Decoding

theEUAIAct

UnderstandingtheAIAct’s

impactandhowyoucan

respond

KPMG.MaketheDifference.

KPMGInternational|

/trustedai

05

Executivesummary

17

Nextsteps

11

UnravellingtheAI

Act’skeycomponents

03

Introduction

Contents

07

ExaminingtheAI

Act’simpactand

scope

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct2

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Introduction

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct3

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Arti?cialIntelligence(AI)isofferingnewbene?tstosocietyandbusinesses,aimingtotransformtheworkplaceandmajorindustriesalongtheway.

Simplyput,theraceisontoembracetheremarkableandevolvingpowerof

AIandautomation.

AsKPMG’s

GlobalTechReport2023

reveals,most

globalexecutives(62percent)reportanincreasein

performanceorpro?tabilityfromdigitaltransformationinitiativesrelatedtoAIandmachinelearningoverthe

past24months.And68percentsaythesetechnologieswillplaya‘vital’roleinhelpingthemachievetheir

businessobjectivesoverthenextthreeyears,while57percentbelieveAIandmachinelearningwillbe‘important’inmeetingshort-termobjectives.

ButastheworldwideAIproliferationinbusinessand

oureverydaylivesunfolds,thereisacriticalneed

forguardrailsandlegislationtodealwithsigni?cant

newrisksregardingtheappropriateandethicaluse,

developmentanddistributionofAI.Accordingto

Trust

inarti?cialintelligence

,aglobalsurveyconductedby

KPMGAustraliaandtheUniversityofQueensland,threein?vepeoplearewaryabouttrustingAIsystems,and71percentexpectAItoberegulated.Morerecently,

CEOsfromglobaltechgiantscalledforgreaterAI

regulationatameetingonCapitolHilltoprotectpeoplefromtheworsteffectsofAI.

Inresponse,theEuropeanUnion(EU)hasreached

aground-breakingprovisionalagreementona

comprehensiveArti?cialIntelligenceAct(AIAct)thattakesarisk-basedapproachtoprotectingfundamentalrights,democracy,theruleoflawandenvironmentalsustainability.1Thoughit'sexpectedtobecomelaw

in2024,withcomplianceexpectedby2025,thislegislation—the?rstofitskind—isanticipatedtoemergeasthede-factonewglobalstandardforAIregulation.

WiththeintroductionoftheAIAct,theEUaimsto

strikeabalancebetweenfosteringAIadoptionand

ensuringindividuals’righttoresponsible,ethicaland

trustworthyuseofAI.Inthispaper,weexplorewhattheAIActmaymeantoyourorganizationandexaminethestructureoftheAIAct,theobligationsitimposes,thetimelinesforcomplianceandtheactionplanthatorganizationsshouldconsider.

Organizationalleadership

shoulddriveinitiativesinline

withtheAIAct,company

brand,valuesandrisktolerancetopromoteresponsibleuse

ofAI.Thiscanhelppromote

ethicaldevelopment,regulatorycompliance,riskmitigationand

stakeholdertrust.

DavidRowlands

GlobalAILeader

KPMGInternational

AIshouldbedevelopedandusedwithafocusonsafetyandethics,turningtechnologicaladvancementintoa

positiveforceforsociety.TheEUAIActwillhelpfosterinnovationwhile

protectingend-users.

LaurentGobbi

GlobalTrustedAILeader

KPMGInternational

1EuropeanParliament.(December9,2023).Arti?cialIntelligenceAct:dealoncomprehensiverulesfortrustworthyAI[Pressrelease].

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.DecodingtheEUAIAct4

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Executive

summary

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct5

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

TheAIActaimstoregulatetheethical

useofAI

AIholdsimmensepromisetoexpandthehorizonof

whatisachievableandtoimpacttheworldforour

bene?t—butmanagingAI’srisksandpotentialknownandunknownnegativeconsequenceswillbecritical.TheAIActissettobe?nalizedin2024andaimsto

ensurethatAIsystemsaresafe,respectfundamentalrights,fosterAIinvestment,improvegovernance,andencourageaharmonizedsingleEUmarketforAI.

