Analysis

'Far-Reaching' EU Ban On High-Risk AI Models Now In Effect

(February 3, 2025, 7:28 PM GMT) -- The European Union on Sunday ushered in key laws to rein in the use of artificial intelligence systems that pose an "unacceptable risk," but a lack of guidance from the bloc has companies in the dark.

Use of such systems is now prohibited and companies are required to have adequate training programs in place for staff using AI systems, marking the latest in the ongoing rollout of the world's first sweeping legislation governing the sector.

"For organizations that have recently rolled out generative AI-backed platforms, this is likely to have a far-reaching scope," Ashurst LLP Risk Advisory partner Matt Worsfold said.

Specifically, providers of AI systems are now barred from releasing or using AI systems that, among other things, "deploy subliminal ... or purposefully manipulative or deceptive techniques" with the aim of "distorting the behavior of a person or a group."

Any system that aims to exploit vulnerabilities of a person or a group, classifies people based on social behavior or known characteristics, or creates or expands facial recognition databases is also prohibited.

Businesses found to be using such systems could face up to an €35 million ($36 million) fine, or up to 7% of their global annual turnover.

Any company using an AI system must also ensure a "sufficient level of AI literacy" of staff tasked with using AI systems.

While the laws around prohibited systems are broadly uncontroversial, lawyers have criticized the lack of guidance on crucial provisions, pointing out that the bloc has been slow to roll out guidelines on the sweeping regulations.

"Although the commission has promised guidelines to help providers with compliance by early 2025, and has consulted on the topic, nothing has yet been published, and of course no case law exists on this novel topic," Ashurst LLP partner Fiona Ghosh said. "Meanwhile, compliance must be seen as a continuing task."

As of the time of writing, the European Commission has set aside a page for "guidelines on prohibited AI practices," with a note that "content will be published soon."

Lawyers have also noted that companies using AI have faced difficulties in assuring that the systems they are employing are not prohibited.

"The boundary of some of the prohibited practices is blurry," Bird & Bird LLP partner Toby Bond said. "For organizations operating globally, there has also been the challenge of deciding whether they want to apply the prohibited practices rules across all of their operations, or just apply them in the EU."

"We saw similar decision-making about how far to apply new EU rules when GDPR was first introduced," Bond said, referring to the General Data Protection Regulation.

The European Commission first floated the idea of imposing major AI legislation in 2021, and sought input from stakeholders on how best to legislate the nascent technology.

Following a long period of negotiations, the commission, European Parliament and member states arrived at a final draft of the act in December 2023, imposing a broad swath of obligations on AI models.

Parliament voted overwhelmingly to pass the act in March 2024, ushering in the landmark law that promised to foster innovation of the burgeoning technology while ensuring that AI development did not run afoul of fundamental EU rights.

But the bill attracted criticism from legal professionals, who requested further guidance on key provisions, including what exactly constituted "machine-readable" means of opting out copyrighted works from scrapers harvesting data for AI training.

The act first took effect in August 2024, beginning a slow rollout of the legislation and giving EU member states until August 2025 to establish national authorities to oversee the transcription of the bill into national law.

One of the next crucial deadlines regarding the EU AI Act will be Aug. 2, which will mark the introduction of the EU AI Act rules on general-purpose AI models.

Central to these rules are provisions obliging providers of such general-purpose AI models to have established a policy for compliance with EU copyright law and to provide a detailed summary of all content used to train their systems.

"Exactly how these obligations will work in practice depends on the Code of Practice and template training data disclosure, which the AI Office is currently working on," Bond said.

--Editing by Alex Hubbard and Marygrace Anderson.

For a reprint of this article, please contact reprints@law360.com.

Hello! I'm Law360's automated support bot.

How can I help you today?

For example, you can type:
  • I forgot my password
  • I took a free trial but didn't get a verification email
  • How do I sign up for a newsletter?
Ask a question!