Towards an EU Artificial Intelligence Act
In April 2021, the European Commission published a proposal for the EU's first ever legal framework to regulate artificial intelligence. The proposal follows a risk-based approach, whereby AI systems considered a clear threat to the safety, livelihoods and rights of people will be banned, whereas the ones considered as high-risk will be subject to extra scrutiny.
The draft also proposed creating a European Artificial Intelligence Board, comprising one representative per EU country, which will supervise the law’s application and share best practices.
Several civil rights groups welcomed elements of the proposal, such as the ban on social scoring software, but expressed concern that the proposal does not go far enough to mitigate the vast potential for abuse of technologies such as non-live facial recognition systems. A cross-party group of 40 MEPs in the European parliament also called on the Commission to strengthen the proposal to include an outright ban on the use of facial recognition and other forms of biometric surveillance in public places. 163 civil society organisations pointed out in December 2022 that "the EU AI Act does not adequately address and prevent the harms stemming from the use of AI in the migration context."
Based on the Commission's proposal, on 6 December 2022 the Council adopted its General Approach. Civil rights group heavily criticised the changes made, for example, the increase of exemptions for AI-uses in law enforcement, migration, asylum and border control and the weakening of the restrictions on remote biometric identification. Furthermore, the approach proposes a national security exemption, meaning intrusive AI-based technologies could be used with no special limitations or safeguards.
In June 2023, the European Parliament adopted its official position adding key protections for fundamental rights to the Commission's draft. NGOs welcomed the proposed ban on facial recognition and abusive mass surveillance technology, but criticised that the parliament failed to introduce new provisions which would protect the rights of migrants from discriminatory surveillance.
After all institutions, the Commission, the Council and the Parliament, had adopted their positions, trilogue negotiations between the bodies started.
On 9 December 2023, EU co-legislators reached political agreement on the AI Act, after a negotiation marathon. The new AI rules, considered the world's most comprehensive, present a substantial advance in an extraordinarily dangerous sector that is still mostly unregulated across the globe. The AI Act will provide a range of key safeguards for fundamental rights in the context of AI, including at the workplace, after sustained efforts from civil society and EU Parliamentarians to rebalance the law. The law establishes mandatory fundamental rights impact assessments for AI systems classified as high-risk, extending to sectors like insurance and banking, and also grants citizens the right to file complaints and receive explanations about high risk AI systems’ decisions affecting their rights. However, rights groups caution that crucial technical details are not yet fixed or publicly known, and that serious loopholes remain, including carve-outs for law enforcement, allowing overseas exports of banned technology and a walk-back from banning live facial recognition.
🥁 AI Act deal: Key safeguards & dangerous loopholes
— AlgorithmWatch (@algorithmwatch) December 9, 2023
After a negotiation marathon in the global spotlight, EU lawmakers closed a deal last night on the #AI Act.
Read our statement: https://t.co/nPo3D87WAO@brandobenifei @IoanDragosT @ThierryBreton @carmeartigas
Please see below for more information and civil society reactions.
On 2 February 2024, the ambassadors of the 27 countries of the EU approved the Act, rubber-stamping the political agreement reached in December.
On 13 March 2024, the EU Parliament approved the Act with a large majority.
The AI Act was set to take effect from 2 February. However, according to reporting by Investigate Europe, lobbying by European governments has led to the act being diluted, "giving police and border authorities, among others, greater freedoms to covertly monitor citizens".
In February 2025, it was reported that the European Commission had withdrawn the AI Liability Directive. The decision followed criticisms, including by US Vice President JD Vance, of technology regulation at Paris' AI Action Summit. Criticism of the AI Liability Directive had allegedly "gained traction" following the adoption of the AI Act (see above) in 2024.