MostAIsystemsneedtocomplywiththeAIActbythe?rsthalfof2026

TheAIAct'sde?nitionofAIisanticipatedtobebroad

andincludevarioustechnologiesandsystems.Asa

result,organizationsarelikelytobesigni?cantlyimpactedbytheAIAct.Mostoftheobligationsareexpected

totakeeffectinearly2026.However,prohibitedAI

systemswillhavetobephasedoutsixmonthsafter

theAIActcomesintoforce.Therulesforgoverning

general-purposeAIareexpectedtoapplyinearly2025.2

Providersandusersofhigh-riskAIsystemsfacestringentobligations

TheAIActappliesarisk-basedapproach,dividingAIsystemsintodifferentrisklevels:unacceptable,high,limitedandminimalrisk.3

High-riskAIsystemsarepermittedbutsubjecttothemoststringentobligations.Theseobligationswillaffectnotonlyusersbutalsoso-called

‘providers’ofAIsystems.Theterm‘provider’in

theAIActcoversdevelopingbodiesofAIsystems,includingorganizationsthatdevelopAIsystemsforstrictlyinternaluse.Itisimportanttoknowthatanorganizationcanbebothauserandaprovider.

Providerswilllikelyneedtoensurecompliancewith

strictstandardsconcerningriskmanagement,data

quality,transparency,humanoversight,androbustness.

UsersareresponsibleforoperatingtheseAIsystemswithintheAIAct’slegalboundariesandaccording

totheprovider'sspeci?cinstructions.Thisincludesobligationsontheintendedpurposeandusecases,datahandling,humanoversightandmonitoring.

GuardrailsforgeneralAIsystems

Newprovisionshavebeenaddedtoaddresstherecentadvancementsingeneral-purposeAI(GPAI)models,

includinglargegenerativeAImodels.4Thesemodels

canbeusedforavarietyoftasksandcanbeintegratedintoalargenumberofAIsystems,includinghigh-risksystems,andareincreasinglybecomingthebasisformanyAIsystemsintheEU.Toaccountforthewide

rangeoftasksAIsystemscanaccomplishandtherapidexpansionoftheircapabilities,itwasagreedthatGPAIsystems,andthemodelstheyarebased

on,mayhavetoadheretotransparencyrequirements.

Additionally,high-impactGPAImodels,whichpossess

advancedcomplexity,capabilities,andperformance,

willfacemorestringentobligations.Thisapproach

willhelpmitigatesystemicrisksthatmayarisedueto

thesemodels'widespreaduse.5

TheAIActdoesnotaffectexisting

Unionlaw

ExistingUnionlaws,forexample,onpersonaldata,

productsafety,consumerprotection,socialpolicy,

andnationallaborlawandpractice,continuetoapply,

aswellasUnionsectorallegislativeactsrelatingto

productsafety.CompliancewiththeAIActwillnot

relieveorganizationsfromtheirpre-existinglegal

obligationsintheseareas.

UnderstandingtheAIAct’simpact

onyourorganizationwillbepivotal

tosuccess

Organizationsshouldtakethetimetocreateamapof

theAIsystemstheydevelopanduseandcategorize

theirrisklevelsasde?nedintheAIAct.Ifanyoftheir

AIsystemsfallintothelimited,highorunacceptable

riskcategory,theywillneedtoassesstheAIAct’s

impactontheirorganization.Itisimperativeto

understandthisimpact—andhowtorespond—as

soonaspossible.

2EuropeanCommission.(December12,2023).Arti?cialIntelligence—QuestionsandAnswers[Pressrelease].

3EuropeanCouncil.(December9,202).Arti?cialIntelligenceActTrilogue:Pressconference—Part4.[Video].

4EuropeanParliament.(March2023).General-purposearti?cialintelligence[Backgroundmaterial].

5EuropeanCommission.(December12,2023).Arti?cialIntelligence—QuestionsandAnswers[Pressrelease].

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.DecodingtheEUAIAct6

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Examiningthe

AIAct’simpact

andscope

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct7

Introduction

Throughourlens:ThepotentialimpactoftheAIAct

Stimulatethepositive

?Stimulateinnovationthroughregulatory

sandboxeswheresmallandmedium-sizedenterprisescantesttheirAIsystemswithoutimminentregulatoryscrutiny.

