When European lawmakers reached a provisional deal on landmark artificial intelligence rules<\/a> last week, they had reason to celebrate.<\/p>\n<\/div>\n The EU AI Act reached a long-awaited climax on Friday<\/a> following not only two years of broad discussion but a three-day \u201cmarathon\u201d debate between the European Commission, the European Parliament, and EU member states to iron out disagreements. All-nighters were pulled<\/a>. Bins overflowed with the remnants of coffee, energy drinks, and sugary snacks<\/a>. It was the kind of environment you\u2019d expect from students cramming for finals, not lawmakers working on legislation that could set a blueprint for global AI regulation. The chaos was largely thanks to two contentious issues that threatened to derail the entire negotiation: facial recognition and powerful \u201cfoundation\u201d models.<\/p>\n<\/div>\n When the AI Act was first proposed in April 2021<\/a>, it was intended to combat \u201cnew risks or negative consequences for individuals or the society\u201d that artificial intelligence could cause. The act focused on tools already being deployed in fields like policing, job recruitment, and education. But while the bill\u2019s overall intent didn\u2019t change, AI technology did<\/em> \u2014 and rapidly. The proposed rules were ill-equipped to handle general-purpose systems broadly dubbed foundation models, like the tech underlying OpenAI\u2019s explosively popular ChatGPT<\/a>, which launched in November 2022.<\/p>\n<\/div>\n Much of the last-minute delay stemmed from policymakers scrambling to ensure these new AI technologies \u2014 as well as yet-undeveloped future ones \u2014 fell under the legislation\u2019s scope. Rather than simply regulating every area they might appear in (a list including cars, toys, medical devices, and far more), the act used a tier system that ranked AI applications based on risk<\/a>. \u201cHigh risk\u201d AI systems that could impact safety or fundamental rights were subjected to the most onerous regulatory restrictions. Moreover, General Purpose AI Systems (GPAI) like OpenAI\u2019s GPT models faced additional regulations. The stakes of that designation were high \u2014 and accordingly, debate over it was fierce.<\/p>\n<\/div>\n \u201cAt one point, it looked like tensions over how to regulate GPAI could derail the entire negotiation process,\u201d says Daniel Leufer, senior policy analyst at Access Now, a digital human rights organization. \u201cThere was a huge push from France, Germany, and Italy to completely exclude these systems from any obligations under the AI Act.\u201d<\/p>\n<\/div>\n Those countries, three of Europe\u2019s largest economies, began stonewalling negotiations in November<\/a> over concerns that tough restrictions could reduce innovation<\/a> and harm startups developing foundational AI models in their jurisdictions. Those concerns clashed with other EU lawmakers who sought to introduce tight regulations regarding how they can be used and developed. This last-minute wrench thrown into the AI Act negotiations contributed to delays in reaching an agreement, but they weren\u2019t the only sticking point.\u00a0<\/p>\n<\/div>\n In fact, it seems a sizable amount of the actual legislation remained unsettled even days before the provisional deal was made. At a meeting between the European communications and transport ministers on December 5th<\/a>, German Digital Minister Volker Wissing said that \u201cthe AI regulation as a whole is not quite mature yet.\u201d<\/p>\n<\/div>\n GPAI systems faced requirements like disclosing training data, energy consumption, and security incidents, as well as being subjected to additional risk assessments. Unsurprisingly, OpenAI<\/a> (a company known for refusing to disclose details about its work<\/a>), Google<\/a>, and Microsoft all lobbied the EU<\/a> to water down the harsher regulations. Those attempts seemingly paid off. While lawmakers had previously considered categorizing all<\/em> GPAIs as \u201cHigh risk,\u201d the agreement that was reached last week instead subjects them to a two-tier system that allows companies some wiggle room to avoid AI Act\u2019s harshest restrictions. This, too, likely contributed to the last-minute delays<\/a> being hashed out in Brussels last week.