The EU AI Act

MAR 13 2024 · 12:00

The European Parliament hemicycle in Strasbourg, where the EU AI Act was approved on 13 March 2024. Place: European Parliament, Strasbourg; Council of the European Union, Brussels Figures: Dragoș Tudorache, Romanian MEP, co-rapporteur · Brando Benifei, Italian MEP, co-rapporteur · Margrethe Vestager, Commission Executive Vice-President · the OpenAI, Anthropic, Google and Meta lobbyists, all newly resident in Brussels Risk-Tiered Sovereignty On 13 March 2024 the European Parliament approves Regulation (EU) 2024/1689, the Artificial Intelligence Act, by 523 votes to 46. It enters into force on 1 August 2024 with staged application: prohibitions from February 2025, obligations for general-purpose AI models from August 2025, the full risk-tiered regime by August 2026. The Act is the first comprehensive AI regulation by a major Westphalian polity, drafted across three years of trilogue, transformed in late 2022 by the arrival of ChatGPT, which a regulation begun in 2021 had not anticipated. The architecture is risk-tiered. Unacceptable risk uses (social scoring, untargeted scraping of facial images, real-time biometric identification in public spaces with narrow law-enforcement exceptions, emotion recognition in workplaces and schools) are prohibited outright. High-risk uses (in employment, education, critical infrastructure, migration, judicial administration) require conformity assessments before deployment. General-purpose models above a compute threshold of 10^25 floating-point operations face transparency, safety-evaluation and systemic-risk obligations. The Brussels Effect on a Stateless Stack The Act's jurisdictional reach is the heart of the matter. Article 2 extends it to providers and deployers established outside the Union whenever the output of the AI system is used inside the Union. Almost every frontier model trained in San Francisco, Mountain View or Hangzhou is, by that test, in scope. The Union's regulatory sovereignty extends, by writing, into the development practices of laboratories in jurisdictions that did not consent to it. The same Brussels effect that GDPR achieved for data protection in 2018 is now claimed for the foundation-model stack. Whether it works is the open question. The largest model developers are American or Chinese; the largest compute is American or Chinese; the export of US chips is regulated by the US Department of Commerce, not by Brussels. The Act is the clearest current example of a Westphalian polity attempting to project regulatory sovereignty over a technology whose development is extraterritorial, and on a substrate (matrix multiplication on accelerators) that does not respect any border. The next two years will be a tutorial in how much of that projection compiles. Video: France 24 coverage of the European Parliament vote on the AI Act in Strasbourg, 13 March 2024. The world's first comprehensive statutory framework for artificial intelligence, passed 523 to 46.