The AI Act, one year on: Europe takes stock of its artificial intelligence legislation

The European Commission has always presented the AI Act as an investment in trust: establishing clear rules — Brussels argues — reduces legal uncertainty and attracts long-term investment: ‘Our aim is to promote trustworthy AI in Europe’.

The basic idea is that compliance could become a mark of quality.

European companies that adhere to high standards of transparency, security and respect for fundamental rights could gain a reputational advantage in global markets, particularly in sensitive sectors such as healthcare, finance and the justice system. It is the same logic that has made the GDPR a global benchmark for privacy, despite all its practical limitations.

Meanwhile, the institutional framework is taking shape. At its operational heart is the Commission’s AI Office, which directly oversees general-purpose models – those that power chatbots, image generators and virtual assistants. As the Commission points out, the office ‘has the exclusive power to monitor, supervise and enforce compliance with the rules among providers of Gpai (general-purpose, ed.) models’, including the power to ‘request documentation, carry out assessments and, where necessary, access the source code’.

Alongside this body sit the European Board, in which each Member State has a representative, and the newly established Scientific Panel, a body of independent experts tasked with assessing the systemic risks of the most powerful models. The selection process attracted over four hundred applications; the first appointments were made in March, and the scientists are already hard at work scrutinising the most powerful models.

April also saw the first meeting of the Advisory Forum, the body that brings together industry, civil society and academia around the same table. Its role, as set out in the rules of procedure, is to ‘provide technical expertise to the Commission and the Board’ and to help put the regulation into practice.

The final piece of the jigsaw came in May with the draft guidelines on the transparency of AI-generated content.

But it is the classification of high-risk systems that presents the most delicate challenge. The AI Act draws a clear line: anyone who uses artificial intelligence to select candidates, grant loans, recognise faces or make decisions in court must comply with stringent obligations. Article 13, for example, stipulates that high-risk systems ‘be designed and developed in such a way that their operation is sufficiently transparent to enable deployers to interpret the output of the system and use it appropriately’.

The problem is that, in practice, the line isn’t always so clear-cut. The guidelines published in February have helped, but the helpdesk has received over 12,000 enquiries in six months. Companies and developers are looking for certainty, which they often fail to find.

What about the penalties? The Regulation is no joke. Article 99 stipulates that ‘penalties must be effective, proportionate and dissuasive’ and sets three thresholds: up to 35 million euros or 7 per cent of global turnover for the most serious infringements, up to 15 million or 3 per cent for other infringements, and up to 7.5 million or 1 per cent for providing false information to the authorities. Reductions are available for SMEs.

And what about the Member States? Here, the picture is more fragmented. To date, only fourteen countries have notified their supervisory authorities. Italy is among the most advanced, but elsewhere delays are mounting.

Observers warn that the risk is a multi-speed Europe, just as it seeks to establish itself as the global arbiter of AI regulations. The Commission has promised a report on the state of implementation by the end of the year. This will also help to identify who is doing their homework and who is putting it off.

One year on from its launch, the AI Act remains an open question. The framework is holding up, the tools are in place, but the final verdict will depend on variables that are still in flux: the ability of institutions to provide interpretative certainty, the willingness of businesses to turn compliance into a competitive advantage, and the resilience of the single market in the face of centrifugal pressures.

One thing is certain: the adage ‘America innovates, China copies, Europe regulates’ sounds less derisive than it did a year ago. Not because Europe has stopped regulating, but because Washington and Beijing are also starting to do so, often following Brussels’ example. Whether this will be enough to bridge the technological gap is another matter. But at least Europe has chosen to play the game on its own terms.