On July 12, 2024, Regulation (EU) 2024/1689 was published in the Official Journal of the European Union (OJEU), establishing harmonized rules on artificial intelligence and amending certain European regulations (Regulation (EC) 300/2008, (EU) 167/2013, (EU) 168/2013, (EU) 2018/858, (EU) 2018/1139, and (EU) 2019/2144) and Directives (Directive 2014/90/EU, (EU) 2016/797, and (EU) 2020/1828).
The Regulation on Artificial Intelligence (RIA) imposes obligations on various operators within the AI ecosystem (developers, manufacturers, providers, distributors, users, etc.).
I. Objective (RIA Art. 1)
The objective is to enhance the functioning of the internal market by establishing a uniform legal framework for the development and use of AI systems in the EU, in accordance with European values, to promote the adoption of human-centric and trustworthy AI while ensuring a high level of protection for health, safety, and fundamental rights enshrined in the EU, protecting against the detrimental effects of AI systems.
To this end, the Regulation establishes:
– Harmonized rules for the placing on the market, putting into service, and use of AI systems in the EU;
– Prohibitions on certain AI practices;
– Specific requirements for high-risk AI systems and obligations for operators of such systems;
– Harmonized transparency rules applicable to certain AI systems;
– Harmonized rules for the placing on the market of general-purpose AI models;
– Rules on market monitoring, market surveillance, governance, and enforcement;
– Measures to support innovation, with particular attention to SMEs, including start-ups.
II. Scope (RIA Art. 2)
The Regulation applies to:
a) Providers placing on the market or putting into service AI systems or general-purpose AI models in the EU, irrespective of whether these providers are established in the EU or a third country;
b) Entities deploying AI systems that are established or located in the Union;
c) Providers and entities deploying AI systems established or located in a third country, when the output generated by the AI system is used in the EU;
d) Importers and distributors of AI systems;
e) Manufacturers of products placing on the market or putting into service an AI system along with their product under their own name or trademark;
f) Authorized representatives of providers not established in the EU;
g) Individuals affected who are located in the EU.
Among other exclusions, the Regulation does not apply to AI systems exclusively linked to:
– Military, defense, or national security purposes, regardless of the type of entity carrying out these activities;
– Scientific research and development, as the sole purpose of the system.
III. Prohibited Practices (RIA Art. 5)
Prohibited AI systems include those that:
– Deliberately manipulate human behavior, significantly impairing individuals’ ability to make informed decisions;
– Perform social scoring (evaluation or classification) to the detriment of the person;
– Conduct real-time facial or biometric recognition in public spaces (with exceptions for personal safety, such as searching for kidnapped or missing persons).
IV. Classification of AI Systems by Risk
The Regulation establishes different requirements based on the risk level of the AI system, which are broadly classified into:
a) High-risk AI systems (RIA Ch. III), including those used in critical infrastructure (energy, transport, etc.), education and vocational training, employment, essential services (banking, etc.). These systems must implement a risk management system to identify, analyze, and mitigate potential risks, and ensure the system is subject to adequate human oversight to prevent and mitigate risks.
b) General-purpose AI models (RIA Ch. V), which will be sub-classified as “systemic risk” (with specific obligations) when they have high-impact capabilities assessed through appropriate technical tools and methodologies, such as indicators and benchmarks.
V. Governance (RIA Ch. VII)
At the European level, the governance and oversight of AI systems will be undertaken by:
– The AI Office (RIA Art. 64), which will, among other tasks, promote and facilitate the development of EU-wide codes of good practice (RIA Arts. 56 and 95);
– The European Artificial Intelligence Board (AI Board) (RIA Art. 65), comprising one representative per Member State (with the European Data Protection Supervisor participating as an observer), providing advice and assistance to the European Commission and Member States to ensure consistent and effective implementation of the RIA.
Other bodies or forums provided for in the RIA include the consultative forum (Art. 67) and the independent scientific expert group (Art. 68).
VI. Sanctions (RIA Ch. XII)
Member States must establish the regime of sanctions and other enforcement measures, such as warnings or non-pecuniary measures, applicable to infringements of the RIA committed by operators, and take all necessary measures to ensure these are applied appropriately and effectively.
Such sanctions must be effective, proportionate, and dissuasive, and take into account the interests of SMEs, including start-ups, as well as their economic viability.
VII. Implementation Schedule (RIA Art. 113)
The RIA, which enters into force 20 days after its publication in the OJEU, will be generally applicable from August 2, 2026 (i.e., two years). However, some provisions have different application dates, notably:
– Chapter II on prohibited AI practices, from February 2, 2025 (six months);
– Chapter V on general-purpose AI models, from August 2, 2025 (one year); – Obligations related to high-risk systems