On December 9, 2023, the European Parliament, the Council of the European Union and the European Commission reached a political agreement on the EU Artificial Intelligence Act (“AI Act”) (see here for the Parliament’s press statement, here for the Council’s statement, and here for the Commission’s statement). Following three days of intense negotiations, during the fifth “trilogue” discussions amongst the EU institutions, negotiators reached an agreement on key topics, including: (i) the scope of the AI Act; (ii) AI systems classified as “high-risk” under the Act; and (iii) law enforcement exemptions.

As described in our previous blog posts on the AI Act (see here, here, and here), the Act will establish a comprehensive and horizontal law governing the development, import, deployment and use of AI systems in the EU. In this blog post, we provide a high-level summary of the main points EU legislators appear to have agreed upon, based on the press releases linked above and a further Q&A published by the Commission. However, the text of the political agreement is not yet publicly available. Further, although a political agreement has been reached, a number of details remain to be finalized in follow-up technical working meetings over the coming weeks.

• Prohibited AI practices. Each EU institution’s press release confirms that the AI Act prohibits certain AI practices. According to the Parliament’s press release, banned AI practices include (among others): (i) untargeted scraping of facial images from the internet or CCTV to create facial recognition databases; (ii) biometric categorization of natural persons that uses sensitive characteristics; (iii) emotion recognition in the workplace and educational institutions; and (iv) social scoring based on social behaviour or personal characteristics.
• High-risk AI systems. Each EU institution’s press release confirms that AI systems classified as “high-risk” will have to comply with additional obligations. The Commission’s Q&A highlights the following obligations (among others): (i) conformity assessments; (ii) quality and risks management systems; and (iii) fundamental rights impact assessments that will apply to “deployers that are bodies governed by public law or private operators providing public services, and operators providing high-risk systems”.
• Right to lodge complaints. According to the Parliament’s press release, the AI Act will grant citizens the “right to launch complaints about AI systems and receive explanations about decisions based on high-risk AI systems that impact their rights.”
• General-purpose AI systems. Each EU institution’s press release confirms their agreement on rules covering general purpose AI models (“GPAI”). The Parliament’s press release indicates that GPAI “will have to adhere to transparency requirements” including “drawing up technical documentation, complying with EU copyright law, and disseminating detailed summaries about the content used for training”.
• Oversight. The Commission’s Q&A states that the Commission will establish a new European AI Office and AI Board. According to the Q&A, the AI Office will “enforce and supervise the new rules for general purpose AI models. This includes drawing up codes of practice to detail out rules, its role in classifying models with systemic risks and monitoring the effective implementation and compliance” with the AI Act.  
• Sanctions. The Commission’s press releases states that non-compliance with the AI Act could lead to fines of up to (i) €35 million or 7% of global turnover, whichever is higher, for violations of banned AI practices; (ii) €15 million or 3% of global turnover for violations of other obligations; and (iii) €7.5 million or 1.5% of global turnover for supplying incorrect information required by the AI Act.
• Entry into force. The Commission’s Q&A confirms that the AI Act will enter into force 20 days after its publication in the EU Official Journal and will start applying to organizations two years after its entry into force, except for some specific provisions including: prohibitions on certain AI systems will apply after 6 months and rules on GPAI will apply after 12 months.

To bridge the transitional period before the AI Act becomes generally applicable, the Commission will be launching an AI Pact for AI developers to voluntarily commit to complying with the Act’s key obligations ahead of it becoming legally binding.

The Covington team has deep experience advising clients on European data-related and privacy regulations, including on the AI Act, and is closely monitoring any development in relation to the AI Act and Member States initiatives on AI. If you have any questions on how the AI Act and other upcoming EU legislation will affect your business, our team is happy to assist.