Today Europe definitively votes on the world's first artificial intelligence law. The creation of this legislation has been complex, but it allows us to bring order to a sector that is moving at a devilish speed in the hands of a handful of companies without regulations that mark red lines for them. The final text maintains complex balances between those who long for greater guarantees for citizens' rights and those who hope that AI will have uses such as law enforcement.
In yesterday's plenary session, prior to today's vote, the internal market commissioner, Thierry Breton, mentioned the work done in the final agreement of the law by the Spanish Secretary of State for Digitalization and Artificial Intelligence, Carme Artigas, in last December, since "during the Spanish presidency we reached a historic compromise" that the commissioner considers "is balanced and will stand the test of time."
The European artificial intelligence law establishes that a future European Artificial Intelligence Office will classify AI systems according to their risks and this will determine what requirements the companies and organizations that use them must meet. Policymakers believe that most AI providers will be in the minimum risk category, allowing for widespread use in the economy by companies.
Another category will be high risk, which includes systems that may have a potential negative impact on people's security or fundamental rights.
In the next step, the law also establishes a detailed list of uses of unacceptable risk. This group includes the use of AI for social scoring for public or private use, the exploitation of people's vulnerable points through subliminal techniques, and remote biometric identification, in real time and in public places, by security forces and bodies. This point is one of the most controversial, because in the final wording limited exceptions were introduced for a series of crimes.
Other uses considered inadmissible and prohibited are the categorization of people based on biometric data to deduce their race, political opinions, union membership, religious or philosophical beliefs, or sexual orientation. Biometrics may also not be used for individual predictive policing or emotion recognition in the workplace and educational centers, although there will be medical and security exceptions for the latter. Systems that pose a risk to transparency will also be classified. With chatbots, users will need to be aware that they are interacting with a machine.
The text addresses the systemic risks of general-purpose AI models, such as large generative AI models of the same type as ChatGPT, because they can be used for many different jobs. Their widespread use by the population could have widespread consequences, for example, if they spread negative bias or are affected by a cyberattack. All companies that use AI in Europe must be registered by a future European Artificial Intelligence Office that will be created as soon as the text is officially published, in 20 days.
The rest of the law's implementation, once passed today, will not be so quick. The process will be gradual and will take effect until spring 2026. There are some parts that will be adopted much sooner, such as the bans, which will come into effect after six months. Governance rules and obligations for general-purpose AI models will be implemented within a year.
The last intervention yesterday in the European Parliament before today's vote was given by one of the rapporteurs of the law, Dragoş Tudorache, who asked: “Have we found the right balance between protection and innovation? Do we have adequate safeguards for citizens against the risks that technology may pose or against potential abuse by governments or bad actors? Have we future-proofed this legislation enough? To answer the incredible speed with which all of these questions evolve, I have one answer: Absolutely. Yeah".
