A Deal on the EU’s AI Act: What Now?

For months, AI policy watchers had Wednesday, December 6, highlighted on their calendars, the date of the final trilogue negotiations among the European Council, the European Commission, and the European Parliament on the EU’s AI Act. The law takes a horizontal, risk-based approach, banning AI uses that pose “unacceptable risk” and introducing risk mitigation and oversight for “high-risk” systems, without restricting most AI uses. The last round of talks lasted an unprecedented three days and overcame rising uncertainty that a deal was within reach. But the announcement of one came late last Friday, even if uncertainties and unanswered questions remain behind the smiles and thumbs-ups of the tired EU officials.

The “deal” is in fact a provisional political agreement. Without time to organize another trilogue before the end of the year, all sides were under pressure to conclude negotiations before then. More behind-the-scenes negotiations on precise wording will now follow. The devil is always in the details.

Lawmakers resolved questions on key issues seemingly poised to complicate, or even derail, the legislation. ChatGPT and large language models were late additions to the discussions. But following the first day of negotiations, an agreement based on computing power used to train foundation models was reportedly reached. So-called systemic models will be subject to risk assessments and environmental and cybersecurity standards that an AI office within the Commission will enforce.

Sticking points remain despite the provisional agreement, illustrating the sensitivity of AI and key issues of rights, privacy, and civil liberties. For example, the act will include a national security exemption, including for external contractors. National security remains under member-state purview, and its parameters will be significant. On controversial AI uses, including remote biometric identification, emotion recognition, and predictive policing, the details of narrow law enforcement exemptions must also be finalized. Potential exemptions or opt-out clauses mean uncertainty remains, and civil society groups have already expressed disappointment.

The extent to which the much-vaunted “Brussels effect”, or impact on regulation elsewhere, including the recent White House executive order, will take hold is unknown. Bans apply six months after the law comes into force, and requirements for foundation models begin after one year, with full compliance required for companies two years after the law’s formal adoption. Yet EU companies may still sell systems prohibited at home to buyers outside the bloc. The act’s influence over business decisions in and outside the EU is also undetermined.

After a long and sleep-deprived week in Brussels to reach a deal, much work remains for negotiators.