The European Parliament gave final approval on Wednesday to wide-ranging EU rules to govern artificial intelligence, including powerful systems like OpenAI's ChatGPT.
Senior European Union officials say the rules, first proposed in 2021, will protect citizens from the possible risks of a technology developing at breakneck speed, while also fostering innovation on the continent.
Brussels has sprinted to pass the new law since OpenAI's Microsoft-backed ChatGPT arrived on the scene in late 2022, unleashing a global AI race.
There was a burst of excitement for generative AI as ChatGPT wowed the world with its human-like capabilities -- from digesting complex text to producing poems within seconds, or passing medical exams.
Further examples of generative AI models include DALL-E and Midjourney, which produce images, while other models produce sounds from a simple input in everyday language.
The far-reaching regulation passed with the support of 523 lawmakers in the European Parliament in Strasbourg, France, with 46 voting against.
The EU's 27 states are expected to endorse the text in April before the law is published in the EU's Official Journal in May or June.
EP President Roberta Metsola said the law "means leadership, innovation & new avenues. But equally respect for fundamental rights."
"Today is again an historic day on our long path towards regulation of AI," said Brando Benifei, an Italian lawmaker who pushed the text through parliament with Romanian MEP Dragos Tudorache.
"(This is) the first regulation in the world that is putting a clear path towards a safe and human-centric development of AI," Benifei added, speaking just before the vote.
"We managed to find that very delicate balance between the interest to innovate and the interest to protect," Tudorache told journalists before the vote.
The EU's internal market commissioner, Thierry Breton, hailed the vote.
"I welcome the overwhelming support from the European Parliament for the EU AI Act," he said. "Europe is now a global standard-setter in trustworthy AI."
Rules covering AI models like ChatGPT will enter into force 12 months after the law becomes official, while companies must comply with most other provisions in two years.
- AI policing restrictions -
The EU's rules known as the "AI Act" take a risk-based approach: the riskier the system, the tougher the requirements -- with outright bans on the AI tools deemed to carry the most threat.
For example, high-risk AI providers must conduct risk assessments and ensure their products comply with the law before they are made available to the public.
"We are regulating as little as possible and as much as needed, with proportionate measures for AI models," Breton told AFP.
Violations can see companies hit with fines ranging from 7.5 million to 35 million euros ($8.2 million to $38.2 million), depending on the type of infringement and the firm's size.
There are strict bans on using AI for predictive policing and systems that use biometric information to infer an individual's race, religion or sexual orientation.
The rules also ban real-time facial recognition in public spaces but with some exceptions for law enforcement, although police must seek approval from a judicial authority before any AI deployment.
Lobbies vs watchdogs
Since AI will likely transform every aspect of Europeans' lives and big tech firms are vying for dominance in what will be a lucrative market, the EU has been subject to intense lobbying over the legislation.
Watchdogs on Tuesday pointed to campaigning by French AI startup Mistral AI and Germany's Aleph Alpha as well as US-based tech giants like Google and Microsoft.
They warned the implementation of the new rules "could be further weakened by corporate lobbying", adding that research showed "just how strong corporate influence" was during negotiations.
"Many details of the AI Act are still open and need to be clarified in numerous implementing acts, for example, with regard to standards, thresholds or transparency obligations," three watchdogs based in Belgium, France and Germany said.
Commissioner Breton stressed that the EU "withstood the special interests and lobbyists calling to exclude large AI models from the regulation", adding: "The result is a balanced, risk-based and future-proof regulation."
Lawmaker Tudorache said the law was "one of the... heaviest lobbied pieces of legislation, certainly in this mandate", but insisted: "We resisted the pressure."
What's included in the new EU law on AI
The European Parliament on Wednesday gave the final nod to far-reaching rules on artificial intelligence that the EU hopes will both harness innovation and defend against harms.
The law, known as the "AI Act", was first proposed in April 2021 by the European Commission, the EU's executive arm.
But it was only after Microsoft-funded ChatGPT burst onto the scene in late 2022 that the real AI contest began -- and also the race to regulate.
China and the United States last year introduced regulation on AI but the European Union's law is the most comprehensive.
The EU will take a staggered approach to applying the law.
Outright bans on forms of AI considered highest-risk will kick in later this year, while rules on systems like ChatGPT will apply 12 months after the law enters into force, and the rest of the provisions in 2026.
As EU negotiators debated the text, tensions within and lobbying from outside were at their highest over how to regulate general-purpose AI models, like chatbots.
Developers of such models will have to give details about what content they used -- such as text or images -- to train their systems and comply with EU copyright law.
There are a greater set of requirements for models, for example OpenAI's latest ChatGPT-4 and Google's Gemini, that the EU says pose "systemic risks."
Those risks could include causing serious accidents, being misused for far-reaching cyberattacks, or to propagate harmful biases online.
Companies offering these technologies must assess and mitigate the threats, track and report serious incidents -- like deaths -- to the commission, take action to ensure cybersecurity and give details about their models' energy consumption.
The commission has already established the AI office that will enforce the rules on general-purpose AI.
- Risk-based approach -
The EU looks at AI systems from the perspective of risk to democracy, public health, rights and the rule of law.
High-risk products such as medical devices, those used in education or systems used in key infrastructure like water, face more obligations to mitigate any danger.
For example, high-risk providers must develop the systems with quality data, ensure human oversight and maintain robust documentation.
Even after they place their product on the market, providers have to keep a close eye.
EU citizens will have the right to complain about AI systems, while public bodies must register the high-risk AI systems they deploy in a public EU database.
Breaking the rules can be costly.
The EU can slap AI providers with fines ranging between 7.5 million and 35 million euros ($8.2 million and $38.2 million), or between 1.5 and seven percent of a company's global turnover, depending on the size of the violation.
The rules also stipulate that citizens should be aware when they are dealing with AI.
For example, deepfake images produced using AI must be labelled as such while chatbots must say that they are AI-powered in their interactions.
- Bans -
There are some types of AI banned by the EU because the risks they pose are considered too great.
These include predictive policing, emotion recognition systems in workplaces or schools and social scoring systems that assess individuals based on their behaviour.
The law also bans police officers using real-time facial recognition technology, with exceptions for law enforcement if they are searching for an individual convicted or suspected of a serious crime, such as rape or terrorism.
Police can ask to use the technology to find victims of kidnapping or trafficking -- subject to approval from a judge or another judicial authority, and for a use limited in time and location.