The European regulation on artificial intelligence (AI Act), first proposed by the European Commission in April 2021, adopted by the Council of the European Union on 21 May 2024 and published as Regulation (EU) 2024/1689 of 13 June 2024 in the Official Journal of the European Union on 12 July 2024, entering into force on 1 August 2024, does not apply only to companies established in the European Union. Where an AI system is placed on the European market or used within the EU, its provider may be subject to the obligations of the regulation, wherever it is established. Here are the key points for companies located outside the European Union.
A harmonised legal framework, inspired by the GDPR
Unlike a directive, the AI Act is directly applicable in all EU Member States, without needing to be transposed into national legislation, which ensures uniform application of the rules across the Union. The regulation has two objectives: to ensure that AI systems are safe and respect the fundamental rights of EU citizens, and to promote innovation and the adoption of AI technologies within the Union.
A classification of AI systems according to their level of risk
The AI Act classifies AI systems into four categories: unacceptable risk, high risk, limited risk, and minimal or no risk. The regulation imposes specific requirements on each category, in particular as regards data governance, documentation and transparency, human oversight, and robustness and security. High-risk systems must obtain certification before being placed on the market, and national supervisory authorities have powers of inspection and sanction, with administrative fines of up to EUR 35,000,000 or 7% of the company’s total worldwide annual turnover for the most serious breaches, that is, the prohibited practices listed in Article 5 of the regulation; up to EUR 15,000,000 or 3% for breaches of most other obligations; and up to EUR 7,500,000 or 1% for supplying incorrect, incomplete or misleading information to the authorities, whichever amount is higher in each case, with a lower cap for SMEs (Article 99 of the regulation).
Extraterritorial scope of the AI Act
The AI Act applies to AI systems located outside the EU where those systems are placed on the European market or used within the Union. Non-European providers must therefore comply with the requirements of the regulation in order to access the European market, in the same way as providers established in the EU.
Appointing a representative in the European Union
Providers of AI systems located outside the EU must appoint a representative established in the Union, who acts as the point of contact for all compliance questions under the AI Act. This representative shares responsibility for ensuring that the AI systems comply with the regulation.
Technical documentation and conformity assessment
Non-European providers must supply detailed technical documentation demonstrating the compliance of their AI systems with the requirements of the regulation. High-risk systems must also undergo conformity assessments before being placed on the EU market.
Security, transparency and oversight requirements
AI systems must be trained on high-quality data in order to limit bias and ensure accurate performance. End users must be informed when they interact with an AI system, with clear instructions for its use. The supervisory authorities of the Member States may carry out inspections and audits of AI systems marketed in their territory, including those supplied by non-European companies.
Innovation support mechanisms
Non-European providers may take part, in cooperation with EU authorities, in regulatory sandboxes to test and develop their AI systems in a controlled environment. By complying with the requirements of the AI Act, non-European companies can access the European single market.
The AI Act is a major step towards regulating the development of artificial intelligence while promoting innovation. Companies established outside the European Union have an interest in anticipating these requirements before accessing the European market. The firm supports Tunisian and international companies in analysing whether the AI Act applies to their systems and in bringing their related data processing into compliance. For any question, contact the firm.
References
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
- Regulation (EU) 2016/679 (GDPR)