?Promoteharmonizationofstandards,codesofconductandcerti?cation.

?OffergreatertransparencyregardingAIsystems.

?Createalevelplaying?eldforthoseinvolved.

?SafeguardfundamentalrightsandprovidelegalcertaintyforindividualsresidingintheEU.

Adoptbestpractices

?CategorizeyourAIsystemsandunderstandtheassociatedrisks.

?Imposemorestringentrequirementsforhigh-riskAIsystems(obligatoryriskmanagement,data

governance,technicaldocumentation,etc.).

?Carryoutconformityassessmentsandpost-marketmonitoringforhigh-riskAIsystems.

?Establisheffectiveoversightandenforcementmechanisms.

Manageandreducerisks

?ProhibitunacceptablerisksinAIsystems.

?Avoidfundamentalrightsviolations.

?Preventtheuseofsubliminalorunethical

techniquesthatmightin?uenceordistorta

person’sbehaviorinsuchawaythatitcausesharmtothatpersonoranotherperson.

?Minimizebiasthatcouldresultinunfairorinadequateoutcomes.

?Restricttheexploitationofvulnerablepeopleorgroupsduetotheirage,disability,politicalopinionorotherfactors.

Summary

Impactandscope

Keycomponents

Nextsteps

TheEuropeanCommission(EC)proposedtheAIActinApril2021.AsofDecember2023,theEuropeanParliament,theEuropeanCouncilandtheEuropeanCommissionhavereachedaprovisionalagreementtomaketheAIActlaw.

TheproposedAIActisexpectedtoreshapehow

wethinkaboutandmanageAIsimilarlytowhathas

happenedindataprivacyoverthelastcoupleofyears.

Expectedtobecomelawin2024,theAIActwill

likelyhaveanimmediatewide-rangingimpactonany

businessoperatingintheEUthatoffersAIproducts,

servicesorsystems.Thelawintroducesade?nitionfor

AIintheEU,categorizesAIsystemsbyrisk,laysout

extensiverequirementsandnecessarysafeguarding

mechanismsforAIsystems,andestablishes

transparencyobligations.

Whatitaimstodo?

TheECaimstobalancepromotingAIdevelopment

andboostinginnovationwithmanagingemerging

riskseffectively.Thisisre?ectedintheobjectivesof

theproposal:6

?EnsuringthatAIsystemsontheEUmarketaresafeandrespectpublicrightsandvalues.

?ProvidinglegalcertaintytofacilitateinvestmentandinnovationinAIsystems.

?Enhancinggovernanceandeffectiveenforcementofethicsandsafetyrequirements.

?FacilitatingthedevelopmentofasingleEUmarketforlawful,safe,trustworthyAIapplicationswhilepreventingmarketfragmentation.

6EuropeanCommission.(April21,2021).ProposalforaRegulationoftheEuropeanParliamentandoftheCouncil,“LayingDownHarmonisedRulesonArti?cialIntelligence(Arti?cialIntelligenceAct)andAmendingCertainUnionLegislativeAct.”

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.DecodingtheEUAIAct8

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Toachievetheseobjectives,theAIActappliesa

risk-basedapproach.Thisallowsforestablishing

speci?cminimumrequirementstoaddresstherisks

andproblemslinkedtoAIsystemswithoutunduly

constrainingorhinderingtechnologicaldevelopmentordisproportionatelyincreasingcostsrelatingtoplacingAIsystemsonthemarket.

Whowillbeaffected?

Mostorganizations,bothinsideandoutsidetheEU,aredevelopingorusingAIsystemsthatwilllikelyqualify

asAIunderthescopeoftheAIAct.Giventheshort

implementationperiod,however,organizationsshouldgainaprofoundunderstandingoftheAIsystemstheyaredevelopingand/ordeployingandhowtheymeasureuptotheAIAct’srequirements.

Whatpartiesarecovered?

?AnyproviderplacingAIsystemsonthemarketorputtingthemintoservicewithintheEU,regardlessoflocation.

?AnyproviderofAIsystemslocatedoutsidetheEU,whosesystemoutputcanorisintendedforuseintheEU.

?AnyproviderofAIsystemslocatedintheEU.

