The European Parliament voted Wednesday to adopt the AI Act, securing the bloc pole-position in setting rules for a broad sweep of artificial intelligence-powered software — or what regional lawmakers have dubbed “the world’s first comprehensive AI law”.
MEPs overwhelmingly backed the provisional agreement reached in December in trilogue talks with the Council, with 523 votes in favor vs just 46 against (and 49 abstentions).
The landmark legislation sets out a risk-based framework for AI; applying various rules and requirements depending on the level of risk attached to the use-case.
The full parliament vote today follows affirmative committee votes and the provisional agreement getting the backing of all 27 ambassadors of EU Member States last month. The outcome of the plenary means the AI Act is well on its way to soon becoming law across the region — with only a final approval from the Council pending.
Once published in the EU’s Official Journal in the coming months, the AI Act will come into force 20 days after that. Although there’s a phased implementation, with the first subset of provisions (prohibited use-cases) biting after six months; with others applying after 12, 24 and 36 months. Full implementation is thus not expected until mid 2027.
On the enforcement front, penalties for non-compliance can scale up to 7% of global annual turnover (or €35 million if higher) for violating the ban on prohibited uses of AI. While breaches of other provisions on AI systems could attract penalties of up to 3% (or €15 million). Failure to cooperate with oversight bodies risks fines of up to 1%.
Speaking during a debate Tuesday, ahead of the plenary vote, Dragoș Tudorache, MEP and co-rapporteur for the AI Act, said: “We have forever attached to the concept of artificial intelligence the fundamental values that form the basis of our societies. And with that alone the AI Act has nudged the future of AI in a human-centric direction. In a direction where humans are in control of the technology and where it, the technology, helps us leverage new discoveries, economic growth, societal progress, and unlock human potential.”
AI Act co-rapporteur, Dragoș Tudorache, gives a thumbs-up to the plenary vote result in European Parliament (Screengrab: Natasha Lomas/TechCrunch)
The risk-based proposal was first presented by the European Commission back in April 2021. It was then substantially amended and extended by EU co-legislators in the parliament and Council, over a multi-year negotiation process, culminating in a political agreement being clinched after marathon final talks in December.
Under the Act, a handful of potential AI use-cases are deemed “unacceptable risk” and banned outright (such as social scoring or subliminal manipulation). The law also defines a set of “high risk” applications (such as AI used in education or employment, or for remote biometrics). These systems must be registered and their developers are required to comply with risk and quality management provisions set out in the law.
The EU’s risk-based approach leaves most AI apps outside the law, as they are considered low risk — with no hard rules applying. But the legislation also puts some (light touch) transparency obligations on a third subset of apps, including AI chatbots; generative AI tools that can create synthetic media (aka deepfakes); and general purpose AI models (GPAI). The most powerful GPAIs face additional rules if they are classified as having so-called “systemic risk” — the bar for risk management obligations kicking in there.
Rules for GPAIs were a later addition to the AI Act, driven by concerned MEPs. Last year lawmakers in the parliament proposed a tiered system of requirements aimed at ensuring the advanced wave of models responsible for the recent boom in generative AI tools would not escape regulation.
However a handful of EU Member States, led by France, pushed in the opposite direction — fuelled by lobbying by homegrown AI startups (such as Mistral) — pressing for a regulatory carve-out for advanced AI model makers by arguing Europe should focus on scaling national champions in the fast developing field to avoid falling behind in the global AI race.
In the face of fierce lobbying, the political compromise lawmakers reached in December watered down MEPs’ original proposal for regulating GPAIs.
It did not grant a full carve-out from the law but most of these models will only face limited transparency requirements. It is only GPAIs whose training used compute power greater than 10^25 FLOPs that will likely have to carry out risk assessment and mitigation on their models.
Since the compromise deal, it has also emerged that Mistral has taken investment from Microsoft. The U.S. tech giant holds a much larger stake in OpenAI, the U.S.-based maker of ChatGPT.
During a press conference today ahead of the plenary vote, the co-rapporteurs were asked about Mistral’s lobbying — and whether the startup had succeeded in weakening the EU’s rules for GPAIs. “I think we can agree that the results speak for itself,” replied Brando Benifei. “The legislation is clearly defining the needs for safety of most powerful models with clear criteria… I think we delivered on a clear framework that will ensure transparency and safety requirements for the most powerful models.”
Tudorache also rejected the suggestion lobbyists had negatively influenced the final shape of the law. “We negotiated and we made the compromises that we felt were reasonable to make,” he said, calling the outcome a “necessary” balance. “The behaviour and what companies choose to do — they are their decisions — and they have not, in any way, impacted the work.”
“There were interests for all of those developing these models to keep still a ‘black box’ when it comes to the data that goes into these algorithms,” he added. “Whereas we promoted the idea of transparency, particularly for copyrighted material, because we thought it is the only way to give effect to the rights of authors out there.”
Benifei also pointed out the addition of environmental reporting requirements in the AI Act as another win.
The lawmakers added that the AI Act represents the start of a journey for the EU’s governance of AI — stressing the model will need to evolve and be extended with additional legislation in the future, with Benifei pointing to the need for a directive to set rules for the use of AI in the workplace.
Work to enhance conditions for investments in AI are also required, he said. “We want Europe to invest in artificial intelligence. To do more for common research. To do more in sharing the computational capability. The work of the supercomputers… It will be important to also underline the need to complete the Capital Markets Union — because we need to be able to invest on AI with more [ease] than today. We risk today that some investors prefer to invest in the U.S. than in another European country, in another European company.”
“This Act is only the beginning of a longer journey, because AI is going to have an impact that we can’t only measure through this AI Act — it’s going to have an impact on education systems, it’s going to have an impact on our labour market, it’s going to have an impact on warfare,” Tudorache added. “So there’s a whole new world out there that opens up where AI is going to play a central part and therefore, from this point onwards, as we’re also going to build the governance that comes out of the Act, we’ll have to be very mindful of this evolution of the technology in the future. And be prepared to respond to new challenges that might come out of this evolution of technology.”
Tudorache also reiterated his call last year for joint working on AI governance between likeminded governments and even more broadly, wherever agreements can be forged.
“We still have a duty to try to be as interoperable as possible — to be open to build a governance with as many democracies, with as many like minded partners out there. Because the technology is one, irrespective of which quarter of the world you might be in. Therefore, we have to invest in joining up this governance in a framework that makes sense.”