Get ready for the 
EU AI Act with Credo AI

The EU’s approach to artificial intelligence centers on excellence and trust, aiming to boost research and industrial capacity while ensuring safety and fundamental rights.

Since April 2018, the three governance bodies of the European Union - the European Commission, Parliament, and Council - have considered how to comprehensively regulate Artificial Intelligence in the European Union’s Single Market.

In June of 2018, the European Commission appointed fifty-two experts (from academia, business, and civil society), to its “High Level Expert Group on Artificial Intelligence” (HLEG), designed to support the implementation of the EU Communication on Artificial Intelligence (published in April 2018). This HLEG focused on outlining a human-centric approach to AI, and designed a list of seven key requirements that AI systems should meet in order to be trustworthy (in its Ethics Guidelines for Trustworthy AI):

1. Human agency and oversight;
2. Technical Robustness and safety;
3. Privacy and data governance;
4. Transparency;
5. Diversity, non-discrimination and fairness;
6. Societal and environmental well-being; and,
7. Accountability.

The mandate of the AI HLEG ended in July 2020 with the presentation of two more deliverables: 

• The final Assessment List for Trustworthy AI (ALTAI): A practical tool that translates the Ethics Guidelines into an accessible and dynamic self-assessment checklist. The checklist can be used by developers and deployers of AI who want to implement the key requirements. This new list is available as a prototype web based tool and in PDF format; and, 
• Sectoral Considerations on the Policy and Investment Recommendations: recommendations have served as resources for policymaking initiatives taken by the Commission and its Member States. 

Then, in April 2021, the European Commission presented its “AI package,” which included:

• its Communication on fostering a European approach to AI;
• a review of the Coordinated Plan on Artificial Intelligence (with EU Member States);
• its proposal for a regulation laying down harmonised rules on AI (AI Act) and relevant Impact assessment.

The European Union (EU) “AI Act,” is the more commonly referred to name for the “Proposal for a Regulation Laying Down Harmonised Rules On Artificial Intelligence,” proposed by the European Commission on 21 April 2021. 

Broadly speaking, any AI system that is developed by an EU provider, wherever in the world it is deployed, as well as systems that are developed outside of the EU and put onto the EU market - are within the purview of the EU AI Act (meaning there are obligations that the AI system must comply with as required by the EU AI Act). 

The EU AI Act’s extraterritoriality - meaning its application outside of the European Union national borders - is expansive. The EU AI Act applies to AI systems that are developed and used outside of the EU, if the output of those systems is intended for use in the EU. 

Many AI providers and users based outside the EU, including those in the United States, will find their system outputs being used within the EU, and such entities will therefore, fall under the purview of the EU AI Act.

In the original text of the “Proposal for a Regulation Laying Down Harmonised Rules On Artificial Intelligence,” as written by the European Commission, there are four main categories of risk identified (as defined in Chapter II, Annex III), which identify enterprises that must comply with obligations per the EU AIA. The four levels of risk are defined as follows:

The EU AI Act uses a risk-based approach to regulation, which has different compliance obligations for AI systems based on their level of risk. The EU considers four levels of risk:

1. Minimal or no risk systems: These are systems that have minimal or no impact on individuals' rights, safety, or interests. These systems are subject to a set of light-touch transparency obligations.
2. Limited risk systems: These are systems that pose some risk to the rights, safety, or interests of individuals, but that risk is limited. These systems include those that (i) interact with humans, (ii) are used to detect emotions or determine association with (social) categories based on biometric data, or (iii) generate or manipulate content.These systems are subject to transparency obligations, but they may also need to undergo a conformity assessment before they can be placed on the market.
3. High-risk systems: These are systems that can significantly impact the rights, safety, or interests of individuals. These systems include those used in critical infrastructure, transport, and healthcare, as well as those used for law enforcement and border control.  These systems are subject to transparency, conformity assessment, and specific requirements related to data quality, fundamental rights, human oversight, and cybersecurity.
4. Unacceptable risk systems: These are systems that are prohibited by law, such as those that enable real-time remote biometrics in public spaces, social scoring, or the manipulation of individuals without their knowledge or consent.

In the most recent changes to the original European Commission text proposed by the European Parliament, the categorical risk was also proposed to be added to the Regulation, specifically that “foundation model providers” and “providers who specialize a foundation model into a generative AI system”  (as defined in the revisions proposed to Article 28b) would additionally be identified as categories of enterprises that must comply with obligations per the EU AIA.