It has just happened. AI EU regulation is almost here. On 21 May 2024 the Council approved the Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) ["AIR"].
Being the first European Union legislation, the AIR must now be analyzed by the national administrations to make sure it is properly implemented. In Poland the attempts are undertaken to set up local governance structure.
Governance and enforcement framework
The AIR general approach to the AI regulation is based on:
a) setting up an AI-related institutional structure at the EU level,
b) imposing the obligation on Member States to set up an analogous structure at the national level,
c) laying down substantive, procedural and conformity-related provisions regulating AI activities,
d) imposing sanctions for breach of the provisions imposed by the regulation.
AI-related EU institutional structure
As for EU institutional structure, the AIR foreshadows establishing: (i) the AI Office, functioning as a top body of the Commission in charge of all AI-related matters, esp. the ones related to the creating of high level expertise at the Union level and developing the digital single market, (ii) European Artificial Intelligence Boad, composed of representatives of the Member States, whose main role is to harmonize AI administrative practices in the Member States, esp. through the development and application of codes of conduct and codes of practice and (iii) other institutions as, for instance, a scientific panel of independent experts and an advisory forum.
AI-related national structures
As to national AI-related structures, each Member State should: (i) designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring, (ii) establish notified bodies which are tasked with conducting conformity assessment activities concerning requirements imposed on high risk AI systems. These bodies should apply to the notifying body for their notification as nationally authorized bodies, (iii) designate a market surveillance authority to act as a single contact point.
Public pre-consultation in Poland as regards national AI-related structures
In Poland, the Ministry of Digital Affairs has just completed the public pre-consultation process of implementing the AIR. The Ministry decided to consult 50 NGOs, research centers and business associations.
One of the key issues was whether to establish a new body i.e. new supervisory authority, who should carry out the function of the notifying authority, or to leave the competence to one of the already established authorities e.g. the President of the Office of Competition and Consumer Protection (Polish: "UOKiK"), the President of the Office of Personal Data Protection (Polish: "UODO"), the Chairman of the Financial Supervision Authority (Polish: "KNF"), the Chairman of the National Broadcasting Council (Polish: "KRRiTV"), the President of the Office of Electronic Communications (Polish: "UKE") or the Minister of Digital Affairs (Polish: "MC").
The notifying authority would have the following tasks:
- be the single point of contact for the general public and other partners at Member State and EU level,
- handle requests for authorization for the placing on the market or putting into service of high-risk AI systems, and complaints from individuals subjected to AI systems,
- receive reports of serious incidents,
- liaise with the Commission, the Advisory Forum and the AI Board.
The main reason for establishing a new body, instead of adding AI-related duties to the already existing authorities, is that it would allow for avoiding potential disputes over competencies and conflicts of priorities in the operation of other institutions.
The notifying body is the one to develop and apply, in cooperation with its EU partners, the procedures necessary for the assessment, designation, notification and monitoring of conformity assessment bodies of AI systems and, in certain situations, to provide the Commission and the Member States with evidence which attests to the competence of the conformity assessment body. The notifying authority, as intended by the drafters of the AIR, is to operate in a manner that guarantees a high level of expert competence, confidentiality, impartiality and absence of conflicts of interest with conformity assessment bodies.
The entities taking part in public consultations in Poland were far from certain as regards the authority to act as a notifying body. Although more consultants supported the idea of establishing a new institution, the Polish Centre for Accreditation (Polish: "PCA") was the institution, which was the most frequently mentioned as the existing and competent one.
The works are in progress.
Provisions regulating AI activities
As to the provisions regulating AI activities, high-risk AI models/systems or GP AI models/systems, which are in conformity with the harmonized standards or common specifications, are deemed, in principle, to be in compliance with the AIR. However, providers of high-risk AI systems, depending on the areas in which their high-risk AI systems operate, may choose one of the procedures set out in Annex VI and VII of the AIR.
A possible positive conformity assessment will take the form of a certificate issued by a notified body. Such certificate, in turn, is needed for the provider of the systems in question to draw up EU declaration of conformity. The AIR also imposes on the systems' providers/deployers an obligation to register their systems in the EU data base and to affix CE marking. An additional, and yet significant obligation imposed on them is their obligation to prepare post-market monitoring plan and to conduct this monitoring accordingly.
As to the role of public authorities in the context of the actual operation of these systems, a key part is to be played by market surveillance bodies whose tasks in this context are harmonized with the existing ones based on Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 on market surveillance and compliance of products and amending Directive 2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011.
What is specifically important in this regard is the power of market surveillance bodies to conduct investigations with the aim of promoting compliance, identifying non-compliance, raising awareness and providing guidance in relation to this Regulation. Under this procedure, market surveillance bodies may claim full access to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems. In the case of a market surveillance body's reasoned determination concerning a given AI system as presenting a risk (to safety, health and fundamental rights of persons), this body has the obligation to evaluate the systems' compliance with the requirements and obligations laid down in the AIR and in the case of non-compliance, it shall require a relevant operator to take all appropriate corrective actions to bring the AI system into compliance, to withdraw the AI system from the market, or to recall it within a period the market surveillance authority may prescribe. Any omission or taking inadequate corrective measures by the operator concerned will effectuate possible fines.
Sanctions for breach of the provisions imposed by the AIR
As to the fines, they depend on the severity of possible violations of the provisions of the Regulation:
1) non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to 35 000 000 EUR or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher;
2) non-compliance of an AI system with any of the specifically indicated provisions concerning obligations of the main operators and notified bodies (other than those laid down in Articles 5) will face fines of up to 15 000 000 EUR or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher;
3) the supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request shall be subject to administrative fines of up to 7 500 000 EUR or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.
According to the AIR, EU Member States shall lay down the rules on penalties and other enforcement measures, which may also include warnings and non-monetary measures applicable to infringements of AIR by operators. The general aim for the penalties is that they shall be effective, proportionate and dissuasive. They shall take into account the interests of SMEs, including start-ups, and their economic viability. In the case of these entities, each of the abovementioned fines shall be up to the percentages or amount referred, whichever thereof is lower.
Summary
As indicated in the press release of 21 May 2024 of Council of the EU, "After being signed by the presidents of the European Parliament and of the Council, the legislative act will be published in the EU's Official Journal in the coming days and enter into force twenty days after this publication. The new regulation will apply two years after its entry into force, with some exceptions for specific provisions.".
One may risk and say that the AIR will become the first in-depth regulation of the AI functioning in the EU and in the world.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.