?AnyimporterordistributorplacingAIsystemsonthemarketormakingthemavailablewithintheEU.

?ProductmanufacturersplacingproductswithAI

systemsonthemarketorputtingthemintoservicewithintheEUundertheirnameortrademark.

?UsersofAIproductsandserviceswithintheEU.

Whatisnotcovered?

?AIsystemsdevelopedorusedexclusivelyformilitarypurposes.

?AIsystemsusedbypublicauthoritiesor

internationalorganizationsinnon-Unioncountrieswhenusedforlawenforcementorjudicial

cooperationwiththeEUunderaframeworkofinternationalagreements.

?AIsystemsdevelopedandusedforthesolepurposeofscienti?cresearchanddiscovery.

?AIsystemsintheresearch,testing,and

developmentphasebeforebeingplacedonthemarketorputintoservice(thisincludesfree

andopen-sourceAIcomponents).

?PeopleusingAIforpersonaluse.

InthesamewaytheGeneralDataProtection

Regulation(GDPR)isenforced,theECunderstands

thatnon-Europeanentitiessellingtheirproductsin

Europeanmarketsshouldberegulatedsimilarlytothememberstates.TheEUisexpectedtobethecentergroundforglobalAIstandards,withdivergenceintheUSandpossiblytheUK.LiketheGDPR,theAIActwillhaveandextra-territorialeffect.

Whoisaffectedinyourorganization?

Executiveswhomanagecompliance,data

governanceandthedevelopment,deploymentand

useofAItechnologieswilllikelyseetheirrolesand

responsibilitiesimpactedbytheAIAct.Beyond

seniorrolesintheorganization,theBoardofDirectors

andvariousGovernanceCommitteesmayalsobe

affected,andtheyshoulddevelopawarenessand

knowledge.Giventhebroadde?nitionofAIandthe

currentpaceofproliferation,organizationsshould

takeaholisticapproach.Seniorexecutivesshould

collaborateonpurposefulinnovationanddevelopment,

riskmanagement,andgovernanceofAIsystemsto

achievecompliancewiththeAIAct.

Howitwillbeenforcedandwhatare

thepenalties

TheEChasproposedastructureforenforcingAI

providerrequirementsbyestablishinganArti?cial

IntelligenceBoardandExpertGroup.BothpartiessitattheEUlevelandareresponsiblefor:

?Contributingtoeffectivecollaborationwithnationalsupervisoryauthorities.

?Providingrecommendationsforbestpractices.

?Ensuringconsistentapplicationoftheregulation.

Eachmemberstatewillbeexpectedtocreateor

designateaNationalCompetentAuthoritytoensure

theimplementationoftheregulationandtosafeguard

theobjectivityandimpartialityoftheiractivities.

TheEU’sproposedregulationwilllikelyhavea

far-reachingimpactonallorganizationsleveraging

thevastpowerofAI,andtheconsequencesof

noncompliancecouldrangefromrestrictingmarket

accesstosigni?cant?nesdependingonthelevel

ofnoncompliance.Finesmayrangefrom35million

eurosor7percentofglobalturnoverto7.5millionor

1.5percentofturnover,dependingontheinfringement

andsizeofthecompany.7

7EuropeanParliament.(December9,2023).Arti?cialIntelligenceAct:dealoncomprehensiverulesfortrustworthyAI[Pressrelease].

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.DecodingtheEUAIAct9

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Tracking

theEU’s

legislative

journey

Prohibitionson‘unacceptable

risk’AIsystemswill

June2023–December2023

FinalAIActnegotiationsoccur

betweentheCouncil,Commission,and

Parliament.Aprovisionalagreementto

?nalizetheproposedrulesisreachedin

December2023.

December2022

June2023

itscommonposition

(‘generalapproach’)

ontheAIAct.

0April2021

TheEuropeanCommissionunveilsa

proposalforanewArti?cialIntelligenceAct.

Spring2026

The?nalAIActtakeseffectinitsentirety.

Wearehere

The?naltextisexpectedinthe?rsthalfof2024.

TheParliamentadoptstheirnegotiationpositionforthedraftAIAct.

Severalobligationstogeneral-purposeAIwillapply.

