EU and UK: Technology Law Shorts

Commercial technology on the horizon: what do I need to know?

EU: AI Act now in force

On 1 August 2024, the AI Act (Act) came into force. Most rules will be effective from August 2026, although the prohibitions on AI practices that pose unacceptable risks will apply from February 2025. The Act aims to make sure that AI systems are safe, transparent, and used responsibly in the EU. The Act also impacts international organisations offering AI in the EU or affecting EU individuals.

Obligations apply to developers, users, importers, distributors and product manufacturers of AI systems and general-purpose AI models. AI applications are categorised into four risk levels: unacceptable, high risk, limited risk, and low or minimal risk.

Impact: Obligations will be phased in during the next 3 years. If you are developing, supplying, or using AI systems, you should evaluate whether your activities fall under the Act and begin compliance efforts. You should, among other things, make sure that your documentation and framework for compliance meets the Act’s requirements; deliver training to staff to make them aware of the Act’s implications and risks; review your existing AI systems and assess where they fit within the Act’s categories; and update your related internal and external policies.

EU: Feedback sought on protection of minors

On 31 July 2024, the European Commission (EC) issued a consultation seeking feedback on its plans to create guidelines for protecting minors online under the EU Digital Services Act (DSA). Input is sought on what the guidelines should cover and how they should be approached. The consultation closes on 30 September 2024.

These guidelines (to be developed next year) will help online platforms comply with the DSA, ensuring children’s privacy, safety, and security. They will also help authorities in enforcing the DSA. The DSA (which took full effect in February 2024) requires online platforms to take appropriate measures to make the online world safer, fairer, and easier to navigate.

The guidelines will apply to all online platforms, including those aimed at adults but accessed by minors due to inadequate age-verification tools. The main principle is the rights and best interests of the child. The guidelines will adopt a risk-based approach, requiring platforms accessible to minors to conduct regular child-specific impact assessments. Measures to protect minors will vary by platform.

Impact: If you are a provider of an online platform, consider responding to the consultation. The guidelines will enhance the safety of children and young people online. It will lead to a more uniform approach by online platforms in protecting minors. The guidelines’ effectiveness will be assessed in 2027 and may also be subject to further regulatory work and improvement based on changes to online risks, online platform practices, technological developments and scientific research.

UK: Consultation on mobile spoofing and messaging scams

On 29 July 2024, Ofcom released a statement related to its work to stop scam calls from reaching the UK from overseas. As part of this, it also opened a consultation to seek views and evidence on the effectiveness, costs, risks and timescales of different options to address spoofed UK mobile numbers.

Criminals often defraud victims by imitating, or “spoofing,” phone numbers from trusted sources to increase the chances of their calls being answered. Fraudsters abroad frequently spoof UK numbers, as people are more likely to answer these calls than those from unfamiliar international numbers.

Current rules require operators to block calls from outside the UK using a UK number, but there’s an exemption for UK mobile numbers to allow UK roamers to call home. The consultation considers changing this exemption. Two main technical solutions are being explored:

• International gateway providers checking if a number from abroad is roaming.
• Modifying data for calls from abroad and validating them with the caller’s home network.

No industry consensus exists on the best solution, and evidence on the problem’s scope is limited.

Impact: Respond to the consultation by 23 September 2024. Responses and engagement will feed into potential solutions for spoofed UK mobile numbers. Possible new regulations may be introduced in future and a consultation in relation to this is expected in Spring 2025.

EU/UK: EU, UK and US issue joint statement on AI

On 23 July 2024, the European Commission, the UK’s Competition and Markets Authority, and the US Department of Justice and Federal Trade Commission issued a joint statement setting out their commitment to work together to protect competition and consumers in relation to AI foundation models and AI products.

The joint statement is the first time these risks have been addressed collectively by the four authorities.

Key takeaways from the statement are that the authorities:

• Recognise the transformative potential of AI but also acknowledge the risks it poses to competition.
• Are concerned about certain issues such as:
  • The concentration of control over AI development resources.
  • The potential for large firms to entrench market power.
  • The need for vigilance to prevent anti-competitive practices.
• Are dedicated to using their powers to address risks such as enabling competitors to share sensitive information, fix prices, or collude, and allowing unfair price discrimination or exclusion. Authorities will monitor and address these risks as AI technology evolves, ensuring compliance with competition laws.

Impact: Expect increased AI monitoring by the competition authorities as we see a higher level of threats to consumer protection. Make sure you have protocols and processes in place to avoid the unauthorised use of consumer data for AI training (which can undermine privacy, security and autonomy), and that you inform consumers about AI usage in your products and services. Read our briefing for more information.

UK: New Cyber Security and Resilience Bill

On 17 July 2024, the government announced plans to introduce a new Cyber Security and Resilience Bill (Bill) to tackle the rise in cyber-attacks and protect the country’s critical infrastructure and digital services relied on by many companies.

The Bill will strengthen defences by, among other things, expanding the remit of current laws, empowering regulators with stronger enforcement capabilities and increasing cyber-incident reporting requirements.

It is expected that the Bill will update the current UK NIS Regulations to align with the EU’s updated Network and Information Security Directive (EU Directive). For example, both the EU Directive and the Bill will have an extended scope, covering a greater number of companies in different sectors, and for both jurisdictions, stricter incident reporting requirements will apply.

Impact: More organisations will be brought within the scope of the regime, and in-scope organisations can expect strict reporting requirements on cyber-attacks, including on ransomware. This aims to improve response effectiveness and build a detailed understanding of cyber threats, helping the government – and companies – to identify patterns and develop better, stronger response strategies.

Edited by Kirath Bharya (Knowledge).

Further resources:

• Commercially Connected - August 2024 
• Challenges of AI within Employment and Labor law | Tech Talks - Episode 3
• How AI Treaty Will Further Global Governance Cooperation | Artificial Intelligence