A Brief Overview of AI Regulation in Europe

Concerns about AI’s contribution to misinformation, fake news and copyrighted content have intensified globally in recent months, given the growing popularity of generative AI systems such as OpenAI’s ChatGPT, backed by Microsoft (MSFT.O). Faced with the risks posed by these technologies, the European Union has adopted a legal framework on artificial intelligence.

The European Commission had already detailed its ambition in terms of European intelligence strategy by stating in its communication published on 19 February 2020[1] that its “aim is to create a single common European data space, a true single data market in order to guarantee Europe’s global competitiveness and data sovereignty.”

The construction of this single data market had already begun with the General Data Protection Regulation (GDPR) of 2016[2], which gave users rights on data information, portability and oblivion. A different Regulation of 2018[3] has abolished restrictions on non-personal data, (i.e. data that does not relate directly to individuals such as information on water use or pesticides in agriculture). More recently, the Data Governance Act, applicable since September 2023, sets out the rules and mechanisms for re-using certain public or publicly held data, such as that relating to intellectual property.

More recently, a new major step has been taken by the EU balancing the need to prevent the dangers associated AI and the desire not to fall behind: the Member States of the European Union unanimously approved the proposal for a regulation on artificial intelligence on 21 May 2024[4] (which will enter into force in 2026).

Adopting a broad definition of artificial intelligence systems (as a “machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments“), this ground-breaking legislation aims to regulate artificial intelligence.

New regulation on AI: an ambitious risk-based approach

The central challenge of this Regulation is to encourage artificial intelligence and its positive economic and social spin-offs, while at the same time controlling the risks it poses to the fundamental rights of individuals. Certain AI applications are considered as presenting a high level of exposure such as mass biometric recognition or the development of deepfake videos[5]. This is why the Regulation opts for a risk-based approach to “trustworthy” artificial intelligence. Traceability, transparency, and sustainability rules are required to protect people’s safety or rights. This includes biometric identification, infrastructure management (water, electricity), AI systems for education or human resources management, and AI applications to access essential services such as bank credit, public services, social benefits and justice.

The European Council explains that this “new law categorises different types of artificial intelligence according to risk. AI systems presenting only limited risk would be subject to very light transparency obligations, while high-risk AI systems would be authorised, but subject to a set of requirements and obligations to gain access to the EU market. AI systems such as, for example, cognitive behavioural manipulation and social scoring will be banned from the EU because their risk is deemed unacceptable. The law also prohibits the use of AI for predictive policing based on profiling and systems that use biometric data to categorise people according to specific categories such as race, religion, or sexual orientation.”

Indeed, where the risks are deemed to be limited, the Regulation requires the supplier to provide a degree of transparency. For example, when a user uses an online chatbot, he/she must be informed that it is a robot. Similarly, a deepfake video that uses the face and voice of a celebrity must be identified as content created by artificial intelligence.

Article 5 of the Regulation introduces Prohibited AI Practices considered as “unacceptable risks“, as they are used for intrusive and discriminatory purposes. This Category notably includes the exploitation of the vulnerabilities of a person in order to materially distort his / her behaviour in a manner that causes significant harm either to this person or to someone else, police predictive systems based on profiling, location or criminal records, emotion recognition systems (in the areas of justice, borders, the workplace and education), as well as real-time remote biometric recognition in public spaces.

Artificial Intelligences will have to indicate, in a machine-readable format, that the content has been generated by an AI.

Failure to comply with the rules on prohibited practices could result in penalties of up to 35 million euros or 7% of turnover. For minor breaches, the fine is lower and up to 15 million euros or 3% of turnover.

This European Regulation also echoes a resolution adopted by the United Nations on 21 March 2024 entitled “seizing the opportunities offered by safe, secure and trustworthy artificial intelligence systems for sustainable development“.

The United Nations determined to bridge the digital divide

The aim of the resolution is to “bridge the digital divide“. The text also highlights the risks posed by technologies that are developed or used “inappropriately or with the intention of causing harm“. It also acknowledges that, without the establishment of “safeguards”, artificial intelligence may have harmful consequences for human rights, reinforce prejudice and discrimination, and compromise the protection of personal data.

It therefore urges all Member States and other stakeholders to “avoid or cease using artificial intelligence systems that do not respect human rights or that present excessive risks for the exercise of human rights“.

A worldwide concern covering several initiatives

According to the September 2023 Global AI Legislation Tracker, “countries worldwide are designing and implementing AI governance legislation commensurate to the velocity and variety of proliferating AI-powered technologies. Legislative efforts include the development of comprehensive legislation, focused legislation for specific use cases, and voluntary guidelines and standards”.

The EU and the US cooperate on AI under the Trade and Technology Council (TTC). They are implementing a joint roadmap on evaluation and measurement tools for trustworthy AI and risk management.

In the US, President Biden issued on 30 October 2023 a wide-reaching Executive Order on safe, secure and trustworthy AI which aims at establishing new standards for AI safety and security, protects Americans’ privacy, advancing equity and civil rights, standing up for consumers and workers, promoting innovation and competition.

Finally, some nations, aware of the dangers associated with the increased development of artificial intelligence, are adapting their legislation in response to this trend. This is the case in countries such as Brazil which also intends to remedy to the existing legal vacuum this year.

China has also adopted a new legislation in force since 15 August 2023 which provides a legal framework to ensure that the provision and use of AI systems comply with Chinese laws and regulations[6]. In particular, it provides that such content must adhere to the fundamental values of socialism and prohibit incitement to subvert State power, overthrow the socialist system, endanger the security and interests of the State, damage the image of the State, incite secession from the State, undermine the unity of the State and social stability, spread terrorism, extremism, promote national hatred and ethnic discrimination, violence, obscenity and pornography, as well as false and harmful information.

Compliance programs and procedures must therefore be adapted to include AI, in order to comply in particular with the European AI Regulation, which is likely to influence other foreign regulations.

This summary is provided for informational purposes only and is not intended to constitute legal advice nor does it create an attorney-client relationship with Rimon, P.C. or its affiliates.

[1] https://eur-lex.europa.eu/legal-content/FR/TXT/HTML/?uri=CELEX:52020DC0066

[2] https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_fr

[3] https://gdpr-info.eu/

[4] https://eur-lex.europa.eu/resource.html?uri=cellar:e0649735-a372-11eb-9585-01aa75ed71a1.0001.02/DOC_1&format=PDF

[5] which can be defined as a video or sound recording that replaces someone’s face or voice with that of someone else, in a way that appears real

[6] https://digichina.stanford.edu/work/translation-artificial-intelligence-law-model-law-v-1-0-expert-suggestion-draft-aug-2023/#:~:text=Article%201%3A%20(Legal%20Basis),of%20individuals%20and%20organizations%2C%20this

Stephanie De Giovanni is an accomplished international and litigation attorney with over 20 years of experience practicing commercial law and complex commercial litigation. Ms. De Giovanni has a background in international distribution law and spent her early career focused on commercial agency and the setting-up of distribution networks. For the duration of her legal career, she has dealt with termination issues and the disputes arising therefrom. Read more here.

Elia El Kouh is an Associate in Rimon’s Paris office. Ms. El Kouh focuses on international law, commercial law, litigation, and compliance. She has prior experience in law firms in Paris and Morroco advising clients on matters relating to commercial law, criminal business law, economic law, contract law, litigation, and arbitration.  Ms. El Kouh also has experience serving as in-house counsel for the legal department of an automotive manufacturer, where she advised on issues relating to contract law, competition law, distribution, and consumer law. Read more here.