Timeline of EU AI Act Implementation

Starting in February 2025, the European Union will begin implementing the EU AI Act in phases, affecting businesses worldwide that utilize artificial intelligence. Here's a detailed timeline:

• February 2025: The EU will enforce the prohibition of specific categories of AI systems deemed to compromise personal freedom or be used for monitoring purposes—like "social scoring" systems.

• August 2025: Regulations around general-purpose AI systems and penalties for non-compliance will come into effect.

• August 2026: The majority of the regulatory framework will become enforceable.

• August 2027: Final regulations, primarily under Articles 6.1 and Annex II, will be fully implemented.

This staggered approach aims to give companies ample time to adjust their practices while complying with legal standards.

---

Three-Tier AI Risk Categories

The EU AI Act classifies AI into three risk-based categories:

1. Prohibited AI: AI systems that breach individual autonomy or enable societal harm (e.g., surveillance for controlling populations).

2. High-Risk AI: These include HR recruitment systems, AI used in law enforcement, or systems impacting health and safety. Such technologies must meet strict legal and technical requirements.

3. Low-Risk AI: Examples include AI recommendation engines or spam filters, which have minimal regulatory hurdles. These systems require basic documentation and internal monitoring.

---

Four AI Integration Approaches and Corporate Strategy Suggestions

According to Gartner, businesses adopt AI in one of four ways:

• "Wild AI": Employees use external AI applications not officially part of organizational infrastructure, often for productivity needs.

• "Embedded AI": AI functionalities are pre-built into third-party enterprise solutions.

• "Hybrid AI": Companies collaborate with external AI providers while integrating internal datasets for customization.

• "In-House AI": AI systems developed entirely within a company’s infrastructure.

For compliance, businesses must monitor AI use, catalog systems, and document their objectives. GDPR-compliant tools such as RoPA (Record of Processing Activities) and Privacy Impact Assessments (PIAs) could simplify these processes.

---

Extra Compliance Obligations

The EU AI Act will include supplemental requirements, notably for high-performance AI tools and generative AI models that handle highly sensitive tasks such as facial recognition or biometric data handling.

Key obligations include:

• Conducting continuous AI risk assessments.
• Registering systems in a central EU-wide database.
• Ensuring transparency in deployment, operational boundaries, and data protection.
• Building enforcement mechanisms to address non-compliance, which could result in fines reaching 7% of annual global revenue.

---

Corporate Action Plan

To align with EU AI Standards, Gartner recommends:

1. Realignment of IT Systems: Continuously assess existing AI-enabled platforms for compliance.

2. Policy Adjustments Around Data: Secure sensitive information while preparing for full EU accountability.

3. System Discovery & Documentation: Ensure detailed records of every AI system and their legal justification for using personal, often sensitive attributes like political stances or biometrics.

4. Comprehensive AI Governance: Designate specialized teams for reviewing any AI innovation and assessing associated risks against legal stipulations.

---

Integration with Broader EU Regulatory Framework

Over 17 preexisting EU laws interact with the AI Act:

• Includes the Toy Safety Directive, Aviation Security, Medical Devices Regulation, among others.
• AI systems relevant to these frameworks will likely be classified as “high-risk,” necessitating robust oversight.

---

The EU AI Act, coming into effect in phased stages starting in February 2025, imposes comprehensive AI governance regulations. It categorizes AI into prohibited, high-risk, and low-risk segments, outlining specific compliance mechanisms and corporate responsibilities. Penalties for violations reach as high as 7% of annual revenue. The structured rollout aims to align AI development with the EU’s stringent ethical guidelines while preventing misuse. Companies should rely on actionable steps like risk assessment, cataloging, GDPR-aligned practices, and centralized AI governance to follow these mandates effectively.

---

• Crafted by Billy Yang
  [More…]
  EU AI Act Insights
  Generative AI Compliance Rules