TheCorporateCounsel.net

Since the EU AI Act was published in the Official Journal of the EU on July 12, it will enter into force on August 1 (20 days after publication). This Wilson Sonsini alert says the Act will not apply immediately but in the phases below. (See the further timeline in the alert.)

Prohibitions of certain AI systems: The first set of rules to kick in will be those prohibiting certain applications of AI (e.g., AI systems that exploit individuals’ vulnerabilities, untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases). These rules will start to apply as of February 2025.

General-purpose AI (GPAI) models: The requirements in relation to new GPAI models will start to apply one year after the entry into force of the AI Act, i.e., by August 2025. There will be an additional two-year grace period for GPAI models that are already on the EU market at that time (i.e., providers of GPAI models placed on the EU market before August 2025 will have an additional two years to comply, until August 2027).

High-risk AI (HRAI) systems: The rules for some HRAI systems and AI systems with specific transparency risk will start to apply by August 2026. If the HRAI system is part of a product that is subject to EU health and safety laws (e.g., toys) the rules will apply a year later (i.e., by August 2027). Operators of HRAI systems that are already offered in the EU before the application of the AI Act will need to comply with the AI Act only in the event of a significant design change (e.g., changes in the AI system’s intended purpose). As an exception to this, if the HRAI system offered in the EU is intended to be used by public authorities, the providers and deployers will need to comply with the rules by August 2030, regardless of whether there has been a significant design change or not.

The alert warns: “Once the AI Act starts to apply, it will introduce a swathe of new obligations for companies providing, distributing, importing, and using AI systems and GPAI models in the EU, subject to hefty fines of up to EUR 35 million or seven percent of the total worldwide annual turnover, whichever is higher.”

These new obligations and fines have gotten the attention of US securities regulators. At SEC Speaks in April, SEC Staff characterized the Act as “a comprehensive risk-based legal regime governing AI across the EU” that “will have implications for public companies that provide or deploy AI systems in the EU” and specifically noted that penalties include “up to 7% of global revenue” and violations can “result in withdrawal of the AI system from the market.” The Staff said that some companies are generally disclosing that they may be impacted by the Act and reminded companies of the need to tailor disclosure to address how the company will be particularly impacted based on its facts and circumstances.

– Meredith Ervine