**Insight** 16 July 2024 | 12 min read

# AI Watch: Global regulatory tracker - European Union

The EU introduces the pioneering EU AI Act, aiming to become a global hub for human-centric,

trustworthy AI.

## Laws/Regulations directly regulating AI (the “AI Regulations”)

The primary legislative framework for regulating AI in the EU is the EU AI Act

[(here). The EU has also proposed the AI Liability Directive (here) which is](https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?lang=en&reference=2021/0106(COD))

designed to ensure that liability rules are appropriately applied to AI-related

claims.

## Status of the AI Regulations

The EU AI Act was published in the EU Official Journal on July 12, 2024, and is the

first comprehensive horizontal legal framework for the regulation of AI across the EU.

The EU AI Act enters into force on August 1, 2024, and will be effective from August

2, 2026, except for the specific provisions listed in Article 113. 1

The AI Liability Directive is in draft form and is yet to be considered by the European

Parliament and Council of the EU. Timing remains uncertain.2

## Related laws affecting AI

There are many laws applicable in the EU that may affect the development or use of AI

in the EU. A non-exhaustive list of common examples includes:

The EU General Data Protection Regulation (EU) 2016/679


-----

software (including AI software) to receive compensation from the software
manufacturer (replacing Directive 85/374/EEC)

The General Product Safety Regulation 2023/988/EU, replacing Directive
2001/95/EC

Various intellectual property laws under the national laws of EU Member States

## Definition of “AI”

AI is defined in the EU AI Act using the following terms:

"AI system" means "a machine-based system that is designed to operate with
varying levels of autonomy and that may exhibit adaptiveness after deployment, and
that, for explicit or implicit objectives, infers, from the input it receives, how to
generate outputs such as predictions, content, recommendations, or decisions that
can influence physical or virtual environments"

"General-purpose AI model" means "an AI model, including where such an AI
model is trained with a large amount of data using self-supervision at scale, that
displays significant generality and is capable of competently performing a wide
range of distinct tasks regardless of the way the model is placed on the market and
that can be integrated into a variety of downstream systems or applications, except
AI models that are used for research, development or prototyping activities before
they are placed on the market"

"General-purpose AI system" means "an AI system which is based on a generalpurpose AI model and which has the capability to serve a variety of purposes, both
for direct use as well as for integration in other AI systems"[3]

The AI Liability Directive will likely adopt the same definition as the EU AI Act.[4]

## Territorial scope

The EU AI Act applies extraterritorially to:[5]

Any provider placing, or otherwise putting into service, an AI system or generalpurpose AI models on the EU market, regardless of whether the provider is
established or located within the EU or in a third country

Any deployers of AI systems who have their place of establishment in, or who are
located in, the EU


-----

are otherwise located in a third country, if the output produced by the AI system is
intended to be used in the EU[6]

The AI Liability Directive applies to non-contractual fault-based civil law claims within

the EU.[7]

## Sectoral scope

The EU AI Act is not sector-specific. It applies to all sectors.

The AI Liability Directive is not sector-specific. It applies to non-contractual fault-based

civil law claims brought before national courts.

## Compliance roles

Under the EU AI Act:

Any developer of an AI system or general-purpose AI model, or any natural or legal
person, public authority, agency or other body that has an AI system or generalpurpose AI model developed and places them or puts the system into service on
the EU market are "providers" under the AI Act[8]

Any natural or legal person in the supply chain that is not a provider or importer and
makes an AI system available on the EU market is a "distributor" under the AI Act[9]

Any natural or legal person located or established in the Union that places on the
market an AI system that bears the name or trademark of a natural or legal person
established in a third country are "importers" under the AI Act[10]

Any natural or legal person, public authority, agency or other body using an AI
system under its authority except where the AI system is used in the course of a
personal non-professional activity are "deployers" under the AI Act[11]

Any provider, product manufacturer, deployer, importer, distributor or authorized
representative are "operators" under the AI Act[12]

Each of these roles comes with a set of compliance obligations.

The AI Liability Directive would increase the likelihood of a successful claim against an

AI system developer or the user of an AI system that relied on its output.[13]

## Core issues that the AI Regulations seek to address


-----

and to ensure a high level of protection of health, safety, fundamental rights,

democracy, and rule of law from harmful effects of AI systems while supporting

innovation and the functioning of the internal market.[14]

The AI Liability Directive aims to ensure that persons harmed by AI systems enjoy the

same level of protection as persons harmed by other technologies in the EU. Current

fault-based liability rules are not suited to handling liability claims for damage caused

by AI-enabled products and services. Specifically, it may be difficult (or prohibitively

expensive) for victims to prove the fault of a potentially liable person, and/or the causal

link between the fault and the damage suffered, owing to the complexity, autonomy

and opacity of AI systems.

