EU AI Act Summary: Key Points and Implications

The EU AI Act is an extensive piece of legislation. For any business leader, starting off with an EU AI Act summary is a good place to understand its broad strokes. It also helps understand its goals and the regulations it lays down for the ethical use of AI.

AI has been one of the most revolutionary technological innovations. It offers immense potential to simplify our lives in more ways than one. However, it also comes with its share of ethical and legal implications. This is because of the various instances of the misuse of AI.

The EU AI Act lists AI regulations for business. It aims to lay down a set of rules that curb the misuse of this technology.

This guide covers all the key points in the act and their various implications. It will help you make an informed decision about how you use AI. It also covers Tor.app, which offers a comprehensive suite of business tools that fully comply with this act. They offer the best workflow solutions without compromising privacy and data security.

What is the EU AI Act, and Why Was it Introduced?

The AI Act (Regulation (EU) 2024/1689) provides guidelines for AI developers and deployers. Its focus is on the ethical use of the technology and lists its obligations and requirements with specific uses of AI.

According to a report on the European Parliament's official website, the regulation was endorsed by MEPs with 523 votes in favor, 46 against, and 49 abstentions.

Reference: European Parliament

EU AI Act compliance also aims to reduce financial and administrative burdens, particularly for small and medium-sized enterprises. The overarching goal is to ensure the fundamental rights of people and businesses regarding the use of AI.

For AI governance under EU regulation, the act also prohibits specific AI uses that deploy manipulative or deceptive techniques or practice social scoring. It also prohibits exploiting vulnerabilities of certain societal groups and individual profiling.

The AI Act Explorer on the official EU Artificial Intelligence Act website offers a complete breakdown of the legislation, so you can also refer to any relevant section.

Goals of the EU AI Act for Responsible AI Use

The EU aims to ensure a balance between innovation and the emerging risks of AI. The objectives of the act include:

1. Ensuring AI systems in the EU respect public rights and values
2. Providing legal certainty to help facilitate investment in AI technology
3. Improving governance and the effective enforcement of ethics and safety requirements
4. Developing a single AI market in the EU by ensuring the safe and ethical use of the technology

An AI Office within the Commission must be established to enforce the act. The office monitors how effectively General Purpose Artificial Intelligence (GPAI) providers implement its regulations. Additionally, downstream providers can complain to upstream providers in the event of an infringement.

The AI Office can also evaluate GPAI models to request information or investigate systemic risks following a report by a panel of independent experts.

Key Points of the EU AI Act

The EU AI Act has several key points that address various concerns about AI use. The sections below describe these in greater detail.

Risk-Based Classification of AI Systems

The EU AI Act risk-based classification consists of four tiers:

1. Unacceptable Risk: Models that pose an unacceptable risk are prohibited. Examples include behavioral manipulation, exploiting vulnerable people, social scoring by public authorities, and so on.
2. High Risk: High-risk systems are subject to conformity assessment. These models pose a high risk to health, safety, fundamentals, and environmental rights. A few key examples include:
   • Models that evaluate the eligibility of health or life insurance
   • Analyses of job applications
   • Product safety components.
3. Limited Risk: Models with limited risks are subject to a transparency obligation. These typically carry the risk of impersonation or deception. Examples include AI systems that interact with consumers or generative AI systems that generate manipulated content.
4. Minimal Risk: Models that post minimal risk have no obligations. Examples include AI-enabled video games and spam filters.

Businesses must complete a compliance assessment before using AI models in their workflows. This also applies to businesses using GPAI models in banking, education, etc. Providers of these GPAI models must provide technical documentation about the training and testing process and establish a policy to respect the Copyright Directive.

They must also provide downstream suppliers with information and documentation to ensure effective compliance with the act. Lastly, they should publish a detailed summary of the content used to train the GPAI model.

Transparency and Accountability Standards

The transparency obligations laid out for AI models with limited risk involve informing users that they interact with AI. The goal is to foster a culture of trust. Think of when a human being is interacting with a chatbot. The transparency obligations require informing them that they interact with AI, not humans.

This helps the user decide whether or not to continue. It also requires making AI-generated content identifiable, especially for content issued in the public interest.

