Public Consultation on Implementation of AI Act

The Department of Enterprise, Trade and Employment (‘Department’) has announced a public consultation on the national implementation of the EU Artificial Intelligence Act (‘AI Act’). This follows its formal adoption by the Council of EU on 21 May 2024. Phased implementation of the AI Act will take place over a period of 36 months, with key provisions expected to be operational within 24 months.

Purpose of the AI Act

The AI Act is an EU regulation with direct effect. Its stated aim is to ensure that artificial intelligence (‘AI’) systems used in the EU are safe, transparent, traceable, non-discriminatory and environmentally friendly. It’s focus is on promoting trustworthy, human-centric AI to prevent harmful outcomes, while it looks to respect fundamental rights and EU values.

Risk Based Approach

The AI Act adopts a risk-based approach, defining four different risk classes, namely;

• Unacceptable-risk – AI systems which contravene EU values and are a clear threat to fundamental rights will be banned in the EU, for example, cognitive behavioural manipulation of people or specific vulnerable groups, social scoring that classifies people based on behaviour, socio-economic status or personal characteristics and biometric categorisation systems that use sensitive personal characteristics. There are limited exceptions to this outright ban, including for certain specified law enforcement purposes.

• High-risk – AI systems which pose significant potential harm to health, safety, fundamental rights, environment, democracy and the rule of law will require assessment before being placed on the market and throughout its lifecycle. Such systems include those used in products falling within EU product safety legislation, e.g. cars and medical devices and those falling into specific areas that will have to be registered in an EU database, e.g. management and operation of critical infrastructure and assistance in legal interpretation and application of the law. Obligations will include mandatory compliance, conformity assessments and fundamental rights impact assessments.

• Limited risk – AI systems classified as limited risk, for example chatbots and emotion recognition systems, will be subject to more minimal transparency obligations, such as informing users that they are interacting with an AI system and marking content as artificially generated.

• Minimal risk / no risk – all other AI systems not falling under one of the above three risk classes, such as AI spam filters, are classified as minimal/no-risk. The AI Act allows the unrestricted use of such systems. Voluntary codes of conduct are encouraged.

Enforcement

Monitoring and enforcement of the AI Act will take place at EU and Member State level. The Act will be primarily enforced through national competent market surveillance authorities in each Member State, while the European AI Office will be responsible for discharging the EU Commission’s duties under the AI Act in relation to the implementation, monitoring and supervision of AI systems. An AI Board, comprising Member States’ representatives, will act as an advisory body to the Commission while an AI Committee will also be established with responsibility for adopting EU Commission implementing acts.

Fines for violations of the AI Act will depend on the type of AI system, size of company and severity of infringement, with fines of up to €35 million or 7% of a company's total worldwide annual turnover (whichever is higher) permitted to be imposed.

Public Consultation

As noted, the AI Act requires Member States to provide for its supervision and enforcement. Member States must designate a Notifying Authority and Market Surveillance Authority and also establish a Regulatory Sandbox, providing a controlled and supervised environment for the testing of AI systems, in order to support innovation.

All competent authorities are required to be operational within 24 months. The public consultation published by the Department on 21 May seeks submissions on Ireland’s approach to implementing the AI Act, in particular on the configuration of national competent authorities required for implementation and potential synergies between the implementation of the AI Act and other EU regulations relating to digital markets and infrastructure.

Conclusion

The AI Act should serve to provide legal certainty for providers and users of AI, while also seeking to bring structure and control to reduce the associated risks. In the meantime, Ireland, and other Member States, will have to comply with a demanding timetable to ensure the AI Act is ready for implementation. The public consultation will close for submissions on 16 July 2024, after which further detail will be awaited on the establishment of effective structures to oversee enforcement of the AI Act in Ireland.