What should those in the UK, US and outside the EU know about the EU AI Act?

The text of the EU AI Act has been agreed. We summarise below the impact it will have on those in the UK, US and outside the EU. 

• The EU AI Act applies to those outside the EU. That includes providers of AI systems that are put into service, placed on the market, or used in the EU, and also deployers of AI systems in the EU. Those definitions aren’t dependent upon whether the entity is located inside or outside the EU. 

• The EU AI Act also explicitly states that it applies to those outside the EU: 
  • it will apply to providers of AI systems in a non-discriminatory manner whether the provider is established within the EU or in a third country (see Recital 21 of the EU AI Act); and
  • “To prevent the circumvention of this Regulation and to ensure an effective protection of natural persons located in the Union, this Regulation should also apply to providers and deployers of AI systems that are established in a third country, to the extent the output produced by those systems is intended to be used in the Union.” (see Recital 22 of the EU AI Act).

• The Act applies to AI systems and general purpose AI systems. Neither definition takes the provider or deployer’s location into account. For example, an AI System is defined in the EU AI Act as “a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” (Article 3(1) of the EU AI Act). 

• Given the wide reaching extra territorial effect of the EU AI Act, some commentators believe that it may set a baseline for other countries considering how to regulate AI. 

• The EU AI Act also applies indirectly to those outside the EU. The AI Act affects multiple actors along the AI value chain – providers, deployers, third parties, product manufacturers, distributors and more. It is possible that one or more has to, or chooses to, adapt to the EU AI Act, impacting others along the AI value chain.

• It may also become the baseline for companies seeking to self-regulate use of AI which they procure, develop and deploy.  To avoid having to administrate and incur the cost of different “versions” of an AI system based upon jurisdiction of the “end user” it may be that the EU AI Act is the general regulatory standard that is adhered to by those deploying, providing or otherwise importing an AI system. 

If you have any questions or would otherwise like to discuss any of the issues raised in this article, please contact David Varney, Tom Whittaker, Liz Smith, or another member of our Technology Team. For the latest updates on AI law, regulation, and governance, see our AI blog at: AI: Burges Salmon blog (burges-salmon.com)