EU and UK: Technology Law Shorts

Commercial technology on the horizon: what do I need to know?

EU: AI Act expected to become law this summer

On 21 May, the Council of the EU approved the EU AI Act (Act). It is expected to become law in early July this year, and will be rolled out in stages. The AI Act applies to various entities, including businesses in the EU’s 27 Member States, and non-EU businesses with EU customers. It also affects any business operating in the European Economic Area or whose AI system outputs are used there.

Relevant timelines:

• By the end of 2024, the Act will start to control certain risky uses of AI, like manipulative tactics, social scoring and creating facial-recognition databases. If these rules are broken, fines could be as high as €35 million or 7% of worldwide turnover;
• By the summer of 2025, the Act will control general-purpose AI models - models that pose a “systemic risk” will be subject to extra rules, like needing to evaluate the model, assess risks and monitor incidents. If these rules are broken, fines could be as high as €15 million or 3% of worldwide turnover;
• By summer 2026, the AI Act will regulate high-risk AI, which includes AI components in products subject to EU safety regulations; and
• By summer 2027, high-risk AI systems subject to product safety regulations will be regulated, with penalties for non-compliance similar to other high-risk systems.

Impact: Although the changes will be introduced gradually, prepare now. Teams handling legal, compliance, and risk matters should make their governance and reporting systems more efficient by removing unnecessary overlaps in rules like data protection and AI regulation. Combine different types of assessments to lessen the burden of compliance. Create a variety of use cases to help handle AI-related risks.

EU and UK: Council of Europe adopts global AI treaty

On 17 May, the Council of Europe (CoE) adopted the first global treaty on artificial intelligence (AI). This treaty, which is open to countries outside Europe as well, aims to protect human rights, uphold the rule of law, and maintain democratic standards when using AI. The treaty’s main principles align with those under the EU AI Act, but while the EU AI Act has detailed rules on using AI systems in the EU, the treaty mainly focuses on protecting the human rights of people affected by AI.

The treaty will apply to the 46 CoE members (including the 27 EU Member States and the UK). The treaty mainly aims to control the actions of public authorities, including companies working for them. It also requires parties to manage risks from private companies using AI systems. They can do this by following the same rules or via alternative measures. The treaty has some exceptions; it does not cover: (1) activities related to national security in the lifecycle of AI systems; (2) research and development activities; and (3) national defence matters.

Impact: The treaty asks each member to set up an independent group to make sure everyone follows the treaty’s rules. This group will also help people understand the treaty, encourage public discussions, and consult with different stakeholders on how to use AI technology. The treaty will be ready for signing on 5 September 2024.

UK: Automated Vehicles Act now in force

On 20 May, the Automated Vehicles Act (Act) became law. The law prioritises road safety, expecting to reduce the number of accidents caused by human error. It mandates that autonomous vehicles (AVs) must be as safe as human drivers and pass strict safety checks. This could significantly lower incidents caused by drink driving, speeding, fatigue, and distraction.

Among other things, the Act:

• Sets up a licensing system for self-driving vehicles and introduces the concept of an ‘authorised self-driving entity’ who will hold legal responsibility;
• Defines the ‘user-in-charge’, their liability, and conditions for immunity;
• Grants powers to stop and seize AVs and introduces ‘automated vehicle incident inspectors’ to determine the cause of incidents; and
• Lets the Secretary of State decide which words or symbols can only be used for self-driving cars that are allowed on UK roads - cars that are not allowed to self-drive cannot use these special words or symbols in their marketing (this is to stop misleading ads).

Impact: The success of this Act depends on the introduction of additional laws. These laws will make it clearer how self-driving technologies can be used from 2026 onwards. Further regulatory work is expected in 2024-25: consultations on regulations against deceptive marketing will start later this year. Work on digitising traffic orders will begin in autumn, with the goal of implementing the law by spring 2025. Initial work on the Safety Principles Statement will also start this year, with consultations planned for 2025. Detailed rules on authorisation, operator licensing, and in-use regulation will be developed later.

UK: Online Safety Act - consultation on child protection

The Online Safety Act (OSA) passed into law in October 2023. Among other things, the OSA sets out child safety obligations. On 8 May, Ofcom released its second consultation (closing on 17 July 2024), dealing with Ofcom’s plans for how online platforms and search services should handle their new responsibilities related to content that could harm children.

The consultation covers how to determine if a service is likely accessed by children, the causes and impacts of harms to children, and how services should mitigate these risks. Ofcom proposes various safety measures like robust age checks, algorithms to omit harmful content, strong governance, and clear, accessible information and support for children.

Ofcom anticipates that these measures will improve the online experiences of children:

• Access to pornography will be blocked;
• Children will be shielded from viewing / receiving suggestions for damaging content;
• Children’s consent will be required before adding them to group chats; and
• Processes for children to report harmful content will be simplified.

Impact: Service providers with a large user base will have the most obligations. Final guidance is expected in early 2025, with service providers having three months to carry out assessments. In-scope services should consider responding to the consultation by 17 July 2024.

UK: Regulators publish updates on their AI approaches

On 1 May, the Department for Science, Innovation & Technology published a notice detailing updates from various regulators on their AI strategies, following a government request. Involved regulators included:

• Competition and Markets Authority (CMA): the paper covers the CMA’s approach based on principles like access, diversity, and transparency. It also covers the CMA’s AI capabilities, the Digital Markets, Competition and Consumers Bill’s enforcement powers, collaborations on AI issues, and potential future steps like issuing guidance for AI-related consumer law compliance;
• Equality and Human Rights Commission (EHRC): some key points raised by the EHRC: (1) AI use may potentially result in breaches of the Equality Act 2010 and the Human Rights Act 1998 in many ways; and (2) EHRC is limited by budgetary constraints in its ability to scale-up and respond to risks (see our Flash Update)
• Information Commissioner’s Office (ICO): its strategy recognises AI risks, such as fairness, bias, transparency, safety, and redress. The ICO can intervene anywhere in the AI supply chain to mitigate risks. The strategy includes guidance on AI topics, advice and support services, regulatory actions, and plans for collaboration with stakeholders.
• Ofsted: it will assess AI’s impact on learners during inspections and support AI use that improves education. It expects providers to ensure AI use aligns with five principles: safety, transparency, fairness, accountability, and contestability (see our briefing).

Impact: The UK government will review strategies from all regulators, to ascertain if there’s a need for independent or revised AI laws in the UK. The government has announced support for regulators, including £10 million for AI capabilities, new AI principles guidance, a steering committee proposal, and extra funding for a hub to support AI innovators.

Edited by Kirath Bharya (Knowledge).

Further reading:

• New Generative AI Governance Framework in Singapore
• The EU AI Act: Part two - Cybersecurity, data provenance, and watermarking
• UK's Digital Markets and Consumers Bill podcast series
• The ICO calls for views as part of its consultation series
• Great Britain: Automated Vehicles Bill receives Royal Assent
• Invitation for Public Consultation on Ireland’s Implementation of EU Artificial Intelligence Act
• New UK cybersecurity requirements for consumer connected devices
• Eversheds Sutherland’s legal guide to navigating artificial intelligence