<\/p>\n<\/div>\n \u201cIn the end, we got some very minimal transparency obligations for GPAI systems, with some additional requirements for so-called \u2018high-impact\u2019 GPAI systems that pose a \u2018systemic risk\u2019,\u201d says Leufer \u2014 but there\u2019s still a \u201clong battle ahead to ensure that the oversight and enforcement of such measures works properly.\u201d<\/p>\n<\/div>\n There\u2019s one much tougher category, too: systems with an \u201cunacceptable\u201d risk level, which the AI Act effectively bans outright. And in negotiations down to the final hours, member states were still sparring over<\/a> whether this should include some of their most controversial high-tech surveillance tools.<\/p>\n<\/div>\n The European Parliament initially greenlit a total ban on biometric systems for mass public surveillance<\/a> in July. That included creating facial recognition databases by indiscriminately scraping data from social media or CCTV footage; predictive policing systems<\/a> based on location and past behavior; and biometric categorization based on sensitive characteristics like ethnicity, religion, race, gender, citizenship, and political affiliation. It also banned both real-time and retroactive remote biometric identification, with the only exception being to allow law enforcement to use delayed recognition systems to prosecute \u201cserious crimes\u201d following judicial approval. The European Commission and EU member states contested it<\/a> and won concessions \u2014 to some critics\u2019 consternation<\/a>.<\/p>\n<\/div>\n The draft approved on Friday includes exceptions that permit limited use of automated facial recognition, such as cases where identification occurs after a significant delay. It may also be approved for specific law enforcement use cases involving national security threats, though only under certain (currently unspecified) conditions. That\u2019s likely appeased bloc members like France, which has pushed to use AI-assisted surveillance to monitor things like terrorism<\/a> and the upcoming 2024 Olympics in Paris<\/a>, but human rights organizations like Amnesty International have been more critical of the decision.<\/p>\n<\/div>\n \u201cIt is disappointing to see the European Parliament succumb to member states\u2019 pressure to step back from its original position,\u201d said Mher Hakobyan<\/a>, advocacy adviser on AI regulation at Amnesty International. \u201cWhile proponents argue that the draft allows only limited use of facial recognition and subject to safeguards, Amnesty\u2019s research in New York City, Occupied Palestinian Territories<\/a>, Hyderabad<\/a>, and elsewhere demonstrates that no safeguards can prevent the human rights harms that facial recognition inflicts, which is why an outright ban is needed.\u201d<\/p>\n<\/div>\n To make things even more complicated, we can\u2019t delve into which specific<\/em> compromises were made, because the full approved AI Act text won\u2019t be available for several weeks. Technically, it probably doesn\u2019t officially exist internally within the EU yet at all<\/em>. Compromises for these agreements are often based on principles rather than exact wording, says Michael Veale<\/a>, an associate professor for digital rights and regulation at UCL Faculty of Laws. That means it could take some time for lawmakers to refine the legal language.<\/p>\n<\/div>\n Also, because only a provisional agreement was reached, the final legislation is still subject to change. There\u2019s no official timeline available, but policy experts appear fairly unanimous with their estimations: the AI Act is expected to become law by mid-2024 following its publication in the EU\u2019s official journal, with all provisions coming into force gradually over the next two years.<\/p>\n<\/div>\n That gives policymakers some time to work out exactly how these rules will be enforced. AI companies can also use that time to ensure their products and services will be compliant with the rules when provisions come into effect. Ultimately, that means we might not see everything within the AI Act regulated until mid-2026. In AI development years, that\u2019s a long time<\/em> \u2014\u00a0so by then, we may have a whole new set of issues to deal with.\u00a0<\/p>\n<\/div>\n<\/div>\nFrance, Germany, and Italy sought last-minute compromises for foundation AI models<\/h4>\n<\/p>\n
An outright ban on facial recognition AI systems was fiercely contested <\/h4>\n<\/p>\n