TheCouncilhasadopted

apply.

.

Late2024

Mid2025

Whenwillitapply?

MostoftheobligationsoutlinedintheAIActare

expectedtobecomeeffectivebythe?rsthalfof

2026.Prohibitionsareanticipatedtotakeeffectby

theendof2024,andobligationsregardinggeneral-

purposeAI(GPAI)areexpectedtotakeeffectas

earlyas2025.GPAIreferstoAIsystemsthatperform

generallyapplicablefunctions,suchasimageand

speechrecognition,audioandvideogeneration,

patterndetection,questionanswering,translationand

others,butcanhaveawiderangeofpossibleuses,

bothintendedandunintended.Thesesystemsmay

beutilizedashigh-riskAIsystemsorincorporatedas

componentsofotherhigh-riskAIsystems.

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct10

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Unravellingthe

AIAct’skey

components

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct11

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

TheAIActisacomprehensivedocumentdesignedtohelpprovideaclearde?nitionofarti?cialintelligence,enabling

EU-widealignmentandconsistencywithotherUnionlawsandregulations.TheAIAct'sprimarygoalistoestablisha

uniformandhorizontallegalframeworktopromotetheuptakeofAIsystemswhileprovidingahighlevelofprotection

againsttheirharmfuleffects.ThisframeworkcanhelptobuildtrustinAItechnologyandgiveindividualsandorganizationsgreatercon?denceinusingit.

De?ningarti?cialintelligence

TheAIActappliesabroadde?nitionofanAIsystemderivedfromtherecentlyupdatedOrganisationforEconomicCo-operationandDevelopment(OECD)de?nition.WhiletheAIAct’stextisnotyetpubliclyavailable,theOECDde?nitionisasfollows:

“AnAIsystemisamachine-basedsystemthat,for

explicitorimplicitobjectives,infers,fromtheinputitreceives,howtogenerateoutputssuchaspredictions,content,recommendations,ordecisionsthatcan

in?uencephysicalorvirtualenvironments.DifferentAIsystemsvaryintheirlevelsofautonomyand

adaptivenessafterdeployment.8”

Thisde?nitionisdeliberatelykeptbroadtocover

thewholespectrum,fromsimplertechnologiesandsystemsfocusingonsingle-usecasestoadvancedapplicationsofdeeplearningandgenerativeAI.Asaresult,theAIAct'sscopebecamemuchwider

thaninitiallyanticipated,extendingsigni?cantly

beyondourmorerecentunderstandingofadvancedand

generativeAI.TheAIAct'sde?nedscopehasseveral

exemptionsforAIsystems,suchasthoseusedformilitaryordefensepurposesandlimitedexemptionsforfreeandopen-sourcesystems.

AIriskframeworkandrequirements

TheAIActde?nesaframeworktounderstandtherisksassociatedwithAI.Itclassi?esAIsystemsbasedontheirpotentialrisksanddividesthemintodifferentcategoriesdependingonthedatatheycapture,andthedecisionsoractionstakenwiththatdata.

EUobligationswillvarydependingonthecategoryofAI

beingused.Whileanagreementonthecontexthasbeenreached,the?naltextoftheregulationsisnotyetavailable.However,thefollowingsectionssummarizetheobligationsstipulatedundertheAIAct,basedonthepublicly

availableinformation.9

8NotethattheearliestversionoftheAIActde?nesAIsystemsassystemsthatweredevelopedusingoneofthefollowingtechniquesandapproaches:

(a)Machinelearningapproaches,includingsupervised,unsupervised,andreinforcementlearning,usingawidevarietyofmethods,includingdeeplearning.(b)Logic-andknowledge-basedapproaches,includingknowledgerepresentation,inductive(logic)programming,knowledgebases,inferenceand

deductiveengines,(symbolic)reasoningandexpertsystems.

(c)Statisticalapproaches,Bayesianestimation,searchandoptimizationmethods.

9EuropeanCommission.(April21,2021).ProposalforaRegulationoftheEuropeanParliamentandoftheCouncil,“LayingDownHarmonisedRulesonArti?cialIntelligence(Arti?cialIntelligenceAct)andAmendingCertainUnionLegislativeAct.”

