[Emergo, UL] The European Artificial Intelligence Act: Penalties and Timelines

This is the third in our series of regulatory updates on the EU Artificial Intelligence Act (AIA). Since more than one month has passed since the law’s approval, we are providing this article ahead of the AIA’s publication in the Official Journal of European Union (OJEU).

 

Background

On May 21 2024, the EU AIA was approved and given the final green light by the EU Council. The AIA establishes requirements for compliance of AI systems and general-purpose AI (GPAI) models made available or put into service in the EU market. In our first regulatory update we discussed scope, classification, conformity and economic operators. Our second regulatory update went on to discuss best practices, enforcement and innovation. In this update we focus specifically on the penalties and timelines associated with AIA compliance.

 

Impact and timelines

In addition to the EU Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), medical device manufacturers of AI-enabled and ML-enabled devices will need to comply with the AIA. Due to the nature of medical devices and IVDs, it is envisioned that the majority of AI/ML-enabled devices will fall into the high-risk category. While it is planned for these devices to undergo conformity assessment under the MDR or IVDR, the practicality is yet to be understood due to the specificities of each regulation.

Table 1 outlines the timeline and actions for compliance with the AIA. Medical device and IVD manufacturers subject to the AIA will have a maximum three-year period to comply with the regulation, unless a significant change to the AI system is made which will trigger compliance obligations sooner.

Timeline	Actions
March 2024	Adoption European Parliament Plenary vote and adoption of the AIA.
Q2/Q3 2024	Date of Publication Formal adoption and publication in OJEU.
Date of publication in OJEU + 20 days	Entry into force The AIA enters into force.
Entry into force + 6 months	Prohibitions on unacceptable risk AI systems General provisions apply. Provisions on prohibited AI systems apply.
Entry into force + 9 months	Codes of practice Codes of practice need to be ready.
Entry into force + 12 months	GPAI rules apply GPAI model obligations start to apply for systems placed on the market after the date of application. Penalties start to apply (except for providers of GPAI). Chapter on notifying authorities and Notified Bodies becomes applicable.
Entry into force + 18 months	Post-market monitoring Commission to adopt implementing act on post-market monitoring.
Entry into force + 24 months	Date of Application Obligations for Annex III high-risk AI systems apply. The obligations only apply for systems placed on the market or put into service before the date of application, if they are subject to significant design changes. AI regulatory sandboxes to be operational.
Entry into force + 36 months	Obligations for Annex I high-risk AI systems apply End of transition for GPAI models placed on the market prior to Q2 2025. Obligations for Annex I high-risk AI systems apply (includes AI-enabled medical devices, IVDs).

 

 

 

EU Artificial Intelligence Act Timelines and Penalties | Emergo by UL

The European Artificial Intelligence Act: Penalties and Timelines

---