The EU AI Act comes into effect starting from 2nd February. It is more complex than GDPR and, with AI solutions increasingly being deployed, now is the time to start preparing for it. If you are using Microsoft solutions, Microsoft has published information on how they are looking to address the EU AI Act here. In terms of the legislation, here are the key points you need to know:
Applies to the AI Deployer, not Creator
Regardless of whether you have built AI capability or bought it, if you deploy AI capability within the organisation you are responsible for it as the deployer. You need to have a good understanding of current AI capabilities already being used (doesn’t matter when you deployed it) and identify where your legal obligations are. This needs to be an ongoing thing, not a one-off exercise!
Enforcement is Staggered
Unlike GDPR which came into effect ‘all at once’, the EU AI Act obligations come into effect in stages to allow organisations time to adapt. Rules for general purpose AI and penalties come into effect from August 2025 with all rules into effect 12 months after that.
Additional to Existing Legislation
The AI Act is part of the broader EU data laws. Therefore, it doesn’t go into detail about bias, consent, copyright, intellectual property covered by other laws but applies in addition to them.
Sizeable Penalties
The AI Act has a higher fine sealing than GDPR of 7.5 million or 1.5% of turnover and much higher for prohibited AI systems (35 million/7%).
Next Steps…
You can read more about the EU AI Act here. If you are looking for more practical guidance on this, worth also watching the Gartner webinar on this topic by Nader Henein.
There is also an EU AI Act Compliance Checker but worth noting it is WIP at this stage – in the next few months more tools like this will inevitably be created to help organisations with compliance.
Areti Iles 
Leave a comment