Hard details still need to emerge, and the final text still needs to be formally approved by the European Parliament and the bloc’s national governments, but we now know roughly what rules to expect when the act goes into effect in a couple years’ time. (A voluntary “AI Pact” will bridge the gap between now and then.)

Foundation models (like GPT-4) and the general-purpose systems built on top of them (like ChatGPT) will have to come with technical documentation and detailed summaries of the content on which they are trained. Those deemed to present systemic risks will have to submit to “adversarial testing” and adhere to rules around cybersecurity and energy efficiency. The deal calls for state-sponsored “regulatory sandboxes,” so startups and smaller enterprises can develop and train new AI systems, and test them in real-world conditions, before releasing them—Parliament claimed this will protect smaller players from “undue pressure from industry giants controlling the value chain.” Crucially, fully open-sourced models will be more lightly regulated than proprietary models.

High-risk AI systems in fields like insurance and banking, as well as those that could affect voter behavior, will have to undergo impact assessments, and Europeans will be able to demand explanations about how decisions were made that could have an impact on them. Some things will be outright banned, like social scoring, emotion-recognition systems in the workplace, AI systems that exploit the vulnerable, and biometric categorization systems that use characteristics such as race and sexual orientation.

Obviously, some people are happy with the outcome, not least the negotiators, who managed to get this thing over the finish line just in time—had it been pushed through to next year, it could have fallen victim to the chaos before looming European elections. “It was long and intense, but the effort was worth it,” exhaled Brando Benifei, one of Parliament’s coordinators in the negotiations, in a statement. “The European Union has made impressive contributions to the world; the AI Act is another one that will significantly impact our digital future,” agreed Dragos Tudorache, another key lawmaker.

But tech lobbyists and rights activists alike are pretty dissatisfied. Let’s give the first word here to Daniel Castro, the vice president of the Microsoft/Amazon/Meta/Google/Apple-funded Information Technology & Innovation Foundation (ITIF): “Given how rapidly AI is developing, EU lawmakers should have hit pause on any legislation until they better understand what exactly it is they are regulating…Acting quickly may give the illusion of progress, but it does not guarantee success.”  

The Computer & Communications Industry Association (CCIA), whose members also include Google, Meta, Amazon and Apple, also claimed that “future-proof AI legislation was sacrificed for a quick deal.” The CCIA welcomed the fact that, unlike the original draft from the European Commission, the final compromise allows developers to “demonstrate that a system does not pose a high risk,” but it claimed the Act’s “stringent obligations” would “slow down innovation in Europe” and “lead to an exodus of European AI companies and talent-seeking growth elsewhere.” (Counterpoint: Jeannette Gorzala, vice president of the European AI Forum, which represents local AI entrepreneurs, told Sifted that the provisions for smaller players will “fortify and empower the European AI startup ecosystem.”)

Over to the rights activists now. The European Consumer Organisation (BEUC) fretted that the Act will allow for AI-powered emotion recognition systems outside the workplace, and claimed it would leave things like virtual assistants “basically unregulated.” “Consumers rightly worry about the power and reach of artificial intelligence and how it can lead to manipulation and discrimination, but the AI Act doesn’t sufficiently address these concerns,” said deputy director general Ursula Pachl.

And European Digital Rights (EDRi) predicted that “the devil will be in the detail” of the technical drafts that will appear in the coming weeks. EDRi is concerned that the agreement marks the first time the EU is legalizing live facial recognition in public spaces—albeit limited to a handful of applications such as the search for suspects and the prevention of terror attacks—and contains “exemptions to the rules for when law enforcement, migration, and national security authorities deploy ‘high-risk’ AI.”

“Our fight against biometric mass surveillance is set to continue,” said EDRi senior policy advisor Ella Jakubowska in a statement. More news below.

David Meyer

Want to send thoughts or suggestions to Data Sheet? Drop a line here.

NEWSWORTHY

ON OUR FEED

“If the manufacturer isn’t going to take safety seriously, it is up to the federal government to make sure that they are standing up for others to ensure safety.”

—National Transportation Safety Board chair Jennifer Homendy criticizes the Department of Transportation’s failure to respond to Tesla autopilot-related crashes by creating enforceable rules about where such technology can and can’t be used.

IN CASE YOU MISSED IT

Tech will remain the economy’s key growth engine. Fortune’s Future 50 helps explain why, by Martin Reeves and Adam Job

TikTok is spending $1.5 billion on a joint venture to solve the problem of Indonesia’s surprise social media shopping ban, by Lionel Lim

Apple says it shut down the Beeper Mini app—which enabled iMessage for Android—to ‘protect our users’, by Bloomberg

FabFitFun, a $1 billion subscription box startup, frantically backpedals after a profane, pro–Elon Musk ad bombs, by Paige Hagy

SpaceX’s Starlink passes Arctic military tests, paving the way for new Pentagon contracts as China and Russia eye the region, by Bloomberg

As China’s electric vehicles go global, legacy automakers find reducing costs ‘is now more important than anything else’, by Steve Mollman

BEFORE YOU GO

Life after Prigozhin. Russia’s malign online influence operations are doing just fine after the oh-so-mysterious death of Wagner Group warlord and attempted insurrectionist Yevgeny Prigozhin, who also ran the notorious Internet Research Agency troll farm, Microsoft’s security researchers have established.

In a blog post, the researchers detailed several Russian cyber operations, with one standout being the duping of American celebrities into recording Cameo video messages for someone called Vladimir who, they were told, has a substance abuse problem. And so, the likes of Elijah Wood and Priscilla Presley found themselves incorporated into Russian propaganda, distributed on social media to create the impression that they were speaking about Ukrainian President Volodymyr Zelensky.