On July 12, 2024, the European Union’s (EU) Artificial Intelligence Act (AI Act) was published in the Official Journal of the EU. This was the last step for the AI Act to become law. The AI Act will enter into force 20 days after the publication, i.e., on August 1.
Will the EU AI Act Start to Apply Right Away?
The AI Act will not start to apply right after it has entered into force. Rather, the new rules will start to apply in phases:
- Prohibitions of certain AI systems: The first set of rules to kick in will be those prohibiting certain applications of AI (e.g., AI systems that exploit individuals’ vulnerabilities, untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases). These rules will start to apply as of February 2025.
- General-purpose AI (GPAI) models: The requirements in relation to new GPAI models will start to apply one year after the entry into force of the AI Act, i.e., by August 2025. There will be an additional two-year grace period for GPAI models that are already on the EU market at that time (i.e., providers of GPAI models placed on the EU market before August 2025 will have an additional two years to comply, until August 2027).
- High-risk AI (HRAI) systems: The rules for some HRAI systems and AI systems with specific transparency risk will start to apply by August 2026. If the HRAI system is part of a product that is subject to EU health and safety laws (e.g., toys) the rules will apply a year later (i.e., by August 2027). Operators of HRAI systems that are already offered in the EU before the application of the AI Act will need to comply with the AI Act only in the event of a significant design change (e.g., changes in the AI system’s intended purpose). As an exception to this, if the HRAI system offered in the EU is intended to be used by public authorities, the providers and deployers will need to comply with the rules by August 2030, regardless of whether there has been a significant design change or not.
EU AI Act Timeline
Once the AI Act starts to apply, it will introduce a swathe of new obligations for companies providing, distributing, importing, and using AI systems and GPAI models in the EU, subject to hefty fines of up to EUR 35 million or seven percent of the total worldwide annual turnover, whichever is higher.
For more information about the scope and requirements in the AI Act, please see our FAQ on 10 Things You Should Know About the EU AI Act.
If you have any questions regarding the AI Act, please contact Laura De Boel, Cédric Burton, Yann Padova, or Nikolaos Theodorakis from Wilson Sonsini’s privacy and cybersecurity practice.
Wilson Sonsini’s AI Working Group assists clients with AI-related matters. Please contact Laura De Boel, Maneesha Mithal, Manja Sachet, or Scott McKinney for more information.
Rossana Fol, Roberto Yunquera Sehwani, and Karol Piwonski contributed to the preparation of this client alert.