Regulation IA

Last update: 09/12/2024

The EU’s European AI Regulation is the world’s first comprehensive AI law. It aims to mitigate the significant negative impact of AI on health, safety and fundamental rights. With this regulation, as already happened with the Data Protection Regulation, the European Union is positioning itself as a world leader in digital rights, but now in a new area: artificial intelligence.

The regulation introduces a uniform framework in all EU countries, based on a forward-looking definition of artificial intelligence and a risk-based approach, regulating the uses of technology, but not the technology itself.

This regulatory framework will apply to both public and private actors within and outside the EU, insofar as the AI system is introduced into the EU market or its use affects persons established in the EU.

Artificial intelligence systems designed exclusively for military, defence or national security purposes, as well as research, development and prototype activities that take place before the commercialisation of an artificial intelligence system, do not fall within the scope of this Regulation.

The AI Regulation states:

  • Harmonised rules for the placing on the market, implementation and use of artificial intelligence systems in the EU
  • Bans on certain AI practices in the Union environment.
  • Specific requirements for high-risk AI systems and obligations for operators of such systems.
  • Normas armonizadas de transparencia aplicables a determinados sistemas de IA de riesgo limitado.
  • Harmonised rules for the introduction into the market of general-purpose AI models, whether of systemic risk or not.
  • Rules on market monitoring, market surveillance, governance and a number of compliance guarantees.
  • For the first time, a European regulation also introduces measures to support innovation, paying special attention to SMEs, including start-ups or startups.

It shall apply to:

  • Los suppliers to bring on the market or put into service AI systems or AI models of general use in the EU, irrespective of whether or not they are established in the EU or in a third state.
  • Los responsible for deployment of AI systems that are established or located in the EU or when the output results generated by the AI system are used in the Union.
  • Los importers and distributors of AI systems.
  • Los product manufacturers that they place on the market or put into service an AI system together with their product and with their own name or brand.
  • Los authorised representatives of suppliers that are not established in the Union.
  • Las affected personthey are located in the Union.

Pyramid of Risks AI Regulation

The Regulation establishes some risk levels based on AI use And, on the detected categories, it establishes a series of obligations.

The regulation bans some uses of AI systems because they pose an unacceptable risk to the Union. This is a very limited set of particularly harmful uses that are contrary to EU values because they infringe fundamental rights and seriously affect people's health or safety. These uses are:

  • Deployment of subliminal, manipulative or misleading techniques to distort behaviour and impair informed decision-making, causing significant harm.
  • Exploit the vulnerabilities Related to age, disability, or socioeconomic circumstances to distort behavior, causing significant harm.
  • Biometric categorization systems inferring sensitive attributes (race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation), except the labelling or filtering of biometric data sets acquired legally or when security forces categorize biometric data.
  • Social scorethat is, evaluating or classifying individuals or groups on the basis of social behaviours or personal traits, causing harmful or unfavourable treatment to such persons.
  • Assess the risk of an individual committing criminal offencess relying solely on profiles or personality traits, except when used to augment human assessments based on objective and verifiable facts directly related to criminal activity.
  • Compilation of facial recognition databases by non-selective scraping of Internet facial images or CCTV recordings.
  • Inurture emotions in workplaces or educational centersexcept for medical or safety reasons.
  • “Real-time” remote biometric identification in public spaces for law enforcement except in:
    • search for missing persons, victims of kidnappings and victims of human trafficking or sexual exploitation;
    • prevent a substantial and imminent threat to life, or a foreseeable terrorist attack; or
    • Identify suspects of serious crimes (e.g. murder, rape, armed robbery, drug trafficking and illegal weapons, organized crime and environmental crimes, etc. ).

The Commission will publish guidelines on bans before their entry into force on 2 February 2025.

Most of the regulation is focused on regulating high-risk AI systems, also known as HRAIS (High Risk AI Systems), which may harm the health, safety or fundamental rights of individuals, as contained in the EU Charter of Fundamental Rights. They are divided into two categories:

