European Parliament Adopts the EU AI Act in Landmark Vote

The regulation sets obligations for AI based on its potential risks and level of impact. The Parliament says it aims to protect fundamental rights, democracy, the rule of law and environmental sustainability from high-risk AI while boosting innovation.

What the rules require

The Act bans certain AI applications that threaten citizens' rights, including biometric categorisation systems based on sensitive characteristics and the untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases. The use of remote biometric identification by law enforcement is prohibited in principle, except in exhaustively listed and narrowly defined situations subject to strict safeguards.

High-risk AI systems, such as those used in critical infrastructure, education and vocational training, employment and other sensitive areas, will face clear obligations, including duties to assess and reduce risks, maintain use logs, be transparent and accurate, and ensure human oversight. Citizens will have the right to submit complaints about AI systems and to receive explanations of decisions based on high-risk AI that affect their rights. General-purpose AI systems and the models they are based on must meet transparency requirements, including compliance with EU copyright law and publication of detailed summaries of the content used for training, while the most powerful models that could pose systemic risks face additional requirements such as model evaluations and incident reporting. Deepfakes will need to be clearly labelled.

Timeline

The text, which was debated on 12 March and voted on 13 March, is still subject to a final lawyer-linguist check and must be formally endorsed by the Council. The Act will enter into force twenty days after publication in the Official Journal and will be fully applicable 24 months later, with staggered exceptions: bans on prohibited practices will apply after six months, codes of practice after nine months, general-purpose AI rules including governance after 12 months, and obligations for certain high-risk systems after 36 months.

Who is affected

The obligations fall on organisations that develop AI systems and on those that use them in the EU, from technology providers to employers, banks and public bodies relying on AI in sensitive decisions. Businesses developing or buying AI tools should start mapping their use cases against the prohibited and high-risk categories, since the first obligations will bite within months of entry into force.

Sources

• European Parliament: Artificial Intelligence Act, MEPs adopt landmark law
• European Parliament: Artificial Intelligence Act, Parliament to adopt landmark law