When does the Act come into force?
The EU AI Act enters into force from 1stAugust 2024, however it’s tiered compliance obligations will take effect in stages over several years. For instance, organizations must comply with EU AI Act prohibitions within six months (2nd February 2025) and ensure they are compliant with most GPAI obligations within one year (2nd August 2025). Organizations must meet most other obligations within two years (2nd August 2026).
What are the penalties for non-compliance?
The penalties are significant. A company may be fined up to €35 million or 7% of its worldwide annual turnover (revenue), whichever is higher, for breaching prohibited AI system requirements. Non-compliance with high-risk AI system requirements could result in a fine of up to €15 million or 3% of worldwide annual turnover, again depending on which is greatest. Supplying incorrect or misleading information to regulators could result in a fine of up to €7.5 million or 1% of worldwide annual turnover.
It is useful to note that most AI systems already on the market (other than prohibited ones) will not have to retroactively comply, unless they have been subject to substantial modification after the dates of application.
What should you do to prepare for the Act?
Consider the following actions:
1. Create an inventory of all the AI systems you have – or plan to have – and determine whether any fall within the scope of the EU AI Act.
2. Assess and categorize the in-scope AI systems to determine their risk classification and identify the applicable compliance requirements.
3. Understand your organization’s position in the relevant AI value chains, the associated compliance obligations and how these will be met. Embed compliance within all responsible functions along the value chain, throughout the lifecycle of the AI system.
4. Consider what other questions, risks and opportunities the EU AI Act poses to your operations and strategy.
- Risks include interaction with other EU or non-EU regulations, including those on data privacy.
- Opportunities could involve access to AI research and development channels. The EU is, for example, establishing “sandboxes” where innovators, small-and-medium-sized enterprises, and others can choose to experiment, test, train and validate their systems under regulatory supervision before taking them to market.
5. Develop and execute a plan to ensure that the appropriate accountability and governance frameworks, risk management and control systems, quality management, monitoring and documentation are in place when the Act comes into force.