The EU AI Act: scope, risk classes and timetable
The EU AI Act regulates AI systems on the European market. It defines what counts as an AI system and who is in scope, sorts the uses of AI into risk classes from prohibited to unregulated, leaves AI developed solely for scientific research outside its rules until it becomes a marketed product, and applies in stages, on a timetable that differs between the proposal of 2021 and the Act voted in 2024.
What the Act is for
The Act is a legal framework to promote human-centric and trustworthy AI while protecting the health, safety and fundamental rights of European citizens and still supporting innovation. Regulatory frameworks are thought to stifle innovation, but the Act contains clear measures to promote it. For example, it requires regulatory sandboxes: a small company that creates AI models but lacks the capacity to test them in a real-world scenario can use its member state's sandbox environment for real-world testing with all the regulatory requirements in place.
In May 2024 one panellist, admitting to little detail, understood regulatory sandboxes to be dedicated to research purposes and supposed to simulate real-world scenarios in which systems can be tested. That panellist saw a chicken-and-egg problem in them: software used in a clinical trial needs CE marking, a sandbox has no real patients, and it was unclear how software could get CE marking without a trial having been run first.
The European Union published its proposal in April 2021 because AI is not only an innovation booster but also creates risks. A learning AI is a kind of black box: data are fed in and results come out in a complex manner based on training data, and it is often impossible to determine why and how it arrived at a result. An erroneous result that leads to inappropriate decisions can be significantly problematic for those involved. The proposal laid down a uniform legal framework across the EU for the development, marketing and use of AI, aiming at a high level of protection of health, safety and fundamental rights and at the free cross-border movement of AI-based goods and services.
In one lawyer's view, the Act was not made to protect mankind from AI but to build a regulation that makes it safer to implement products linked with AI. On that view its purpose is economic: the EU wants to build up a single market of data, and AI is an important means of developing new products and new economic ideas. For some years the European Commission has had a data strategy whose idea is that Europe should be a single market of data, making it easier to transfer and use data for scientific and even economic purposes.
The data strategy has led to a body of EU legislation on digital matters. Acts such as the Digital Markets Act aim to make being on the internet safer and to work together with internet providers, the Data Act and the Data Governance Act focus on transferring and processing data towards the single market of data, and the DSM directive is part of the same body of legislation.
The Act runs to more than 500 pages, and the lawyer finds it very informative for a reader interested in legal subjects. In late 2024 one publisher's representative described it as one of the first bills to provide a legal framework for AI: extensive, risk-based, and addressing how copyrighted content can be used. In that representative's view it sets a framework for other countries to follow.
What counts as an AI system, and who is in scope
The Act defines an AI system as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The definition is very vague and broad, and a lot of systems fall under it. In one machine-learning specialist's reading, it has to be that broad because AI is already a very broad field of research and technologies, and will become drastically broader. What matters in it, on his reading, is that it is a system, that it includes some autonomy and perhaps adaptiveness, and that its output is inferred from the input data rather than directly coded. To an EMA speaker in May 2024, the definition showed at once the promise of AI and its possible downsides: all the things the system can do without human oversight.
The Act applies to providers, deployers, importers and distributors whose AI system is placed on the European market. It also applies to foreign providers and deployers whose system is used outside the European market where the data coming out of it affects the European public. The European Commission describes the legislation as horizontal, affecting different sectors and different people, which an EMA speaker took to mean almost everyone unless they are in defence or national security.
Asked in May 2024 whether electronic systems already used in drug development, such as statistical programming tools, fall under the definition, one machine-learning specialist answered that it is so broad that it contains practically everything: in his view even linear regression used for prediction in Excel is AI under it.
Risk classes
Not every system under so broad a definition poses the same threat to safety, health and fundamental rights, so the Act sorts them by risk into four classes, as the medical device and in vitro diagnostic regulations sort devices by risk.
Uses of AI in the unacceptable-risk class are prohibited. They are forbidden because they conflict with the main principles of the EU. One lawyer lists them as manipulative AI, which analyses people's weaknesses in order to manipulate them; biometric categorisation inferring attributes such as race or political opinions; social scoring, meaning scoring a person across all their social aspects and customer behaviours; facial recognition, banned except in very specific circumstances; and recognition of emotions, which the EU does not want enterprises to apply to their workers. The Act has a lot of text on manipulative AI, which in the lawyer's explanation means subliminal messages, one example being pictures or text messages sent to obtain donations. A machine-learning specialist adds predictive policing, because everyone is innocent until proven guilty, which is a fundamental right, and social scoring of people based on unfair characteristics.
High-risk systems still pose a serious threat but bring a lot of benefit, so they are regulated rather than prohibited and remain in use. The class covers AI used as a safety component of a product. Its examples include toys, because they can affect children, who are vulnerable; education; transport, where lives are at stake; aviation; finance, when selecting somebody for a loan; and medical devices and in vitro diagnostics in healthcare. A system counts as high risk where it is covered by Union harmonisation legislation listed in Annex I, such as the legislation on vehicles, aviation, ships, medical devices and in vitro diagnostics, and needs a third-party conformity assessment under that legislation. So medical devices and in vitro diagnostics in a low risk class are not high-risk systems under the Act, though in one specialist's opinion they are so simple that they can never really use AI. A separate list in Annex III names applications of AI systems that are always high risk.
The transparency risk class lies a bit lower than high risk. It covers models that can deceive or impersonate people and be used for manipulation, generally very large models such as ChatGPT and DALL-E, and deep-fake models. They have to be transparent that their content is AI-generated rather than human-generated, so that whoever meets the content can always assess who created it and is not deceived. Minimal-risk systems, such as recommendation systems, games and spam filters, pose hardly any threat and are not regulated by the Act at all, though all other applicable regulations still apply.
