Of particular focus in the recently adopted AI Act by the EU Parliament is the concept of high-risk AI. This term appears over 400 times in the recitals, regulatory text, and annexes. But what defines an AI as high-risk according to the AI Act?
High-Risk AI in Chapter III of the AI Act
High-risk AI systems pose a potential threat to human health, safety, and fundamental rights. Therefore, strict obligations are imposed on providers, including the requirement for comprehensive documentation and the establishment of a system for risk assessment and quality assurance. These are divided into two main categories.
Different Categories of AI Systems
The first category concerns AI systems that either serve as safety components in products or are themselves considered products subject to conformity assessment under EU legislation listed in Annex II of the AI Act. Examples include AI systems used as safety components in medical devices, elevators, certain vehicles, and aircraft.
The second category encompasses standalone AI systems affecting fundamental rights. A list of such AI systems is provided in Annex III of the AI Act and includes, for instance:
- AI systems intended for securing critical infrastructures,
- AI systems to be used in educational institutions to regulate access or assess students,
- AI systems to be deployed in the workplace context, such as in personnel recruitment or employee performance monitoring,
- AI systems for assessing individuals' creditworthiness, except those used for fraud prevention.
Exceptions and Market Authorization in the EU
AI systems listed in Annex III are not considered high-risk AI if specific exceptions apply, such as the enhancement of human activity by the AI system. These exceptions must be documented, and the AI system must be registered in the EU database.
To be authorized for the European market, high-risk AI systems must meet certain requirements and undergo ex-ante conformity assessment. This includes establishing a quality management system and a risk management system, as well as preparing detailed technical documentation in accordance with the AI Act.
Obligations for Providers and Manufacturers
Providers outside the EU offering their AI systems on the EU market must appoint a representative in the EU, similar to provisions in the GDPR. Manufacturers of products containing high-risk AI systems must fulfill the same obligations as providers. Importers and distributors must ensure that the AI systems comply with the requirements of the AI Act.
Operators of high-risk AI systems must use them in accordance with instructions, carefully select input data, monitor operations, and keep records. Some operators may also need to conduct a fundamental rights impact assessment before putting high-risk AI systems into operation.
Technical requirements for high-risk AI systems are also specified. For example, they must be capable of logging operations and events and be effectively monitored by humans. High-risk AI systems must be designed transparently so that users can interpret and utilize their results.
Conclusion: Action Required for Entrepreneurs
For operators and providers of AI systems, there are implementation deadlines, which are tight considering the complex legal and technical issues involved. Within 18 months of the AI Act coming into force at the latest, the Commission will issue guidelines for the practical implementation of high-risk AI and provide a list of examples of such AI systems. However, affected parties should not necessarily wait, as the implementation deadline for the AI Act is only 24 months. Experience with GDPR implementation shows that waiting until a few months before the deadline leads to increased consultancy costs and potentially compliance gaps.
Do you have further questions about AI and the law?
Do you have additional questions about the draft of the EU's AI Act or would you like to consult a lawyer on similar legal issues regarding artificial intelligence? Feel free to check out our services or contact us via email at office@geuer.at or by phone at +43-1-4380072. We look forward to hearing from you.
Seminar and Event Tips on Artificial Intelligence and Law for Austria:
AI Meetup on April 17, 2024, in Linz (German)
AWAK Seminar on April 23, 2024, in Vienna (German)
Linkt to the text adopted by the EU-Parliament
https://www.europarl.europa.eu/doceo/document/TA-9-2024-0138_EN.pdf (English)