Navigating the EU AI Act: Implications and Compliance for Businesses

The EU AI Act, effective as of 1^st August 2024, is a landmark regulation that sets harmonised rules for artificial intelligence within the European Union.

The legislation is likely to prove as pivotal to AI as the GDPR was to personal data, in both impact and scope, addressing the various risk levels of AI systems and mandating compliance measures to ensure safe and ethical AI deployment.

In terms of the UK, the previous government was attempting to take a lighter touch approach, by seeking to rely on existing regulators to oversee the regulation of AI, but without any additional powers or funding for the named regulators.

It remains to be seen however whether that rather tenuous approach adopted by the former government will be carried on by the new government, or if they will seek to implement a different strategy more equivalent to the EU AI Act.

In the meantime, businesses whose products or services utilise AI and are deployed in the EU will still have to ensure they are compliant with the new act or face potentially hefty sanctions.

Wondering if your business could be impacted? Here’s a breakdown of what we know so far…

Who will be affected?

Businesses operating within the EU. This included any business developing, deploying, or using AI systems within the EU must comply.

Non-EU businesses whose AI systems’ outputs are used in the EU are also subject to the Act. This extra-territorial reach means UK and international businesses must adhere to the Act if their AI systems interact with EU users or markets​.

Certain AI systems are excluded however, such as those used solely for scientific research, personal non-professional activities, and systems released under free and open-source licenses (unless classified as prohibited or high-risk)​.

What classifies as an ‘AI system’?

The EU has broken down AI systems into the following categories:

• Prohibited AI – These systems pose unacceptable risks and are banned. Examples include AI systems that manipulate behaviour subliminally or evaluate individuals based on personality traits leading to discrimination.
• High-Risk AI – These systems impact critical areas like healthcare, recruitment, and law enforcement. They must comply with stringent requirements, including risk management, human oversight, and data governance. Examples include AI used for job recruitment or credit scoring​.
• Limited Risk AI – These systems require transparency, such as chatbots or AI generating synthetic content. Users must be informed when interacting with AI.
• Minimal Risk AI – These systems perform simple tasks without significant interaction with EU citizens.
• General-Purpose AI (GPAI) – GPAI, such as ChatGPT, are versatile AI systems with broad applications. Providers of GPAI must meet specific transparency and systemic risk obligations​.

What timelines do we need to work to?

The legislation came into effect as of 1^st August but going forward, business leaders may also want to keep an eye on the following…

• 2 February 2025 – Prohibitions on banned AI and AI literacy obligations commence.
• 2 August 2025 – Obligations for GPAI providers and related penalties take effect.
• 2 August 2026 – General provisions, including for high-risk AI, apply.
• 2 August 2027 – Specific provisions for high-risk AI under Annex I apply​.

What key obligations do we need to adhere to?
There are several key obligations which businesses must meet as part of the legalisation. These include:

Conduct thorough risk assessments
Businesses must evaluate potential risks associated with their AI systems.

Implement robust technical and organisational measures
Ensure systems are designed and operated safely, including data governance, documentation, and human oversight.

Assign competent human oversight
Ensure qualified personnel oversee AI operations.

Notify authorities
Inform relevant authorities of significant risks or incidents​.

Ensure transparency
Disclose information regarding training data and manage systemic risks effectively.

Adhere to codes of practice
Follow guidelines facilitated by the EU AI Office to ensure compliance​.

How will it be enforced? And what are the penalties?
Non-compliance can result in significant fines, including:

• Up to 7% of global annual turnover or EUR 35 million for prohibited AI infringements.
• Up to 3% of global turnover or EUR 15 million for high-risk and transparency infringements.
• Up to 1.5% of global turnover or EUR 7.5 million for providing incorrect information​.

The European Commission established the EU AI Office to oversee the implementation and management of the AI Act, ensuring consistent application across Member States and fostering research and innovation in trustworthy AI​.

What practical steps can we take to ensure we are compliant?

Update AI policies
Ensure your AI policy reflects prohibited and high-risk AI categories under the AI Act.

Assign oversight
Designate a competent individual, such as a Data Protection Officer, to oversee AI compliance.

Conduct training
Provide AI literacy training for staff to ensure safe and compliant AI use.

Review contracts
Define roles and responsibilities in AI supply chains and address regulatory changes during contractual relationships​.

What will be the likely impact on UK businesses?
The EU AI Act will have significant implications for UK businesses, especially those engaging with the EU market.

Despite Brexit, UK companies developing or using AI systems that interact with EU customers must comply with the EU AI Act.

This mirrors the extraterritorial reach seen with GDPR, ensuring that UK businesses align with EU standards to continue operations within the EU market.

Moreover, the UK’s approach to AI regulation may eventually incorporate similar principles to maintain competitiveness and facilitate seamless data interoperability with EU counterparts​.

With this in mind, businesses should really begin preparations now to ensure compliance and leverage the opportunities for innovation and growth that the EU AI Act aims to foster.