In terms of other regulations globally, the US has passed nine bills related to AI. Among these are the National Artificial Intelligence Initiative Act of 2020, the AI in Government Act, and the Advancing American AI Act.

Reference: European Parliament

Several bills are introduced in every Congress, but very few pass. In fact, as of November 2023, 33 legislative pieces were pending US lawmakers' consideration.

Reference: New England Council

President Biden also issued an executive order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. Like the EU AI Act, it requires major AI developers to share the results of their safety tests with the US government. It also aims to protect US citizens from the malicious use of AI, such as for fraud and deception.

Implications of the EU AI Act for Business Automation

The EU AI Act's implications for automation will seriously impact business operations. In fact, the act has set out clear definitions for all the parties involved with AI, including providers, deployers, importers, product manufacturers, and distributors.

As a result, all parties involved in using, distributing, developing, and manufacturing AI systems will be held accountable.

Further, all parties must refer to the detailed implementation timeline to understand how and when they must comply with the act's requirements.

Businesses can comply with the act by defining a policy to identify the risk levels of AI models and prioritizing and managing these risks. Additionally, they should manage stakeholder expectations and ensure transparent communication.

Other steps include setting up sustainable data management practices and testing AI systems to ensure they operate as intended. Lastly, they must automate the system management and evaluation processes and train employees on the ethics of using AI.

In one of its reports, Deloitte examined the impact of the act via a fictional case study to offer a practical example of how it will be implemented. It focused on two global organizations operating in the EU, one of which is CleverBank. It uses an AI-powered loan approval system with a GPAI model from DataMeld, a US-based company that offers its AI models in the EU.

CleverBank would be regulated as a downstream AI provider and an AI deployer. To comply with the act, it will have to complete a conformity test of its AI models against the act’s high-risk assessments, register the system in the EU database, and confirm that its training data is complete and relevant for its intended purpose in the EU.

Impact on Automated Decision-Making and RPA

AI governance under EU regulations will also impact automated decision-making. The regulation lists eight uses of AI, particularly in financial institutions. These include AI systems that use subliminal, manipulative, or deceptive techniques to impair decision-making and certain biometric and facial recognition uses. It also includes systems that classify individuals based on personality and behavioral traits and those that infer emotions in the first place.

The EU regulations on Robotic Process Automation will also ensure businesses gather data transparently.

How Tor.app Supports Privacy in AI-Regulated Environments

This product suite offers a whole suite of workflow automation tools for businesses. It is one of many products that comply with the EU AI Act, among other enterprise-grade standards. It uses the power of AI to streamline content creation, transcription, converting text to speech, and more. The EU AI Act for workflow automation also guarantees the safety of this suite of products.

All the tools in its suite comply with enterprise-grade security mechanisms, including SOC 2 and GDPR standards. This ensures that your data is always protected and eliminates the risk of misuse.

Anonymity and Data Security Benefits with Tor.app

Like many other apps, it complies with data security standards that ensure complete anonymity. In addition to the two regulations above, it also complies with HIPAA, protecting medical information at all times.

The data security benefits ensure businesses can use minimal-risk automation tools without compromising organizational data and personal customer information.

Compliance Steps Businesses Should Consider Under the EU AI Act

Ensuring AU AI Act compliance involves a two-step process, one for the short term and the other for the long term. In the short term, businesses must define the appropriate governance for using AI. This involves:

1. Determining how to categorize businesses' AI systems based on the risks outlined in the act.
2. Communicating the use of AI with all stakeholders, including customers and partners.
3. Setting up sustainable data governance mechanisms that ensure long-term privacy, quality, and security.

The next step is to understand the risks AI presents. Here is what businesses can do:

1. Understand the internal and external risks of the use of AI systems.
2. Categorize these risks to identify those with a higher risk component. This will ensure compliance with the obligations under the act.
3. Conduct a thorough gap analysis to understand areas where systems do not comply with the act.
4. Define a comprehensive third-party risk management process. This will ensure that AI use is in compliance with the regulations under the act.

Thirdly, businesses should also initiate actions that require scaling over time. Here is what this includes:

1. Optimize and automate AI system management processes to ensure the models used are transparent and trustworthy.
2. Ensure comprehensive documentation of compliance with the act.
3. Train employees on how to use AI ethically and to handle new responsibilities with the use of AI.

