EU Parliament passes landmark AI law

Termed as a key development, the EU AI Act is expected to classify tiers of risks and requirements for how AI technologies within each category need to be operated. It also requires human oversight and data governance of systems, as well as technical documentation of how those systems work so they can be understood.

The legislation sailed by 523-46 on 13 March in what was largely seen as a procedural vote, preceded by a unanimous vote from EU member states in February, nearly three years after the European Commission first proposed a regulatory framework for artificial intelligence.

MEPs have praised passage of the law, saying it’s “the first regulation in the world that is putting a clear path towards a safe and human-centric development of AI.”

The act imposes various legal and transparency obligations on tech companies and AI developers operating within Europe. This includes those in the creative sector and music industry. One key requirement is that companies using generative AI or foundational AI models like OpenAI’s ChatGPT or Anthropic's Claude 2 must provide comprehensive summaries of copyrighted works, including music, that they have utilised to train their systems.

Large tech companies that violate these rules, which apply to all AI applications within the 27-member EU block, including “high-risk” uses, could face fines of up to 35 million euros ($38 million) or up to 7% of their global annual revenue. Startups and smaller tech operations will receive proportionate financial penalties.

Importantly, the law’s transparency provisions apply irrespective of where a tech company sourced its data from around the world. For example, if an AI developer obtained copyright-protected digital music from a non-EU country or purchased datasets from outside the EU member states, they would still be required to publicly disclose a “sufficiently detailed summary” of all copyright-protected music used to create AI works once these are used within Europe.

A number of music industry groups have welcomed the passing of the new law. They include the International Confederation of Societies of Authors and Composers (CISAC), the International Confederation of Societies of Authors and Composers (ICMP), the International Federation of the Phonographic Industry (IFPI), the Independent Music Publishers International Forum (IMPF) and the Independent Music Companies Association, originally the Independent Music Publishers and Labels Association (IMPALA). 

“While these obligations provide a first step for rightsholders to enforce their rights, we call on the European Parliament to continue to support the development of responsible and sustainable AI by ensuring that these important rules are put into practice in a meaningful and effective way, aligned with the objectives of the regulation,” the group said in a joint statement.

“To achieve this, it is essential that the template for the sufficient level of information that General Purpose AI model providers must make available enables effective exercise and enforcement of copyright and other fundamental rights, and that creative sectors and rightsholders are formally and directly involved in its drafting.”

However, according to the International Association of Privacy Professionals (IAPP), analysts say the final vote is just the beginning of a long road of further rulemaking, delegating and legalese wrangling, several staggered deadlines that will govern when certain provisions take effect.

Prohibitions on AI with “unacceptable” levels of risk do not kick in until six months after the act is published. It will be a full year before the rules around how general purpose AI take effect, and another two years after that before all rules of the act and obligations for high-risk systems apply.

Nevertheless, the EU can stake a claim as an AI regulator as other countries seek the best path to govern the nascent technology. EU Commissioner for Internal Market Thierry Breton nodded to the significance of those rules on social media, predicting “it would become a model others would follow.”

“Europe is now a global standard-setter in AI," Breton said on LinkedIn. “We are regulating as little as possible — but as much as needed.”

According to the IAPP, one point of ongoing contention is the use of biometric cameras. A total ban on law enforcement's use of untargeted AI-powered facial recognition technology was a key sticking point for the Center for Democracy and Technology.