February 2 marked a significant milestone in the regulation of artificial intelligence in the European Union. On that day, the first two chapters of Regulation (EU) 2024/1689 of the European Parliament and of the Council entered into force. This regulation establishes a legal framework for the development, use, and marketing of AI systems, with the aim of ensuring that their implementation respects fundamental rights and the safety of individuals.
What Do Chapters I and II Regulate?
Chapter I establishes the scope of the regulation, defines what constitutes an AI system, and sets out the general principles for its responsible use. One of the most notable provisions is the promotion of AI literacy, which means that companies must ensure their employees receive adequate training on how these systems work and the risks they pose.
On the other hand, Chapter II imposes more specific restrictions, listing certain practices considered to pose an “unacceptable risk.” Among these practices are:
- The use of AI to manipulate people’s behavior without their knowledge, especially when it could cause them harm.
- The exploitation of vulnerabilities (such as age or disabilities) to influence individuals’ decisions.
- Social scoring systems that classify people based on their behavior or personal characteristics.
- Emotion recognition in work and educational settings, as it is considered an invasion of privacy.
How does this affect businesses?
Organizations that develop or use artificial intelligence systems in the EU are now required to review their models and processes to ensure they do not engage in prohibited practices. This involves taking a series of measures, such as assessing the impact of their AI systems and eliminating or modifying those that conflict with the regulations. They will also need to implement control and audit systems to ensure compliance with the regulation, train their teams to understand these new rules and how the systems work, and ensure transparency in the development and use of AI.
And, as expected, failure to comply with these provisions can result in significant penalties. Fines can reach up to 35 million euros or 7% of the company’s global revenue. This is undoubtedly a major incentive for companies to take preventive measures.
Upcoming Phases of Implementation
The remaining provisions of the regulation will be implemented gradually.
- On August 2, 2025, the rules on governance, notifying authorities, and penalties will take effect, along with specific requirements for general-purpose AI models.
- August 2, 2026, is the date on which the regulation will come into force generally and the applicable rules will begin to apply.
- On 2 December 2026, new prohibitions will come into force and the transitional period set out in Article 50(2) will begin.
- Finally, on August 2, 2027, Member States should have at least one operational regulatory AI test environment per country.
- On 2 December 2027, the rules for high-risk AI systems set out in Annex III will come into force.
- On 2 August 2028, the rules for high-risk AI integrated into regulated products covered by Annex I will come into force.
The adoption of this regulation marks a turning point in the regulation of artificial intelligence in Europe. Companies must begin preparing now to comply with the requirements and avoid both legal and reputational risks. A proactive approach will not only help them avoid penalties but will also enable companies to leverage AI within a safe and ethical framework.
