The EU AI Act and its impact on businesses

What is the EU AI Act?

Recognising the need for a harmonised regulatory approach to ensure the safe integration of AI into society, the EU embarked on a comprehensive initiative to draft legislation that balances innovation with user safety and fundamental rights. On Wednesday, 13 March 2024, MEPs gave final approval for the Act, putting the rules on track to take effect later this year.

At the start of the briefing, PwC’s Keith Power introduced the EU AI Act, which is anchored in the classification of AI systems according to their perceived level of risk. This classification scheme is a cornerstone of the legislation, he said, designed to apply a proportionate regulatory approach that varies in strictness depending on the potential impact of an AI system on users and society. It covers:

• Unacceptable risk: AI applications that pose a clear threat to people’s safety, livelihoods or rights, such as manipulative or exploitative systems, are banned outright.

• High risk: This category includes AI systems with significant implications for individual rights or public safety, such as those used in critical infrastructure, education, employment and law enforcement. These applications are subject to stringent compliance requirements.

• Limited risk: AI applications that involve some level of interaction with users, such as chatbots, require specific transparency obligations to inform users that they are interacting with an AI system.

• Minimal risk: Most AI applications fall into this category. The regulation imposes minimal requirements, allowing for the broad development and use of AI technologies.

Who and what is affected?

The EU AI Act impacts a broad range of entities and sectors. It applies to AI systems and models that are machine-based and operate with some autonomy. The Act is a horizontal regulation, meaning it applies across all sectors. Its jurisdiction extends to all AI systems operating within the EU market or impacting EU citizens, regardless of whether the system is based abroad.

What will happen, and when?

The EU AI Act will be implemented in stages:

• Six months after implementation, prohibitions on unacceptable risk will enter into force.

• After a year, obligations on providers of general-purpose AI models will take effect, and member state competent authorities will be appointed. The Commission will also review and possibly amend the list of prohibited AI annually.

• Eighteen months post-implementation, the Commission will enact a post-market monitoring act.

• Two years after implementation, obligations on high-risk AI systems listed in Annex III will apply, and member states will establish rules on penalties, administrative fees, and at least one national AI regulatory sandbox. The Commission will also review and possibly amend the list of high-risk AI systems.

• Three years post-implementation, obligations for high-risk AI systems intended to be used as a safety component of a product, or if the AI is itself a product, will apply. These systems must undergo a third-party conformity assessment under existing specific EU laws.

• By the end of 2030, specific AI systems that are components of the large-scale IT systems established by EU law in the areas of freedom, security and justice must be brought into compliance.

Compliance requirements

The EU AI Act introduces a comprehensive set of compliance obligations for organisations developing, distributing or using artificial intelligence systems within the European Union. These obligations ensure that AI technologies are developed and deployed in a manner that is secure and prioritises user safety, data privacy and ethical considerations.

Importantly, companies outside the EU that target EU consumers or businesses must ensure their AI systems comply with the Act. This may require significant data handling, system design and operational transparency adaptations.

The consequences of non-compliance with the EU AI Act are severe. Non-compliance with prohibited AI practices or data obligations can result in a penalty of up to €35 million or 7% of total worldwide turnover in the preceding financial year, whichever is higher. If there is non-compliance with any other requirement, the penalty can be up to €15 million or 3% of total worldwide turnover in the preceding financial year, whichever is higher. Supplying incomplete, incorrect, or false information can lead to a penalty of up to €7.5 million or 1.5% of total worldwide turnover in the preceding financial year, whichever is higher.

Panel discussion

Following Keith’s opening remarks, the panel discussed the many issues business leaders must consider to capitalise on the opportunity presented by AI while complying with the principles and spirit of the EU AI Act. Here are the key points:

• The EU AI Act has significant implications for businesses, requiring the development of a responsible AI framework. This involves creating an AI exposure register or inventory of AI systems and categorising them in line with the EU AI Act.

• The first step in working towards compliance is understanding where your organisation uses AI. Many organisations lack standards and rules for AI use, often using it simply because they can. A Governance structure built using Responsible AI principles should provide control over—and trust in—AI systems.

• Dealing with unstructured data like documents and emails can be complex. Every company will have a governance and risk framework, but data in AI presents a unique risk. Harmonising and updating policies alone won’t instil confidence in the business, Data Governance also needs to be considered.

• AI is already in organisations, in many cases through third-party partnerships. You need to understand how the outputs of the third party AI models flow through your organisation and how that data is used, to ensure appropriate safeguards are in place that are consistent with your AI Governance policies.

• Your role in the AI supply chain will help you determine your responsibility, but the most significant risk could be the misuse of AI by those in your own organisation.

• Organisations should see the EU AI Act as a piece of consumer protection legislation that safeguards their fundamental rights and freedoms. If you are doing something that affects those rights and freedoms, you must take action to address this.

• Boards need to ask questions to understand what AI systems are in use within their organisations and what third parties are using AI—and how.

• Where organisations ban GenAI, employees often use it anyway in a quasi-personal capacity. Instead, they could use enterprise-grade tools with the proper boundaries for responsible usage. Boards and organisations must engage with the technology; banning it is a road to nowhere.

Conclusion

While the EU AI Act sets out rigorous standards and compliance requirements for businesses, it also paves the way for innovation within a framework of trust and safety. By embracing these regulations, businesses can navigate the complexities of AI development responsibly while differentiating themselves in a competitive and rapidly evolving digital marketplace.

We are here to help 

In the rapidly changing AI regulation and compliance landscape, navigating your business towards a future where innovation meets responsibility can be overwhelming. Our deep expertise in AI Governance, Responsible AI and our complete understanding of regulatory landscapes make us uniquely positioned to guide your business through these complex challenges. Our tech-powered team of experts can provide the strategic insights you need to comply with the latest AI regulations and drive your business forward. Contact us today.