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct12

Introduction

Minimalrisk

Noobligations●

Limitedrisk

Highrisk

Summary

Impactandscope

Keycomponents

Nextsteps

TheAIActtakesarisk-basedapproach

Prohibited

Unacceptablerisk

ContraveneUnionvalues,

likefundamentalrights.

Conformityassessment

Highrisktohealth,safety,

environmentand

fundamentalrights.

Transparencyobligation

Riskofimpersonation

ordeception.

Nohighrisks.

Examplesofunacceptable-riskAIsystems

?Behavioralmanipulation.

?Exploitationofvulnerable

characteristicsofpeople.

?Socialscoringbypublicauthorities.

?Real-timeremotebiometricidenti?cationfor

lawenforcement.

Examplesofhigh-riskAIsystems:

?Evaluationofeligibilitytocredit,healthorlifeinsuranceorpublicbene?ts.

?Analysesofjobapplicationsorevaluationofcandidates.

?Productsafetycomponents.

Examplesoflimited-riskAIsystems:

?AIsystemsthatinteractwithconsumers.

?GenerativeAI*:AIsystemsgeneratingor

manipulatingcontent(image,audioorvideo).

Examplesofminimal-riskAIsystems:

?Spam?lters.

?AI-enabledvideogames.

*Furtherspeci?cobligationstogenerativeAIandfoundationmodelswillapplyoutsideofthisrisk-basedapproach

?2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.

DecodingtheEUAIAct13

Introduction

Summary

Impactandscope

Keycomponents

Nextsteps

Unacceptable-riskAIsystems

WhichAIsystemsarecovered?AIsystemsthat

enablemanipulation,exploitationandsocialcontrol

practicesareseenasposinganunacceptablerisk.

ThiscategoryprohibitsAIforthefollowingpurposes:

?ManipulationthatharmsorislikelytoharmanAIuseroranotherperson.

?Exploitingvulnerabilitiesofaspeci?cgroupofpersons.

?Socialscoringleadingtodetrimentalorunfavorabletreatmentinsocialcontexts.

?Indiscriminatescrapingoffacialimages.

?Emotionrecognitionsoftwareintheworkplaceandeducation(withsomeexceptions).

?UseofAIthatcategorizespersonsbasedon

sensitivetraitssuchasrace,politicalopinionsorreligiousbeliefs.

?Predictivepolicingonindividuals(riskscoringfor

committingfuturecrimesbasedonpersonaltraits).

?Remotebiometricidenti?cationofpeople(partialbanwithsomeexceptionsinlawenforcement).

Whataretheobligationsrelatedtothiscategory?

SincetheAIsystemsinthiscategoryposeanunacceptablerisk,theiruseisprohibited.

High-riskAIsystems

WhichAIsystemsarecovered?AIsystemsthat

negativelyaffectsafetyorfundamentalrightswill

beconsideredhighriskandwillbedividedintotwo

categories:1)AIsystemsthatareusedinproductsfalling

undertheEU’sproductsafetylegislation.Thisincludestoys,aviation,cars,medicaldevicesandelevators.2)AIsystemsfallingintospeci?careasthatwillhavetoberegisteredinanEUdatabase.8Theseinclude:

?Criticalinfrastructure,suchasthesupplyofutilities.

?Educationalandvocationaltraining,forexample,

automatedscoringof—orexclusionfrom—exams.

?Employment,workersmanagementandaccesstoself-employment,forexample,automated

recruitmentandapplicationtriage.

?Accesstoessentialprivateandpublicservices

andbene?ts(e.g.healthcare),creditworthiness

evaluationofnaturalpersons,andriskassessmentandpricinginrelationtolifeandhealthinsurance.

?Law-enforcementsystemsthatmayinterferewithfundamentalrights,suchasautomatedriskscoringregardingpotentialoffenders,deepfakedetectionsoftwareandevidencereliabilityscoring.

?Migration,asylumandbordercontrolmanagement,forexample,veri?cationofauthenticityoftravel

documentsandvisaandasylumapplicationexaminations.

?Administrationofjusticeanddemocratic

processes,forexample,legalinterpretationtoolstoassistjudicialauthorities.

Mostorganizationsusethesehigh-ri