Artificial Intelligence (AI)

• Technology

• EU AI Act: We have been closely tracking this legislation since the EU High Level Expert Group issued its White Paper in February 2020. If you develop AI systems, we will help you understand the degree to which your technology will be regulated and what compliance looks like for you.
• Licensing and Commercialising AI: AI systems, and particularly those dependent on significant training datasets, present unusual challenges, like ownership and use of both input and output datasets, ownership, and use of model improvements, explainability and liability for the acts and omissions of the AI system. We will work with you to manage your contracts and negotiations in this regard to ensure an outcome aligned with your operational needs and risk profile.
• Adopting & using AI: Users of AI, whether as licensees or under service arrangements, must also consider some of the same issues faced by providers. We will work with you to make sure you optimise your access rights under the provider terms while understanding and mitigating exposure to the novel risks posed by AI. We will also help you understand your future obligations under the EU AI Act and how to plan for them both operationally and in your contracts.
• Privacy and Security: Many AI systems give rise to complex privacy law issues related to automated decision making and profiling. Our Privacy and Data Security Legal Team provides world-class expertise and strategic advice on all issues surrounding data protection law, privacy law and cyber-security compliance.
• Product Regulatory: The proposed conformity assessment process for physical AI products under the AI Act is different to that proposed for software type AI products. We have market leading product lawyers across our Technology, Financial Services and Life Sciences sectors and will leverage that experience to support you with your AI compliance project and queries.

• An Overview of the EU AI Act
• General Purpose AI and the EU AI Act
• Who is Affected
• Risk Categories
• High-Risk AI Systems
• Regulating Chatbots and Deepfakes

• Providing a large international customer experience platform owner with in-depth analysis and guidance on the classification of AI applications under the high-risk and prohibited risk categories under the EU AI Act and advising on necessary risk mitigation and compliance strategies.
• Advising a multinational technology conglomerate on aspects of various drafts of the EU AI Act including in relation to Article 6 / Annex III thresholds and obligations of LLM providers.
• Advising a Chinese internet technology company with on the role out of a new AI model as a service platform.
• Acting for a leading business messaging platform in its adoption and use of ChatGPT to automate and augment aspects of its offering.
  
• Advising a large FinTech provider on internal policies and procedures governing the development, implementation, and monitoring of AI technologies and compliance with the EU AI Act.
• Assisting a Japanese multinational pharmaceutical company with understanding and commenting on the European Medicines Agency Reflection paper on the use of artificial intelligence in the lifecycle of medicines.
• Assisting a significant international FinTech provider in its negotiations for procuring Generative AI products.
• Providing tailored training sessions and workshops to large in-house legal and technical teams on the implications of the EU AI Act, ensuring thorough understanding and competence to manage AI-related legal challenges proactively.
  
• Acting for a leading business messaging platform in its adoption and use of ChatGPT to automate and augment aspects of its offering.
• We are supporting a global venture capital fund in its investment in a sophisticated visual AI end-to-end platform business in the retail sector.
• We are advising key firm technology clients in the exploratory stage of understanding compliance with aspects of the EU AI Act.

Contact a member of our Artificial Intelligence team if you have any AI questions that were not answered here.

Are there existing laws regulating the use of Artificial Intelligence in the EU?

Not specifically. The General Data Protection Regulation (GDPR) regulates how personal data may be used to train, develop, and use AI models. Under Article 22 (Automated Decision Making), it also regulates the operation of certain AI machines such as credit scoring engines and AI deployed in the recruitment space.

What is the AI Act?

The AI Act is the EUs proposal for a horizontal regulation of AI systems put on the market or put into service in the EU. It is intended to apply to all such AI systems. In reality, while the AI Act will apply in some manner to all AI systems, it will really only disrupt certain types of AI which will be categorised as prohibited or high risk AI systems.

How is Artificial Intelligence defined?

The AI Act defines an AI system as a machine-based system that is designed to operate with varying levels of autonomy and that can, for explicit or implicit objectives, generate outputs such as predictions, recommendations, or decisions that influence physical or virtual environments.

What is the timeline for implementation of the AI Act?

The European Parliament and the Council of the European Union reached political agreement on the European Commission’s proposal for the AI Act on Friday, 8 December 2023. We expect that the final agreed text of the AI Act will not be published for a number of months yet.

What is the territorial scope of the AI Act?

Any entity placing on the market or putting into service AI systems in the EU will be subject to compliance irrespective of whether they are established in the EU or not.

Are any uses / users exempt from compliance with the AI Act?

Yes, for instance, private users of AI, defence / military applications, pure R&D and R&D conducted prior to launch, some AI made available under free and open source licences, and some uses of AI under international agreements.

How will AI be regulated under the AI Act?

The below AI risk pyramid produced by the EU Commission best illustrates the sliding scale of risk based regulation under the AI Act, decreasing in risk and regulatory oversight from the top down as follows: (i) unacceptable risk, like social scoring; (ii) high-risk, like fintech, recruitment, employment and education uses; (iii) limited risk, like deepfakes and chatbots; and (iv) minimal risk, like spam filters. Foundation models and Generative AI are also regulated but not according to this risk pyramid, and will be subject to robust and disruptive requirements.

How can I find out if my AI technology will be regulated in the EU?

The short answer is it will be regulated to some extent given the broad scope of the definition of AI system. The more pertinent question for AI system providers and deployers is the level of compliance your AI system will be subject to (see next FAQ above). The answer to the question requires undertaking a threshold analysis in accordance with the AI Act. Contact a member of our AI team for further information.

How should I prepare for compliance with the AI Act?

First, decide if you are a provider (manufacturer) or deployer (business user). If you are a deployer your compliance obligation is far less than that of a provider and much more manageable. Next, determine the risk category into which your AI system falls by reference to the AI risk pyramid set out above in these FAQs (bear in mind Foundation models and Generative AI are also regulated). Armed with that information you will be in a position to take discrete and targeted advice on your compliance obligation. Contact a member of our AI team for further information.

If my AI technology achieves compliance with the AI Act, will that compliance also cover other territories?

Most likely yes. Much like GDPR, the EU is aiming for the gold standard in AI regulation and wants to influence global AI regulatory standards. The UK has decided to adopt a light touch regulator by regulator approach based on principles. It does not intend to adopt any new laws for AI. The US has not yet adopted any broad AI specific laws like the AI Act at a federal level, but some States have implemented some sector / technology specific AI laws. Compliance advice should be sought on a territory by territory basis.