Akt o AI Evropské unie přináší řadu nových povinností

The European Union AI Act Introduces a Number of New Obligations

Artificial Intelligence ("AI") is currently having a significant impact in a wide range of areas, including the automotive industry, culture, education and healthcare. The ubiquity of AI and its impact on the daily lives of most of us is manifested, among other things, in its use by recommendation systems (e.g. Netflix, Spotify or YouTube), virtual assistants (e.g. Alexa or Siri) or generative and creative tools (e.g. AI Art, ChatGPT or DeepL).

The AI Act

In response to the growing importance of AI and the related growing concerns about the impact of AI on fundamental rights and freedoms in particular, the European Union ("EU") has drafted the Artificial Intelligence Act ("AI Act"), which is the world's first concrete initiative on AI regulation. The AI Act is a regulation, i.e. a legal standard of general application that is binding in its entirety and directly applicable in all EU Member States. In particular, the AI Act aims to ensure that the development, marketing, operation and use of AI are in line with EU values. Other objectives include promoting the deployment of trustworthy AI, ensuring a high level of protection of health, safety and fundamental rights as enshrined in the Charter of Fundamental Rights of the European Union, and promoting innovation.

Who is covered by the AI Act?

The AI Act defines those involved in AI quite broadly. In particular, AI system providers, users, importers, distributors and manufacturers of relevant products, both those established or located in the EU and those operating in a third country, will be liable if the output of the AI system is used in the EU.

What obligations does the AI Act bring?

Each entity should assess whether it is subject to the obligations under the AI Act, in particular whether it develops, produces or uses an AI system. These are defined by the AI Act as a "machine-based system designed to operate with varying levels of autonomy, that may  exhibit and which, once implemented, can exhibit adaptability and which, for explicit or implicit purposes, infers from the inputs received how to generate outputs such as predictions, content, recommendations or decisions that can affect physical or virtual environments".

Where the AI Act applies to a company, the company should assess the level of risk posed by a particular AI system. The AI Act distinguishes between four levels:

1. unacceptable risk (e.g., AI systems that exploit the vulnerabilities of specific groups of individuals, create social assessments primarily for public authorities, assess individuals' risk of committing a crime, or use real-time and publicly accessible remote biometric identification for law enforcement purposes, unless one of the enumerated exceptions applies) - such AI systems are prohibited;
2. high risk (AI systems that may have a negative impact on the health, safety, fundamental rights or the environment of individuals, either as a stand-alone product or as part of a product, e.g. in the area of critical infrastructure, education and training or law enforcement) - for such systems, the entity must ensure compliance with the requirements imposed by the AI Act for this category, i.e. in particular it must ensure appropriate data governance and management procedures, maintain sufficient technical documentation and register the relevant AI system in the EU database for high-risk AI systems;
3. limited risk (AI systems that may pose a risk of impersonation, e.g. chatbots, emotion recognition systems, biometric categorisation systems, or systems that generate deepfake content) - for such AI systems, the entity must ensure that users are aware that they are interacting with a machine and flag content as artificial or manipulated;
4. minimal risk (e.g. video games using AI or spam filters) - the AI Act does not (yet) attach any obligations to such AI systems.

After a careful assessment of the risk level to which a particular AI system belongs, the company should take the measures set out in the AI Act for that risk category. In particular, we recommend implementing an AI risk management system, training employees in the proper use and management of AI systems, maintaining sufficient documentation or identifying up-to-date information in this area. The development of a code of ethics in relation to AI systems also seems appropriate.

Penalties for non-compliance with the AI Act

Failure to comply with the procedures under the AI Act can result in significant penalties for legal entities. Administrative fines range from €7.5 million to €35 million or, if the offence is committed by a legal entity, from 1% to 7% of its total worldwide annual turnover for the preceding financial year, whichever is the greater.  

Effectiveness

The AI Act will be effective in its entirety from 2 August 2026. However, certain provisions will take effect earlier, for example, the provisions relating to AI systems that pose an unacceptable risk will take effect from 2 February 2025 and the provisions relating to high-risk AI systems will take effect from 2 August 2025.

Conclusion

The AI Act is an important milestone for the further development and use of AI systems. Despite the staggered commencement date from 2 February 2025 to 2 August 2026, we encourage all businesses to act now, in particular to assess whether they will be subject to the obligations of the AI Act and, if so, to consider the level of risk posed by a particular AI system and to take action in accordance with the provisions of the AI Act. It may also be appropriate to establish an AI risk management system, train staff, maintain sufficient documentation, gather up-to-date information in this area or develop a code of ethics in relation to the AI systems in question.

For further information or advice on the AI Act and related obligations, please contact the authors of this article or other members of the EY team with whom you work.

Authors:

David Hlaváček

Magdalena Hamáčková