The EU AI Act is here - What you need to know and what to do next

Risk Category

Description

Key requirements

Relevant AI systems

No or minimal risk

AI systems not caught by any of the below risk categories

Not subject to the AI Act, however compliance with voluntary AI codes of conduct is encouraged.

For example, AI systems used for spam filtering.

Limited risk

AI systems deemed to pose a limited risk, but which must be operated transparently

Transparency obligations vary depending on the AI system, but generally providers / deployers must ensure that there is transparency as to the fact that the interaction, content, decision, output etc is created by AI.

Subject to defined limited exceptions, AI systems used or intended to be used:

• to directly interact with people (e.g. chatbots);
• to generate synthetic audio, image, video, or text content (including GPAI);
• for emotion recognition or biometric categorisation;
• to generate or manipulate image, audio or video content as "deep fakes"; and
• for text generation / manipulation which publish text to inform the public on public interest matters.

Where a AI system is subject to transparency obligations but also falls within the high-risk category as outlined below, such transparency obligations continue to apply in addition to any specific high-risk requirements.

High Risk

AI systems that are specifically listed as high risk in the AI Act – broadly these are systems that create a high risk to the health and safety or fundamental rights of people

High-risk AI systems are subject to comprehensive compliance requirements, covering seven main areas:

1. risk management systems – a risk management system is required to be "established, implemented, documented and maintained" for high-risk AI systems. The risk management system is to be developed iteratively and needs to be planned and run throughout the entire lifecycle of the system and will be subject to systematic review and updates;

2. data governance and management practices – training, validation and testing data sets for high-risk AI systems must be subject to appropriate data governance and management practices, with the AI Act setting out specific practices which must be considered, including data collection processes and appropriate measures to detect, prevent and mitigate biases;

3. technical documentation – a requirement to draw up relevant technical documentation for a high-risk AI system before it is placed on the market or "put into service" (i.e. installed for use) and that should be kept up to date;

4. record keeping / logging – high-risk AI systems must "technically allow for" automatic logs to be recorded over the lifetime of the system in order to ensure a level of traceability of the system's functioning appropriate to the intended purpose of the system;

5. transparency / provision of information to deployers – high-risk AI systems must be designed and developed to ensure sufficient transparency in order to allow deployers to interpret the output from such systems and use it appropriately. Any instructions for use must be provided in a format which is appropriate to the AI system;

6. human oversight – "natural persons" must oversee high-risk AI systems, with a view to preventing or minimising the risks to health, safety or the fundamental freedoms that may arise from use of such systems; and

7. accuracy, robustness and cybersecurity – high-risk AI systems are required to be designed and developed to achieve an appropriate level of accuracy, robustness and cyber security and to perform in accordance with these levels throughout their lifecycle.

Certain operators of high-risk AI systems are subject to additional obligations, as set out in section 6 below. 

Subject to defined exceptions and except as prohibited below AI systems used or intended to be used:

• as a safety component of a product/or the AI system itself is a safety product regulated by certain EU legislation listed in the AI Act and (in each case) is required to undergo a conformity assessment before being placed on the market in the EU;

• for (i) remote biometric identification (other than where the sole purpose is ID verification), (ii) biometric categorisation according to sensitive or protected attributes or (iii) emotion recognition;

• as safety components in the management and operation of critical digital infrastructure road traffic and the supply of water, gas, heating and electricity;

• in education and vocational training for admissions, evaluation of learning outcomes, assessing the appropriate level of education to be received by a student and monitoring and detecting prohibited student behaviour in testing environments;

• in employment in respect of decisions on recruitment, "work related relationship", promotions, contract terminations, task allocation and monitoring or evaluating performance and behaviour;

• to make decisions which affect access to essential public and private services and benefits in defined area including credit scoring or risk assessment for insurance;

• in certain law enforcement contexts including polygraphs, evidence assessment and re-offending risk assessment;

• in migration, asylum and border control management including to assist with examination of visa / asylum applications; and

• for the administration of justice and democratic processes including to assist judiciary with fact / law interpretation and application, or intended for use to influence outcome of an election or referendum.

Unacceptable risk - prohibited AI systems

AI systems that present a threat to people - as specifically defined in Article 5 of the AI Act

All such AI systems are banned under the AI Act.

Subject to limited, defined exceptions, AI systems that:

• deploy subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques (in each case) which distort human behaviour to circumvent free will;

• exploit vulnerable groups (e.g. children) in order to materially distort behaviour in a way that is reasonably likely to cause harm to a person;

• categorise people based on their biometric data to deduce or infer race, political opinions, religious or philosophical beliefs or other specific defined matters, except in respect of the labelling or filtering of lawfully acquired biometric datasets, such as images, in law enforcement;

• evaluate or classify people based on social behaviour or known, inferred or predicted characteristics creating a "social score" which leads to specific defined detrimental / unfavourable treatment

• use "real-time" biometric identification in public for law enforcement purposes (subject to narrow exceptions, such as targeted searches for missing / abducted persons and preventing terrorist attacks);

• assess or predict the risk of people carrying out crimes based on profiling or personality trait / characteristic assessments;

• create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV; and

• enable emotion recognition in the workplace or educational institutions, except for medical or safety reasons.