The full and final text of the EU law on AIthe European Union’s landmark risk-based regulation for artificial intelligence applications, has been published in the bloc Official newspaper.
Within 20 days, on August 1, the new law will come into force and in 24 months – that is, in mid-2026 – its provisions will generally be fully applicable to AI developers. However, the law takes a phased approach to implementing the EU’s AI ruleset, meaning there are several deadlines to observe between now and then – and some even later – as different legal provisions begin to be implemented. applied.
EU lawmakers reached a political agreement on the bloc’s first comprehensive set of rules for AI in December last year.
The framework imposes different obligations on AI developers depending on use cases and perceived risk. Most AI uses will be unregulated as they are considered low risk, but a small number of potential AI use cases are prohibited by law.
So-called “high-risk” use cases—such as biometric uses of AI or AI used in law enforcement, employment, education, and critical infrastructure—are permitted by law, but developers of such applications face obligations in areas such as data quality. and anti-prejudice.
A third risk level also applies some lighter transparency requirements for makers of tools like AI chatbots.
For makers of general-purpose AI (GPAI) models like OpenAI’s GPT, the technology underlying ChatGPT, there are also some transparency requirements. More powerful GPAIs, typically defined based on compute threshold, may also be required to perform systemic risk assessments.
Heavy lobbying by some elements of the AI industry supported by a handful of member state governments, sought to water down GPAIs’ obligations due to concerns that the law could impede Europe’s ability to produce homegrown AI giants to compete with rivals in the US and China.
Phased implementation
Firstly, the list of prohibited uses of AI will be applied six months after the law comes into force – that is, at the beginning of 2025.
Prohibited (or “unacceptable risk”) use cases of AI that will soon be illegal include Chinese-style social credit scoring; compile facial recognition databases through untargeted Internet scraping or CCTV; the use of real-time remote biometrics by law enforcement in public places, unless one of several exceptions applies, such as during a search for missing or kidnapped persons.
Then, nine months after they come into force – i.e. around April 2025 – the codes of practice will apply to developers of in-scope AI applications.
The EU AI Office, an ecosystem construction and oversight body established by law, is responsible for providing these codes. But who will in truth writing the guidelines is still raising questions.
According to a Euractiv report earlier this month, the EU has been looking for consultancy firms to write the codes, triggering civil society concerns that AI industry players will be able to influence the shape of the rules that apply to them. More recently, Mlex reported that the AI Office will launch a call for expressions of interest to select interested parties in drafting codes of practice for general-purpose AI models, following pressure from MEPs to make the process inclusive.
Another important deadline is 12 months after entry into force – or August 1, 2025 – when the law’s rules on GPAIs that must comply with transparency requirements will begin to be applied.
A subset of high-risk AI systems received the most generous compliance deadline, with 36 months after entry into force – until 2027 – to meet their obligations. Other high-risk systems must comply sooner, after 24 months.
