Update on Europe's AI Act: a new regulatory framework for artificial intelligence

On 13 March 2024, the EU parliament adopted a comprehensive set of regulations to be known as the Artificial Intelligence Act (AI Act), aiming to harmonize the rules on artificial intelligence (AI) across its member states, including Ireland.

This framework is designed to promote innovation while ensuring that AI systems are developed and deployed in a trustworthy and safe manner that respects fundamental rights and values. The AI Act seeks to ensure a consistent and high level of protection across the EU, preventing divergences in national laws that could fragment the internal market and decrease legal certainty for AI operators. It aims to facilitate the free circulation, innovation, deployment, and uptake of AI systems and related products and services within the internal market.

Unacceptable risk

Within the AI Act, AI posing "unacceptable" levels of risk will be banned outright. This will cover AI which negatively affects the safety of fundamental rights. This includes AI which can carry out cognitive behavioural manipulation of people or specific vulnerable groups; social scoring classifying people based on behaviour, socio economic status or personal characteristics or predictive policing or real time remote biometric identification systems.

High risk

The AI Act places particular emphasis on "high-risk" AI systems, which must meet mandatory requirements related to accuracy, robustness, cybersecurity, and respect for fundamental rights before being placed on the market or put into service. High-risk AI systems are those with significant potential to harm individuals' health, safety, or fundamental rights. The classification of AI systems under the AI Act is a crucial component of the regulation, designed to categorize AI systems based on their risk level, with a particular focus on identifying high-risk AI systems. This classification determines the regulatory requirements that apply to each AI system.

The AI Act explicitly identifies several categories of AI systems that are considered high-risk due to their potential impact on individuals’ rights and safety. These categories include:

• AI systems used in the management and operation of critical infrastructure, such as digital infrastructure, road traffic, and the supply of water, gas, heating, or electricity
• AI systems used to determine access to or assignment in educational and vocational training institutions, evaluate learning outcomes, and monitor student behaviour during tests
• AI systems intended for the remote biometric identification of persons, given the high risk of biased results and discriminatory effects
• AI systems used in contexts affecting vulnerable individuals, where accuracy and non-discriminatory nature are paramount and
• AI systems employed by judicial authorities or bodies engaged in alternative dispute resolution, considering the significant impact on democracy and individual rights.

Providers of AI systems, especially those that might be classified as high-risk, must notify the (recently established) European AI Office (AI Office) within two weeks after meeting applicable high-impact capabilities thresholds or when it becomes known that a general-purpose AI model will meet these thresholds. This notification is crucial for engaging early with the AI Office to ensure compliance.

For AI systems that are not initially classified as high-risk but whose intended purpose is modified in such a way that they become high-risk, the provider responsible for the modification becomes the new provider for the purposes of the Act. This new provider must ensure compliance with the conformity assessment of high-risk AI systems. Moreover, market surveillance authorities have the power to reclassify an AI system as high-risk if it is found to meet the criteria during their evaluation. In such cases, the provider must take necessary actions to bring the AI system into compliance with the Act's requirements.

Limited to minimal risk

AI systems which are deemed to be of limited risk will include deep fakes, chatbots and digital assistants only need comply with minimal transparency requirements that would allow users to make informed decisions when using the systems. However, such category of AI could easily be modified in such a way as to reclassify as high risk so care should be taken where a company is operating such systems.

AI systems not falling into the three risk categories above will not be subject to compliance with the AI Act.

The AI outlook

The AI Act establishes a framework for market surveillance and compliance, applicable to all AI systems within its scope. This includes the designation of national competent authorities and the establishment of an EU-wide database for high-risk AI systems.

For investors looking to invest in or through Ireland, the AI Act represents both opportunities and challenges. The harmonisation of AI regulations offers a clearer pathway for AI innovation and deployment across the EU, including Ireland. This could attract investments in AI technologies and startups, particularly in sectors where AI can deliver significant benefits without falling into high-risk categories. Investors will need to conduct thorough due diligence on potential AI investments to ensure compliance with the AI Act's requirements, particularly for high-risk AI systems. This includes evaluating the robustness, safety, and fundamental rights adherence of the AI systems developed or deployed by the investment targets.

Companies that successfully navigate the AI Act's regulatory landscape can differentiate themselves in the market as leaders in ethical, trustworthy AI. This can be a significant competitive advantage and an attractive investment proposition.

In Q1 of 2024, Anthropic announced its intention to open an office in Dublin slated to be their European headquarters. Anthropic was founded by former members of Open AI (creators of ChatGPT) and has the stated goal of ensuring the safety and reliability of AI systems. This year Amazon completed a $4 billion dollar investment in Anthropic who also boast Google as a minority shareholder. It is clear that Ireland will continue to be a key geography for global tech as AI comes to the forefront of the worlds biggest tech companies.

The AI Act is set to apply two years after its entry into force, with specific provisions for prohibitions applying six months from the date of entry into force. Notably, the governance structure and the conformity assessment system are expected to be operational 12 months from the date of entry into force.

Investors should closely monitor the implementation timeline and prepare for the upcoming regulatory changes. Early engagement with the AI Act's requirements can position investors to capitalize on the opportunities it presents while mitigating the risks associated with non-compliance.

The AI Act represents a significant step towards establishing a regulatory environment that balances innovation with ethical considerations and public safety. For investors in Ireland and across the EU, understanding the nuances of the AI Act will be crucial for making informed investment decisions in the AI space.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice