The EU AI Act was entered into the EU’s statute books on July 12, 2024. A transition period will begin from 1 August when it enters into force. The geographic scope is very broad, with obligations falling on organisations using or involved in the supply of AI in the EU and organisations operating outside the EU where the AI’s output is used in the EU.
What are the obligations and penalties?
Penalties are up to €35 million or 7% total worldwide annual turnover for breaches of the prohibitions, with fines of €15 million or 3% total worldwide annual turnover for many provisions and €7.5 million or 1% total worldwide annual turnover for the supply of incorrect, incomplete, or misleading information. Regulators can also require operators to bring an AI system into compliance or withdraw it from the market.
February 2, 2025 – prohibitions apply. These prohibit some use cases e.g. emotion recognition systems in the workplace and in education or inappropriate use of social scoring. Requirements for organisations to promote AI literacy also apply.
August 2, 2025 – general purpose AI provisions apply – these include information obligations to downstream providers for providers of tools like chatbots powered by large language models.
August 2, 2026 – obligations apply for high-risk AI brought into scope due to the use case (e.g. assessing credit risk, underwriting for life and health insurance, emotion recognition outside the workplace or education). These include various risk management and governance obligations.
August 2, 2027 – obligations apply for high-risk AI systems brought into scope via other EU product safety legislation, e.g. medical devices, machinery, radio equipment.
What should we do to prepare?
Create an AI inventory and identify prohibited practices and high-risk AI.
To establish your governance process, start small and look to build while travelling:
- establish where key stakeholders will fit in and what information they need—business units, IT development teams, data office, procurement, legal, HR
- create a library of legal risks with playbooks to allow some evaluation by non-experts
- understand the importance of triage and right sizing the evaluation process
- understand what specific regulatory requirements will apply and when and the role of standards
Create a process for procuring AI that dovetails to the governance process.
For more information
- Attend our European roadshow event The EU AI Act has arrived – how should you govern your use of AI? in-person in Frankfurt (September 30, 2024), Amsterdam (October 1, 2024), Paris (October 2, 2024), or London (October 3, 2024)
- Watch our earlier webinar on what obligations will apply to your business on-demand
- Read our summary of the AI Act