The EU's Artificial Intelligence (AI) Act

The AI Act adopts a risk-based approach and categorizes AI systems based on the inherent risk posed by their application and usage. Based on the risk, a system can be categorized into high-risk AI systems, prohibited/ unacceptable AI systems, or specific systems with specific compliance requirements;

Each risk level has different corresponding regulatory obligations, meaning organizations' requirements and responsibilities under the AI Act will depend on their AI system's risk level;

AI systems that present unacceptable risk will be banned from February 2025;

The AI Act generally prohibits the user of real-time biometric identification systems such as facial recognition in public spaces, apart from a few exceptions for matters of national security or serious crime protection;

All AI systems deemed as "high-risk" must be designed to allow for human oversight and will be subject to conformity assessments before being placed on the market;

National authorities within EU member states, in tandem with the European Artificial Intelligence Board (EAIB), will oversee and enforce the AI Act;

Non-compliance with the AI Act's provisions can result in heavy fines that can reach up to €35 million or 7% of global annual turnover for companies that violate the law, whichever one is higher;

The AI Act is meant to complement other digital regulations within the EU, especially the GDPR, to ensure all deployed AI systems respect data privacy, security, and protection standards.