament press release)
While there is no new draft yet available it is clear that the AI Act will differ in some points from the draft and amendments the EU parliament had agreed upon in the summer. A good time to check in on what has changed: Is it as “historic” as some claim? Or is there too much compromise? Can it be both?
Compromises
With regards to the outstanding contentious points of the negotiations (banned applications, biometric identification and the handling of general-purpose AI models) compromises have been found in the following areas:
Banned applications: The list of outright banned applications of AI has more or less stayed untouched since the parliamentary draft (it is noteworthy that it considerably grown since the EU Commission’s draft published in 2021). The list includes (between other items) a ban of biometric categorisation systems (e.g. political, religious, sexual orientation etc), untargeted collection of facial images from the internet or CCTV for face recognition, emotion recognition in the workplace or education and any form of social scoring system.
Biometric Identification Systems: Rather than the outright ban of BIS, there will be exceptions for law enforcement for the of use biometric identification systems by law enforcement, but limited to crimes mentioned in the AI Act.
Safeguards on general purpose AI : One of the most fought over questions were the requirements for general-purpose AI models (GPAI). The compromise means that different rules apply for models with different levels of impact, essentially introducing a two-tier system. GPAI models generally will have to adhere to transparency requirements as initially proposed by Parliament. These include drawing up technical documentation, complying with EU copyright law and disseminating detailed summaries about the content used for training.
There will however be special rules for “high-impact” GPAI models, such as conduct adversarial testing, incident reporting and model evaluations.
In addition, a right of consumers to launch complaints and the right to receive a “meaningful explanation” has been agreed upon.
Exceptions, biometrics and loopholes
It’s obvious that the EU Parliament has lost the fight over the full-on ban of AI powered biometric identification systems. Exceptions for law enforcement will be made. On the other hand, parliament was successful in limiting those application to crimes mentioned in the Act, rather than leaving it to the member states.
I would have wished for a clear and outright ban. as proposed by parliament. Historically, adding exceptions for law enforcement lead to the limits of the regulation being tested constantly, and even stretch it at times under the excuse of emergency.
As Algorithm Watch points out, the compromise also includes a wide ranging exception with regards to migrants⁴, though details will only be seen when the final text of the act has been published.
However I believe that the discussion about surveillance, use of biometric data and powers for law enforcement purposes should be better moved away from AI regulation to a political debate about basic rights. We need to strengthen the idea that personal rights are more important than potential toys for law enforcement. The EU parliament can and should tackle this in future EU wide regulation.
A process with transparency problems
This has been a long process. A lot of time has passed since the EU commission introduced the first draft of the AI Act in 2021.
The impact recent lobbying from governments and industry is worrying. While companies’ opinions should be heard on regulation, the process has been opaque and obviously coordinated to leave parliament as little time to respond as possible. Considering the intransigence of the decision process, industry appears to have an advantage over the civil society when it comes to access to the parties in the negotiations.
While we learned more about the trilogue than we normally do, it is still an opaque and hard to follow process. There is a clear lack of transparency, maybe even a deficit of democracy, here.
Transition
Despite all provisions being agreed between the negotiators, there is much work to do over the next weeks and months to write the final text of the AI Act, which then can be adopted. After it has been adopted there will be an implementation phase, which means the act will likely come into effect at some point in 2025.
Until then, the EU commission invites the industry to take part in its “AI Pact”⁵, a provisional setup to allow service providers in the industry to show their readiness and compliance during the implementation phase.
Historic? Too much compromise? Or both?
In the current political landscape, this is likely the best that could have been achieved. The process was — as expected — flawed and the outcome is a clear compromise. The final judgement might have to wait until the final text has been published. Some devils might be in the detail.
This is a historical achievement, and a huge milestone towards the future! (Carme Artigas, Spanish secretary of state for digitalisation, EU Council press release)
Nevertheless, the AI Act contains some truly progressive approaches. Different from the GDPR it does not blankly excludes government and law enforcement. It — at least as a starting point — imposes general rules rather than hoping for a self-regulated industry.
The EU is the first in the world to set in place robust regulation on AI, guiding its development and evolution in a human-centric direction (Dragos Trudorache MEP, EU Parliament press release)
It is indeed historic, as it truly is the first comprehensive framework to regulate AI in the world. Such a framework is badly needed, and could have taken much longer, as the stalling and indecisiveness around the world clearly shows. In that sense it is rightly called “historic”. Calling it so doesn’t mean it is perfect.
The AI Act transposes European values to a new era. (Ursula von der Leyen, EU commission press release)
This will not and should not be the last word on AI regulation. As the impact of technology on our lives will continue to increase and evolve, so should regulation evolve to keep abuse in check and guarantee rights to privacy.
Because with great power should always come great accountability.
¹Member states and MEPs strike deal on EU AI Act after drawn-out, intense talks — Euronews
²Press releases The EU Commission, the EU Council and the EU Parliament
³European Union squares the circle on the world’s first AI rulebook — Euractive
⁴AI Act deal: Key safeguards and dangerous loopholes — Algorithm Watch
⁵AI Pact — European Commission