  1. The safety components of the products covered by the sectoral legislation of the Union where they are subject to an assessment of the third-party compliance pursuant to that sectoral legislation, as set out in Annex I to the IA Regulation.
  2. AI systems belonging to eight specific areas, listed in Annex III of the AI Regulation, which are:
    • Non-prohibited biometrics: Systems of biometric identification At a distance, excluding biometric verification that confirms that a person is says to be. Sistemas de categorización biométrica que infieren atributos o características sensibles o protegidos. Systems of Recognition of emotions.
    • Critical infrastructures: Safety components in the Management and operation of critical digital infrastructures, road traffic and supply of water, gas, heating and electricity.
    • Vocational education and training: AI systems that determine the access, admission or allocation To educational and training institutions for professionals at all levels. Evaluation of learning outcomes, including those used to direct the learner’s learning process. Assess the level of education Suitable for an individual. Supervision and Detection of prohibited behaviors of the students during the exams.
    • Employment, management of workers and access to self-employment: AI systems used for the recruitment o selection, in particular specific job advertisements, analysis and filtering of applications, and evaluation of candidates. Promotion and termination of contracts, assignment of tasks according to personality traits or characteristics and behaviour, and monitoring and evaluation of performance.
    • Access to and enjoyment of essential public and private services: AI systems used by public authorities to assess the right to benefits and services, including their allocation, reduction, revocation or recovery. Assessment of solvency, except for detecting financial fraud. Evaluation and classification of emergency calls, including prioritizing shipments from police, firefighters, medical care and urgent patient triage services. Evaluation of risks and pricing of Health and life insurance.
    • Application of the law: AI systems used to evaluate the risk from a person to become victim of a crime. Polygraphs. Evaluation of the reliability of the tests during investigations or criminal proceedings. Risk assessment of delinquency or recidivism of a person not solely based on profiling or in the assessment of previous personality traits or criminal behaviour. Elaboration of profiles during detections, investigations or criminal prosecutions.
    • Management of migration, asylum and border control: Polygraphs. Evaluations of irregular migration or health risks. Examination of applications for asylum, visas and residence permitsand claims relating to admissibility. Detection, Recognition or identification of persons, except verification of travel documents.
    • Jurisdictional activity and democratic processes: AI systems used in the Investigation and interpretation of facts and in the application of the law to specific acts or acts used in the Alternative conflict resolution. Influence in election results and referendums or electoral behaviour, excluding products that do not interact directly with people, such as the tools used to organise, optimise and structure political campaigns.

    3. High-risk systems must meet certain requirements and specific obligations are imposed on both suppliers and those responsible for deploying the systems.

For certain artificial intelligence systems, such as when there is a clear risk of manipulation, for example, through the use of conversational robots) or ultra-massification, the AI Regulation establishes specific transparency obligations so that users are aware that they are interacting with a machine.

Most other artificial intelligence systems can be programmed and used in accordance with existing legislation, without additional legal obligations. On a voluntary basis, providers of these systems may choose to apply the requirements of artificial intelligence voluntarily and adhere to voluntary codes of conduct. Examples of these are AI applications in video games, or spam filters for email.

The regulation imposes a number of obligations that high-risk AI systems must meet:

Risk Management System

The provider of a high-risk AI system must establish, implement, document and maintain a risk management system. Threats will be identified and assessed, mitigation measures will be taken, and their effects will be monitored, in a continuous improvement cycle that will last throughout the system’s life cycle.

Data and Data Governance

High-risk AI systems that use model training techniques with data will be developed from training, validation and testing datasets that will be subject to appropriate governance and data management practices. Among these practices, the following stand out:

  • Choosing a proper design.
  • Adopt the adequate collection processes of data.
  • Timely data processing operations, such as annotation, labeling, debugging, enrichment and aggregation.
  • Analysis and purification of the possible ones biases.
  • Prior evaluation of Availability, quantity and adequacy of the datasets necessary.

Technical documentation

The suppliers must providing users and authorities with technical documentation of the AI system. The documentation will show that the requirements of the regulation we are discussing are met, and will explain how to check it. The AIA describes the minimum information that an AI system should provide.

Records

The systems will generate permanently records, or logs, that they have to ensure a level of traceability its proper functioning for its intended purpose.

In addition, throughout the life of the system, evidence will be collected and analyzed to ensure that the system works normally and complies with the provisions of the Regulation, through a continuous process of post-marketing monitoring.

Transparency and communication of information to users

Systems should be designed in such a way as to guarantee users a sufficiently transparent operation, i.e. to enable them to understand and use it properly. With the system, the provider will have to provide instructions for use with concise, complete, correct and clear information that is relevant, accessible and understandable to users.

Human surveillance

The systems will be designed and developed in such a way that their use can be supervised by natural persons. Such monitoring should prevent or minimise the risks to health, safety or fundamental rights that may arise both if HRAIS is used for its intended purpose and if reasonably foreseeable misuse is made of it, in particular where such risks persist despite the application of the other requirements.

Precision, Solidity and Cybersecurity

High-risk AI systems shall be designed, developed and maintained in such a way that they achieve, according to their intended purpose, a adequate level of accuracy of results. The accompanying instructions for use shall indicate the relevant precision levels and precision parameters.

The systems should offer a adequate degree of resilience Faced with limitations in the systems or the environment in which they operate (e.g. errors, failures, inconsistencies or unexpected situations.

The systems must be designed to be resistant to third party attempts to exploit system vulnerabilities, in particular of the specific vulnerabilities of AI systems, such as the intentional corruption of training data to manipulate the outputs they produce.

Prior to the commercialization of a high-risk artificial intelligence system in the EU market, the suppliers They must submit it to a conformity assessment or, alternatively, to a self-assessment. This will allow them to demonstrate that their system meets the mandatory requirements of a trusted artificial intelligence. In addition, they must also comply with the following obligations:

  • Having a quality management system
  • Maintain the system documentation
  • Safeguarding the activity records
  • Collaborate with the authorities by demonstrating compliance, and notifying breaches and risks detected.

Las user obligations (responsible for deployment according to the nomenclature of the Regulation) are: human supervision, monitoring systems, keeping records and collaborating with authorities.

Las obligations of Importers and distributors They are: keeping the technical documentation, ensuring that the products have passed the conformity assessment, and collaborating with the authorities.