In May 2024 one machine-learning specialist was worried about recommendation systems such as those that show an Instagram user what will entice them to keep scrolling: he expected them to be seen as minimal risk, but might disagree about the impact they can have on society. He noted that the Act's unacceptable-risk provisions mention AI that can deceive people or prevent them from making an informed decision, and that such systems give users a great deal of confirmation of their own biases; he hoped they might be regulated better than with no extra regulation, though that was still to be seen.
The proposal of 2021 already treated some particularly harmful uses of AI as unacceptable, such as social scoring by governments, exploitation of children's vulnerabilities and the use of subliminal techniques, and subjected live remote biometric identification systems in publicly accessible spaces used for law enforcement to narrow exceptions (Article 5). Under the proposal, whether a system was high-risk depended on its intended purpose, the severity of possible harm and the probability of its occurrence. Its high-risk systems were those used for biometric identification and categorisation of natural persons, the management and operation of critical infrastructure, access to education and vocational training, employment, workers management and access to self-employment, access to essential private and public services and benefits such as financial credit or medical aid, law enforcement, migration, asylum and border control management, and the administration of justice and democratic processes. More relevant to AI-based medical devices and in vitro diagnostics, the proposal also classified as high-risk the AI systems intended as a safety component of products, and the AI products within certain Union harmonisation legislation that are subject to a third-party conformity assessment before being placed on the market or put into service (Article 6 and recital 30). A safety component was a component of a product or system that fulfils a safety function for it, or whose failure or malfunctioning endangers the health and safety of persons or property (Article 3(14)).
Under the proposal, high-risk systems had to respect a set of requirements that included risk assessment, mitigation and control measures, the use of high-quality data, technical documentation and record-keeping, transparency and information to the user, human oversight measures, and high standards of accuracy, robustness and cybersecurity. Once a system was on the market, authorities would be responsible for market surveillance, users would ensure human oversight and monitoring, providers would have a post-market monitoring system, providers and users would report serious incidents and malfunctioning, and a substantial change during the system's lifecycle would require a new conformity assessment (Article 43(4)). Non-compliance carried fines of up to €30 million, though penalties should take particular account of the interests and economic viability of small-scale providers and start-ups (Article 71).
The exemption for scientific research
The Act makes exceptions for scientific purposes: a product with an AI component developed in the field of scientific research and development is completely exempt from its regulation. The exception follows from the freedom of research and science, one of the EU's principles, which the legislator did not want to disturb, so it covers all scientific research and studies. In the Act's explanations the EU legislator wrote down its motives and ideas at length, including why it accepted research with AI, even with forbidden AI.
In one lawyer's illustrative case, a study of a drug for a skin disease counts how often dogs scratch. Dogs also scratch without an itch as part of normal behaviour, so the researchers build an AI that tells the two apart by reading from the dog's face whether it is happy. Face recognition and emotion recognition are prohibited, but the Act speaks of natural persons, so he thought, though he was not sure, that recognising a dog's face and emotions is not subject to it. If the research is then extended to recognising human emotions, it is still not forbidden, because the exception for scientific research covers it, and the Act need not be consulted.
The exception stops at the product: once a product is implemented and is to be put on the market, the legislation applies and the Act has to be consulted. Components may be built in the field for the purpose of scientific research and development, but a product may not be made from them and brought to market without looking at the Act. Asked whether a product classified as under development, such as facial recognition software used in a clinical trial, can be exempt from most AI regulation, the same lawyer answered that whether software is in development or ready for the market does not matter. What the law requires is that the software be created with the sole purpose of science and research, and such software may be used if it is used only in research and science.
In the lawyer's second illustrative case, an AI built to look at researchers rather than at research measures how many publications they put online, their impact, how often an article is mentioned and the discussion around it. In the lawyer's view it is not created solely for science and research, because its purposes have to do with budget, so the exception does not apply and the Act has to be consulted. He found it hard to say whether such a system is actually forbidden without more information, such as whether it has a social-scoring aspect.
In May 2024 one machine-learning specialist thought that the electronic systems already used in drug development, such as statistical programming tools, are mostly used in research, and that the Act exempts AI used only for research purposes from some of its high-risk requirements, though he was not entirely sure and held that it was still to be seen. He was not sure what the impact would be once such a tool goes into drug development, which he thought depends on how it feeds into it, and he called the matter still vague.
In the lawyer's summary, the Act is relevant to medical writers' work, but in science and research its exceptions are big, and everything that conforms with the ethical rules of science is possible.
When the Act applies
In April 2021 the European Union published a proposal for an AI Act. In 2022 the European Parliament and the Council were discussing it, and negotiations on a common position among member states had started in the Council. As foreseen in 2022, the regulation could take effect over a transitional period in the second half of 2022, during which standards would be mandated and developed and governance structures would become operational. The second half of 2024 was then the earliest it could become applicable to operators, with the standards ready and the first conformity assessments performed, which left time for further adjustment and clarification.
In March 2024 the European Parliament voted in favour of the Act, with 85% of the votes. In May 2024 it still had to be accepted by the Council and published, and no guidelines on it existed yet, so it was hard to give direct, strict rules on what to do.
In the timetable as it stood in May 2024, the Act enters into force 20 days after its publication in the Official Journal. The prohibitions on unacceptable-risk AI apply six months after that. General-purpose AI models are those that can be fine-tuned or reused for many purposes, are very widespread across society and have systemic impact, and because the technology there is evolving very fast they are regulated 12 months after entry into force. The Act applies generally 24 months after entry into force. High-risk systems listed under Annex I get another year of postponement, because they are already regulated by other legislation.