The long-awaited European Union Artificial Intelligence Act (the AI Act) is nearing implementation following its adoption by the European Council this week (21 May 2024). This signals the completion of the final major stage of the European Union (EU) legislative process and the AI Act is expected to enter into force imminently. We considered the impact of this legislation in detail in our previous article: EU Artificial Intelligence Act — Final Form Legislation Endorsed by European Parliament.

The only remaining formalities are the signature of the President and Secretary-General of the European Parliament and Council and publication in the Official Journal, which is expected to happen in the coming days. The AI Act will enter into force 20 days after this takes place. The AI Act will become fully applicable 24 months after its entry into force (June 2026). However, some provisions will apply before that date.

• The ban on prohibited AI systems that are deemed to pose an unacceptable risk under the AI Act will apply from 6 months after it enters into force (December 2024).
• Provisions regulating general-purpose AI systems will apply after 12 months (June 2025).
• High-risk AI systems designated as high risk pursuant to Annex III (the specific list of AI technology set out by the European Commission) will be subject to the regulation 24 months after its entry into force (June 2026).
• High-risk systems categorised pursuant to Annex I (AI systems that are subject to existing EU health and safety legislation) will be subject to the provisions after 36 months (June 2027).

Businesses will need to assess their use of AI and its risk classification and prioritise accordingly. For example, some businesses that are subject to EU health and safety legislation listed in Annex I (such as toy manufacturers or medical device companies), which will have a three-year implementation period, may also be using AI in their HR systems, which may fall within the Annex III categories and will have a shorter implementation timeline of two years.

Many of the obligations under the AI Act are drafted in relatively high-level terms that are open to different interpretations. The European Commission will develop guidelines on the practical implementation of the AI Act, particularly in relation to some of the key requirements relating to prohibited and high-risk AI systems, as well as guidelines for how the AI Act inter-relates with other EU legislation and enforcement practice.

Each Member State will designate at least one notifying authority and at least one market surveillance authority as “national competent authorities” for the purpose of supervising the application and implementation of the AI Act. These bodies must be formed within 12 months and will work closely with the recently established EU AI Office. The AI Office will facilitate the drawing up of codes of practice which must be in place no later than 9 months after the AI Act enters into force (and can request that the Commission updates its guidance as and when required).

However, whilst some of this guidance is designated as urgent – for example, guidance relating to serious incidents must be in place within the first 12 months – general guidance is likely to take longer to develop. Businesses should be aware that some of the provisions of the AI Act may apply before this guidance becomes available and, as a result, they will need to form an independent view on any action that may need to be taken, in line with emerging industry practice.

This adoption marks the final step in the implementation of the most comprehensive piece of legislation in the regulation of AI globally, and its extraterritorial effect will impact businesses beyond the borders of the EU. We will continue to monitor the final stages of the AI Act before its entry into force.