European Union publishes law on artificial intelligence

On July 12, 2024, the European Union published the text of the long-awaited Artificial Intelligence Act (AI Act), which is the world’s first comprehensive legislation regulating the growing use of artificial intelligence (AI), including by employers.

Quick Hits

• The EU has published the final version of the Artificial Intelligence Act, which will enter into force on 1 August 2024.
• The regulations treat the use of AI in the workplace by employers as potentially high risk and impose obligations related to its use and potential penalties for violations.
• The regulations will be implemented gradually over the next three years.

The AI ​​Act will “enter into force” on 1 August 2024 (i.e. twenty days from the date of publication on 12 July 2024). The publication of the Act follows its adoption by the European Parliament in March 2024 and approval by the EU Council in May 2024.

The groundbreaking AI regulations are based on a risk-based approach that will subject AI applications to four different levels of increasing regulation: (1) “unacceptable risk,” which is prohibited; (2) “high risk”; (3) “limited risk”; and (4) “minimal risk.”

While not specific to employers, the law considers employer use of AI technology in the workplace to be potentially “high risk.” Violating the law can result in severe penalties.

Key Dates

The publication sets out a timetable for implementation over the next three years, and also outlines when we should expect more guidance on how to apply it. Key dates for employers include:

• August 1, 2024 – The Artificial Intelligence Act will come into force.
• February 2, 2025 – (Six months from the effective date) – The regulations regarding prohibited AI systems will come into effect, meaning that the use of such systems must be discontinued by then.
• May 2, 2025 – (Nine months from the date of entry into force) – “Codes of Good Practice” should be ready, which will provide providers of general purpose AI systems with greater clarity on their obligations under the AI ​​Act, potentially providing some information to employers.
• August 2, 2025 – (Twelve months from the date of entry into force) – Provisions on notification bodies, universal AI models, governance, confidentiality and most penalties will come into force.
• February 2, 2025 – (Eighteen months from the date of entry into force) – Guidance should be available on how to comply with the provisions for high-risk AI systems, including practical examples of high-risk and non-high-risk systems.
• August 2, 2026 – (Twenty-four months from the date of entry into force) – The rest of the rules will enter into force, with the exception of a minor provision on certain types of high-risk AI systems, which will enter into force on August 1, 2027, one year later.

Next steps

The adoption of the EU AI Act will establish consistent standards across all EU countries. Furthermore, the legislation is important because it is likely to provide a framework for AI laws or regulations in other jurisdictions, much like the EU’s General Data Protection Regulation (GDPR) has served as a model for data privacy.

In the United States, regulating AI and automated decision-making systems has been a priority, especially when these tools are used to make employment decisions. In October 2023, the Biden administration issued an executive order requiring federal agencies to balance the benefits of AI with the legal risks. Several federal agencies have since updated their guidance on the use of AI, and several states and cities are considering legislation or regulations.