## Risk categorization

The EU AI Act classifies AI systems, and imposes requirements, according to different

levels of risk:

**Unacceptable risk: AI systems that present an "unacceptable" risk are**
prohibited. This includes (among others) AI systems used for social scoring and AI15
systems that use deceptive or exploitative techniques to materially distort a
person’s behavior in a manner that can cause harm.16


**High risk: AI systems that present a "high" risk are subject to the most detailed**
compliance obligations under the EU AI Act and include AI systems falling within
two categories: (i) AI systems used as a safety component of a product (or
otherwise subject to EU health and safety harmonization legislation); or (ii) AI
systems deployed in eight specific areas, including (among others) education,
employment, access to essential public and private services, law enforcement,
migration, and the administration of justice.[17]

**Limited risk: AI systems that present "limited" risk include those that directly**
interact with natural persons (e.g., chatbots), emotion recognition systems,
biometric categorization systems, and AI systems that generate "deep fakes" (i.e.,
audio or visual content that appears genuine, even though it is created by an AI
system). These systems are required to disclose the fact that the content has been
artificially generated or manipulated.18 The transparency obligations imposed on

deployers of these AI systems do not apply where the use is authorized by law to
detect, prevent, investigate and prosecute criminal offenses. If the content is
"evidently" an artistic, creative, satirical, fictional analogous work or program, these
obligations are limited to the disclosure of existence of "deep fakes" in an
appropriate manner that does not hamper the display or environment of the work.19


-----

risk.[20]

For general-purpose AI models, the EU AI Act distinguishes between those that

entail a systemic risk and those that do not. If the computational power of the general
purpose AI model exceeds a certain threshold, the AI model is presumed to entail a

systemic risk. In addition, the European Commission has the power to designate

certain general-purpose AI models as having systemic risk.[21]

The AI Liability Directive does not directly govern the risks posed by AI systems.

## Key compliance requirements

Compliance obligations are primarily determined by the level of risk associated with

the relevant AI system:

**Unacceptable risk: AI systems posing an unacceptable risk are not subject to**
compliance requirements; they are prohibited outright

**High risk: AI systems and their providers (or where applicable, the authorized**
representative) must be registered in an EU database before being placed onto the
EU market or put into service, and must comply with a wide range of requirements
on data training and data governance, technical documentation, recordkeeping,
technical robustness, transparency, human oversight, and cybersecurity[22]

**Limited risk: Providers and deployers of certain AI systems and general-purpose AI**
models are subject to transparency obligations[23]

**Low or minimal risk: AI systems do not have specific obligations or requirements**
under the EU AI Act[24]

All providers of general-purpose AI models are subject to certain technical

documentation and transparency obligations and are required to cooperate with the

Commission and national competent authorities as well as respect national laws on

copyright and related rights.25 Compliance may be demonstrated through adhering to


approved codes of practice.26 Providers of general-purpose AI models with systemic

risk have additional obligations, including the obligations to perform standardized

model evaluations, assess and mitigate systemic risks, track and report incidents, and

ensure cybersecurity protection.27

The EU AI Act also provides for the development of codes of conduct for AI systems,

which the Commission hopes all AI system providers will voluntarily apply.[28]


-----

## Regulators

Enforcement of the EU AI Act involves a combination of authorities. EU Member

States will establish or designate at least one notifying authority and at least one

market surveillance authority (together, the "national competent authorities") and

ensure that the national competent authorities have adequate technical, financial and

human resources, and infrastructure (that are sufficiently knowledgeable) to fulfill its

tasks under the EU AI Act.[29]

The notifying authority is responsible for setting up and carrying out the assessment

and designation procedures that are required under the EU AI Act, in an objective and

impartial manner.[30]

The market surveillance authority may vary for "high" risk AI systems, AI systems used

by financial institutions subject to EU legislation on financial services, and other EU

institutions, agencies, and bodies.[31]

The market surveillance authority is primarily responsible for enforcement at the

national level.32 If an AI system is non-compliant, the market surveillance authorities

can exercise the enforcement powers described below. The market surveillance

authorities will report to the Commission and relevant national competition authorities

on an annual basis.33

Additionally, an AI Office within the Commission will enforce the common rules across

the EU.34 Enforcement will be supported by a scientific panel of independent


experts.35 An AI Board with Member States' representatives will advise and assist the

Commission and Member States on the consistent and effective application of the AI

Act.36 Finally, an advisory forum for stakeholders will provide technical expertise to the

AI Board and the Commission.37

National courts of EU Member States will be responsible for implementing the AI

Liability Directive in the case of non-contractual fault-based civil law claims brought

before them.

