Agreement reached on the "AI Act"

By reaching agreement on the European AI Regulation ("EU AI Act"), the European Union has successfully played a leading role in shaping how the world deals with artificial intelligence (AI). At the EU level, the aim is to create a comprehensive regulatory framework for the use of AI with a view to ensuring that the use of AI is safe, fundamental rights are protected and innovation is promoted. The key points of regulation in the "EU AI Act" are as follows:

  • If it concerns a high-risk AI system (for instance, one relating to the administration of justice, education, etc.), its providers are required to carry out a Fundamental Rights Impact Assessment ("FRIA"), which assesses the intended use and geographical and temporal scope of the AI system (this also applies to the banking and insurance sectors).
  • In addition, persons affected by high-risk AI systems have a comprehensive right to lodge a complaint and a right to information about AI decisions.
  • Law enforcement authorities will largely be restricted in their use of biometric identification systems in public spaces. Exceptions require judicial authorisation and are limited in scope to the prosecution of specific serious criminal offences (there is an exhaustive list of relevant offences) or to combating terrorist threats.
  • The following are expressly prohibited: biometric categorisation systems using sensitive characteristics, social scoring based on social behaviour or personal characteristics, the untargeted scraping of facial images, as well as AI systems that manipulate human behaviour or exploit vulnerabilities.
  • "Regulatory sandboxes" are being promoted, and only simple transparency criteria need be adhered to in the case of AI systems that pose a minimal risk.
  • General-purpose AI ("GPAI") must meet certain transparency requirements, including requirements relating to technical documentation and compliance with EU copyright law.
  • Fines for non-compliance: Depending on the respective infringement and the size of the company, fines of EUR 7.5 million or 1.5% of turnover up to EUR 35 million or 7% of worldwide turnover are provided for in the draft regulation.


At present, there is still no final draft and the regulation has yet to be formally adopted by the Member States. Subsequently, some provisions will become applicable in a phased manner due to planned implementation periods; however, all regulatory requirements must be met within 24 months of the EU AI Act entering into force.