EU Regulation 2024/1689 (Artificial Intelligence Act) published in the Official Gazette.

The Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) has been published in the Official Journal of the European Union on 12nd July 2024.

The Regulation 2024/1689 is the world's first comprehensive law on AI and aims to address risks to health, safety, and fundamental rights. In addition, it protects democracy, the rule of law and the environment.

The Regulation 2024/1689 shall enter into force on 1st August 2024, but it will only be applicable from 2nd August 2026. However, some rules will apply after 6 or 12 months.

The following will be applicable from 2nd February 2025:

(a) Articles 1 to 4, relating to the subject matter, scope, definitions (supply contracts may therefore use technical and legal definitions of the AI Act) and AI literacy obligations (obligation for suppliers and developers to have trained and competent personnel, who may find specific entry into contracts with suppliers).
(b) Article 5 on prohibited AI practices (particular attention will have to be paid – for example – to advanced profiling using biometrics, especially in the workplace, to check the applicability of the ban).
 
After 12 months (from 2nd August 2025) the following will apply:
 
(a)   the rules on the penalty system (with penalties of up to €35 million or 7% of annual global turnover; the penalty for providers of AI models for general purposes – up to €15 million or up to 3% of turnover – will apply after 24 months);
(b) the rules on General Purposes AI models (GPAI) ( from which relevant compliance and contractual issues arise, considering that companies already use on a daily basis solutions – such as Chat-GPT and generative AI – integrated into devices/services);
(c) the rules on notified bodies and on the related notification procedures;
(d) Article 78 ("Confidentiality");
(e) the rules establishing the EU database on high-risk AI systems.

Finally, the applicability of the rules on "high-risk" AI systems, as well as the related obligations, is postponed to 2nd August 2027.

The Regulation 2024/1689 shall apply to public and private entities, inside and outside the EU, provided that an AI system is placed on the EU market or that its use affects persons located in the EU.

The rules will bind both providers/developers of AI systems (e.g. a developer of a CV screening tool) and professional end-users (called "deployers") of high-risk AI systems (e.g. a company that purchases the aforementioned screening tool).

The Regulation 2024/1689 will also apply to the entire commercial chain (importers, distributors, manufacturers of products who place an AI system on the market or put into service together with their product and with their name or brand, etc.): importers of AI systems in the EU will have to ensure, for example, that the non-EU supplier has already performed the appropriate conformity assessment procedure and that the AI system bears a European conformity (EC) and is accompanied by the required documentation and instructions for use.

There are also specific obligations for providers of general-purpose AI models (GPAIs) including large generative AI models (LLM systems – Large Language Models, such as Chat-GPT, Copilot, Gemini, etc.).

Providers of free and open-source models are exempt from most of these obligations. However, this exemption does not cover obligations applicable to providers of GPAI general purpose AI models that involve systemic risks.

Regulation 2024/1689 shall not apply to research, development and prototyping activities prior to placing on the market and to AI systems developed for military, defence or national security purposes, regardless of the type of entity carrying out such activities.