## Enforcement powers and penalties


-----

obligations of the EU AI Act; or (ii) compliance from a high-risk AI system with the

obligations of the EU AI Act, but still presents a risk to the health and safety of

persons, the fundamental rights of persons, or other aspects of public interest

protection; then the relevant market surveillance authority can (a) require the relevant

operator to take all appropriate corrective actions (in the event of (ii), to ensure the AI

system concerned no longer presents that risk) or withdraw/recall the AI system from

the market; or (b) where the operator fails to do so, the relevant authority shall

prohibit/restrict the AI system being made available on its national market or put into

service, or withdraw/recall the product or the standalone AI system from the market.[38]

Penalties range from (i) the higher of €35,000,000 or up to 7 percent of a company’s

total worldwide annual turnover for non-compliance with prohibited AI practices, to (ii)

the higher of €7,500,000 or up to 1 percent of a company’s total worldwide annual

turnover for the supply of incorrect, incomplete, or misleading information to notified

bodies and national competent authorities.[39]

The AI Liability Directive increases the claimants’ likelihood of a successful claim by

creating a rebuttable presumption of causality on the defendant. In practice, the new

rule means that if a victim can show that someone was at fault for not complying with

a certain obligation relevant to their harm, and that a causal link with the AI

performance is reasonably likely, the court can presume that this non-compliance

caused the damage.[40]


-----

evidence about high risk AI systems that are suspected of causing damage, to help

victims access relevant evidence to identify the person(s) that could be held liable.[41]

[1 See EU AI Act, Article 113.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[2 See Procedure File: 2022/0303(COD) | Legislative Observatory | European Parliament (europa.eu).](https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2022/0303(COD)&l=en)

[3 See EU AI Act, Articles 3(1), 3(63) and 3(66).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[4 See AI Liability Directive, Article 2(1).](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0496)

[5 See EU AI Act, Articles 2(1)(a) to (c). Responsibilities along the AI value chain (including distributors, importers,](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

deployers) are set out in Article 25.

[6 See EU AI Act, Recital 22.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[7 See AI Liability Directive. Article 1(2).](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0496)

[8 See EU AI Act, Article 3(3).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[9 See EU AI Act, Article 3(7).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[10 See EU AI Act, Article 3(6).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[11 See EU AI Act, Article 3(4).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[12 See EU AI Act, Article 3(8).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[13 See AI Liability Directive, Article 4(b).](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0496)

[14 See "Purpose" in the Procedure File: printficheglobal.pdf (europa.eu); and EU AI Act, Article 1(1).](https://oeil.secure.europarl.europa.eu/oeil/popups/printficheglobal.pdf?id=725395&l=en)

[15 See EU AI Act, Recital 179.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[16 See EU AI Act, Article 5.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[17 See EU AI Act, Article 6(1), (2) and Annex I, Annex III.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[18 See EU AI Act, Articles 50(1) to 50(4).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[19 See EU AI Act, Article 50(4).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[20 See page 4 of the briefing note.](https://www.europarl.europa.eu/RegData/etudes/BRIE/2021/698792/EPRS_BRI(2021)698792_EN.pdf)

[21 See EU AI Act, Article 51.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[22 See EU AI Act, Articles 8-15 and 49.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[23 See EU AI Act, Article 50.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[24 See page 4 of the briefing note.](https://www.europarl.europa.eu/RegData/etudes/BRIE/2021/698792/EPRS_BRI(2021)698792_EN.pdf)

[25 See EU AI Act, Article 53.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[26 See EU AI Act, Article 56.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[27 See EU AI Act, Article 55.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[28 See EU AI Act, Chapter X (Codes of Conduct and guidelines).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[29 See EU AI Act, Article 70.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[30 See EU AI Act, Article 31(6).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[31 See EU AI Act, Article 74(6).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)


-----

[34 See EU AI Act, Article 64.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[35 See EU AI Act, Article 68.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[36 See EU AI Act, Article 65 and 66.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[37 See EU AI Act, Article 67.](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

[38 See EU AI Act, Articles 79(2) and 82 (1).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[39 See EU AI Act, Articles 99(3) and (5).](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689)

[40 See AI Liability Directive, Article 4(1).](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0496)

[41 See AI Liability Directive, Article 3(1).](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0496)

Timo Gaudszun (Legal Intern, White & Case, Berlin), Jeffrey Shin (Trainee Solicitor,

White & Case, London) and Daniel Mair (Trainee Solicitor, White & Case, Paris)

contributed to this publication.

White & Case means the international legal practice comprising White & Case LLP, a New York State registered

limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all

other affiliated partnerships, companies and entities.

This article is prepared for the general information of interested persons. It is not, and does not attempt to be,

comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.

© 2024 White & Case LLP


-----

