The European Parliament approves the AI act

On 13 March 2024, the European Parliament approved the artificial intelligence act. Its obligations would take effect in stages between 2025 and 2027, so companies would have a period in which to adapt. It was a pioneering regulation in its scope, and its effects were expected beyond Europe, because it would affect any company that offers or uses these systems in the European market.

Artificial intelligence has ceased to be a matter for laboratories and become an everyday tool: writing assistants, staff selection systems, customer analysis, process automation. Each of those applications raises different questions of safety, transparency and protection of people, and the new rule tries to organise them with a common criterion. Understanding it in good time makes it possible to prepare without surprises. The aim is not to become an expert but to know what questions to ask.

A risk-based approach

The law scales its obligations to the risk posed by each use of artificial intelligence: the higher the risk, the more demanding the requirements. It is a reasonable approach, because a system that recommends a song is not the same as one that helps decide whether a person gets credit or a job. High-risk uses require more controls, documentation and human oversight. The aim is to protect people’s rights without holding back useful innovation.

That is why its application would be staggered over time, with different deadlines depending on the type of obligation. This gradual timetable gives companies and administrations room to adapt their processes, but it also demands that preparation not be left to the last moment. Anyone who waits until the deadline approaches risks finding suppliers and advisers overloaded, and bearing higher costs.

What changes for companies

Any company using AI in Europe would need to know which risk category each use falls into. That affects both those who develop these tools and those who buy them or build them into their work processes. It is not enough to buy a solution: the user also has responsibilities, for example regarding oversight of the results and information to the people affected. The higher the risk, the more detailed that responsibility will need to be.

For a small business, the practical implication is that it is worth knowing which tools are in use, even if they come built into everyday programs. Sometimes artificial intelligence is present without anyone having decided so expressly: in an email manager, in a CV-screening program or in a customer-service system. Knowing those uses is the first step in assessing whether the rule affects them.

Where to start

A sensible first step is to list which AI tools the company uses, for what and with which data, and to review supplier contracts. It is worth asking each supplier how it plans to comply with the rule, what documentation it will provide and who bears responsibility if something fails. Those answers, in writing, help to organise the obligations of each party. A well-drafted contract avoids disputes when accounts are demanded.

After that, each use can be classified by risk level, a responsible person appointed and simple internal rules set on what may be done with these tools and what data should not be entered into them. Preparing in good time is cheaper than adapting in a hurry, and usually improves the quality of processes along the way. A legal adviser can help specify the steps according to each company’s sector. It is also worth following the guidance published by the authorities, which usually clarifies questions of application.

Complying early costs less than correcting late.

This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.