On 13 March 2024, the European Parliament approved the Regulation on Artificial Intelligence (“the Regulation”). This is the world's first piece of legislation that aims to comprehensively regulate artificial intelligence (“AI”). Formal approval of the final text of the Regulation by the Council is expected by the end of April, after which the Regulation will be published in the Official Journal. A vast majority of the Regulation will enter into force 24 months after publication. We also remind you that the Regulation is directly effective, which means that persons on the territory of the Czech Republic will derive rights and obligations directly from it, regardless of national legislation.

The Regulation harmonises the rules for the placing AI on the EU market, putting it into service and for its use. A significant part of the Regulation is also devoted to systems whose practices are considered by the European Union (“EU”) to be so harmful that the Regulation expressly prohibits their placing on the market, putting into service or use. 

In this article, we will give you an overview of who will be covered by the ban and which AI systems will be banned in the EU. You can also look forward to further publications on AI Regulation, in which we will discuss permitted AI systems and the conditions for their marketing, operation and use in the EU depending on their risk profile.

Responsible persons

The persons who, in accordance with the Regulation, are responsible for compliance with the prohibition of placing on the market, putting into service or use of AI engaging in unsafe practices are in particular: 

• people who provide, deploy or import and distribute AI in the EU;
• authorised representatives of non-EU based AI providers;
• persons placing artificial intelligence on the market together with their product.

Deployment means any use of the AI system except for purely private, non-professional use. In other words, an ordinary Internet user – a consumer – will not be a responsible person within the meaning of the Regulation, even if he or she uses AI to generate and disseminate dangerous content, such as alarm messages or otherwise misleading information. However, criminal or civil liability of such persons cannot be excluded.

In contrast, persons who use AI in the course of their business, e.g. to communicate with consumers or generate content, will be liable for compliance with the prohibition on unsafe AI functions, regardless of whether or not they have access to the source code of the system in question – and therefore a real ability to influence the operation of the system in use.

Exceptions

The following are explicitly excluded from the scope of the Regulation – including the provisions on prohibited practices:

• systems designed exclusively for military or defence and national security purposes;
• systems intended exclusively for the purposes of scientific research and development;
• use of AI in the context of international cooperation, judicial cooperation or law enforcement cooperation with third countries or international organisations, provided that the third country or international organisation provides adequate safeguards to protect the fundamental rights and freedoms of individuals;
• AI research, testing and development activities prior to commercialisation or putting into service, subject to testing in real-world conditions.

Prohibited practices

The Regulation generally prohibits AI functions that manipulate humans to their detriment or to the detriment of others, or that constitute an unacceptable intrusion into a person’s private sphere.

Manipulative AI

AI functions that use subliminal techniques outside of a person’s awareness or deliberately manipulative or deceptive techniques with the purpose or effect of substantially disrupting the behavior of a person or group of persons are prohibited.

Substantial impairment of a person’s behaviour is defined as a significant impairment of the person’s ability to make informed decisions, resulting in the person making a decision that he or she would not otherwise have made, with the result that either the affected person or another person or group of persons suffers significant harm.

In practice, this category could include especially:

• systems that create subliminal or otherwise manipulative advertising;
• systems that generate fake news;
• systems that generate messages inciting hatred towards certain persons or groups of persons.

Abusive AI

The prohibition also applies to AI functions that exploit the weaknesses of a person or group of persons by reason of age, disability, or special social or economic circumstances, if the purpose or effect of that exploitation is to substantially disrupt the behaviour of that person or group of persons in a way that causes or is likely to cause them significant harm.

In particular, this category will include systems that generate content that leads people who are easily influenced to behave in ways that are harmful to them, such as substance abuse or gambling. Generating content with the purpose or effect of extorting undue monetary or non-monetary consideration from an easily influenced person would also fall into this category.

Profiling AI

The Regulation prohibits AI systems used to

• evaluate and classify individuals based on their known or perceived personal characteristics for the purpose of so-called social profiling;
• predicting the likelihood of committing a crime based solely on the personal characteristics of the person in question;
• the categorisation of persons on the basis of their biometric data in order to derive sensitive data about them.

Thus, in compliance with the Regulation, a system similar to the one that has been in place in China for several years, which, based on an ongoing assessment of people’s socio-economic behaviour, allows for the imposition of sanctions, disciplinary measures and restrictions not directly related to the observed behaviour, should not be introduced in the EU.

Tracking AI

The ban also applies to systems

• of real-time biometric identification of persons, except for identification for the strict purpose of combating and preventing particularly serious crimes (e.g. trafficking in human beings, terrorist attacks, violent crime including sexual violence);
• creating or enhancing facial recognition databases by retrieving facial images from the Internet or from CCTV footage.

Recourse

Violations of the above prohibitions are subject to severe financial penalties. The person responsible may be fined up to EUR 35 000 000 or, if the offender is a company, up to 7% of the total worldwide annual turnover for the preceding financial year, whichever amount is higher. Furthermore, the Regulation explicitly allows the fine to coincide with any other penalties under national law.