March 2024 – On March 13th the EU Parliament adopted the AI Act, marking a significant milestone in shaping the region's AI landscape. The Act will be published in the Official Journal of the European Union, and 20 days after publication, the AI Act will enter into force.
Although it will take two full years until the grace period passes and almost all provisions will be applicable, AI providers should be aware of the detailed schedule of applicability. In addition, as the AI Act has extraterritorial scope, it does not only concern the 27 Member States of the European Union, but any AI provider worldwide whose AI systems are placed on the market or put into service in the EU.
The first deadline expires in six months, as the rules concerning prohibited AI systems will enter into force soon after the adoption of the AI Act. This means that AI manufacturers need to prepare their risk assessments and determine by this deadline whether their AI systems pose an unacceptable risk and whether there is an exemption from the prohibition.
Nine months after the entry into force of the regulation, codes of practices will be adopted. These documents will provide the market additional guidance on the implementation of the AI Act. The adoption will be assisted by invited members of stakeholders, academia, civil society and the industry.
The next deadline expires a year after the entry into force of the AI Act. The providers of general-purpose AI systems have several compliance obligations to meet, including the preparation of technical documentation on the AI system, a copyright policy, and a summary of the training data used to train the AI system. There are also obligations on the regulatory side effective on the same one-year anniversary of the AI Act, as this is the deadline for the Member States to appoint the competent authorities under the AI Act as well as for the application of the rules on penalties. The Commission has an annual obligation to review the list of prohibited AI systems and amend it if necessary.
Within 18 months after the entry into force of the AI Act, the Commission will adopt an implementing act on post-market monitoring of high-risk AI systems. The post-monitoring will be done mainly by AI providers based on a post-market monitoring plan consisting of a systematic collection, documentation and analysis of information from various sources to ensure the continuous monitoring of AI systems.
The general grace period prescribed by the AI Act is 24 months, but there are deadlines even after this date. On the industry side, the obligations that will be applicable at this point are obligations that concern high-risk AI systems that are specifically listed in the AI Act (e.g., biometrics, education and employment, immigration, etc.). This is also an important deadline for Member States, as by this point they have to implement rules on penalties and establish at least one operational regulatory sandbox. Finally, the Commission will review—and if necessary, amend—the list of high-risk AI systems set out in the AI Act.
As previously noted, the general grace period does not mark the end of this schedule. Thirty-six months is the last deadline for the industry—for manufacturers of AI systems that are required to undergo a third-party conformity assessment (not prescribed by the AI Act, but by other EU legislation due to safety aspects of AI products or the products themselves (e.g., medical devices, certain vehicles, toys, etc.).
The final deadline to note regarding the AI Act is the end of 2030. This is when certain obligations will go into effect for large-scale AI systems (e.g. the Schengen Information System).
This short article only includes the key dates that are already set out in the AI Act (in the latest version available to the public) and thus is subject to change if the legislator adopts an amended version. Member State parliaments will start the implementation process to make their national legislation compliant with the AI Act. Due to the minimalist nature of the AI Act, it is almost certain that most Member States will adopt layers of additional legislation that will be complimentary to the AI Act.
Our takeaway is clear: there is a short time to act. AI providers need to start their preparations, because if the AI Act is adopted as expected, there will only be a few months to prepare and document the initial legal assessments. AI adoption by businesses is accelerating. According to multiple studies, on average more than eight out of ten businesses have adopted AI in some way in their operations, and a similar percentage of companies consider AI a top priority in their business strategies.
If you are in a similar situation, please do not hesitate to contact us and let us assist you through the next phase of your AI journey.