Besides these short-term measures, there are certain things businesses must do in the long term. These include:

1. Anticipate the long-term impact of the regulation on the business and build trust among customers through AI transparency standards. They must also strategize how to align business practices with the regulations.
2. Prioritize long-term investments in educating all internal and external stakeholders on the ethics of AI and governance.
3. Incorporate trusted AI models in innovation and ensure the highest data privacy and security standards at every stage.

According to Dasha Simons, IBM's Managing Consultant of Trustworthy AI, businesses will need to approach their use of AI strategically. The C-suite will also need to be heavily involved in this conversation.

Besides these, businesses should also be aware of the financial penalties for non-compliance. These include:

1. Fines of up to €35 million or about 7% of the company's worldwide annual turnover for violating Article 5. This relates to the violation of prohibited AI practices.
2. Fines of up to €15 million or 3% of the annual turnover for non-compliance with AI obligations.
3. Fines of up to €7.5 million or 1% of annual turnover for providing false information.

In addition to the financial penalties that can be imposed, businesses could also face reputational damage. This could result from erasing customer trust, business partnerships, and competitiveness.

Identifying High-Risk Systems

The first step to ensuring compliance with the EU AI Act is identifying high-risk AI systems. According to the Act, high-risk systems that are prohibited are those that:

1. Deploy “subliminal, deceptive, and manipulative systems” to distort user behavior and impair decision-making.
2. Evaluate and classify individuals based on social behavior or personal traits. This results in their unfavorable treatment, also known as social scoring.
3. Compiling facial recognition database by scraping images available off the internet.
4. Real-time biometric identification (RBI) in publicly accessible spaces. The exceptions to this include searching for missing persons or victims, preventing threats to life, and identifying suspects involved in serious crimes.
5. Exploiting age, group, or other related vulnerabilities to distort behavior.

Developing Documentation Protocols

Businesses must also develop a comprehensive documentation process to identify the use of high-risk AI systems. They need to ensure that AI systems completely comply with the regulations laid down in the EU AI Act. The documentation should also cover any high-risk AI systems a business has identified. Other aspects are strategies to ensure greater transparency.

Benefits and Challenges of Adhering to the EU AI Act

Adhering to the EU AI Act comes with its benefits and challenges. This is the case with any new regulation. Some of the benefits include:

• Greater Trust: Users can be more confident that the AI systems they use comply with the regulations under the Act.
• Reduced Costs: Businesses will have easier access to European AI solutions that are already in compliance with the act. As a result, they can reduce the cost of finding the right solution.
• Greater Data Protection: The alignment of the EU AI Act with the General Data Protection Regulation (GDPR) ensures the highest data protection standards.

On the flip side, some of the challenges of this act include:

• Higher Prices: AI solutions in compliance with the act may cost more than others. This is especially true if they originate outside the EU.
• Reduced Functionality: AI regulations may eliminate certain AI features, reducing functionality for internal and external stakeholders.
• Potentially Reduced Innovation: The stricter regulations could come at the cost of innovation. Regions with less or no regulations may take over the innovation race.

Long-Term Benefits for Trust and Ethics

According to Statista, only a quarter of US adults trusted AI to provide them with accurate information. The exact number trusted it to make ethical and unbiased decisions. Even when examined globally, this figure shows the scale of the distrust in AI.

Reference: Statista

The EU AI Act aims to reduce this distrust and ensure greater transparency in how businesses use AI. It also focuses on the data they collect to ensure the highest security standards.

In the long term, compliance with these regulations will ensure greater trust in businesses. It will also ensure that AI is used ethically and its misuse is curbed.

Conclusion

The EU AI Act is the most comprehensive set of regulations. It seeks to govern the use of AI systems within the European Union. It ensures AI accountability in the EU. It classifies systems based on their risks and lists regulations for each category.

Going forward, businesses must ensure compliance with the regulations in the act. They must also ensure transparency and the highest data security and privacy standards.

For those looking for a tool that already complies with the highest AI regulations you should check out Tor.app. It offers a comprehensive workflow automation tool that maximizes efficiency and profitability.