The European Parliament today voted 523-46 with 49 abstentions to adopt the Artificial Intelligence Act, the world’s first comprehensive legal framework governing artificial intelligence. The regulation, agreed with member states in December 2023, establishes a risk-based tier system: the regulation establishes obligations based on risk and level of impact, while high-risk systems — those affecting health, safety, fundamental rights, or democratic processes — must undergo risk assessments, maintain use logs, and ensure human oversight.

Unacceptable-risk practices are banned outright, including social scoring, untargeted scraping of facial images from CCTV or the internet for recognition databases, emotion recognition in workplaces and schools, predictive policing based solely on profiling, and AI that manipulates human behaviour or exploits vulnerabilities. Law enforcement use of real-time biometric identification is prohibited except in narrowly defined cases such as searching for a missing person or preventing a terrorist attack, requiring prior judicial authorisation.

General-purpose AI models must comply with transparency requirements — disclosing training data summaries and respecting EU copyright law. The most powerful models deemed to pose systemic risks face additional obligations to evaluate and mitigate those risks. Deepfakes must be clearly labelled. The act also mandates national regulatory sandboxes for SMEs and startups to test AI before market deployment.

The law will enter into force 20 days after publication in the Official Journal, with prohibitions applying within six months, general-purpose AI rules within twelve months, and high-risk system obligations within 36 months. Final lawyer-linguist checks and formal Council endorsement remain before publication.

The debate in the European Parliament this week saw MEPs framing the vote as a decisive step toward regulating a technology that is evolving faster than law.