What You Need to Know About the Artificial Intelligence Act

On May 21st the EU Council gave final agreement to what is being called the first significant law that would regulate artificial intelligence. There are many questions surrounding the new law - such as implementation, enforcement, and deadlines.

Anne-Gabrielle Haie, a partner with Steptoe LLP, joins us for this episode of Let's Talk Medtech to discuss the AI Act and how medical device and life sciences companies can prepare for it.

Below is a short excerpt of a transcript of the conversation. Editor's note: (One important thing to point out is that when we first recorded this conversation the EU AI act had not been given the final green light.) 

Well, good morning and welcome to Let's Talk Medtech, Anne Gabrielle. Thanks for joining us. Before we dive into our conversation about the EU AI Act, could you talk a little bit about your background and the work you do to help your clients?

Anne-Gabrielle: Sure, and thank you for the invitation. I'm Anne Gabrielle, a French-qualified lawyer and partner at Steptoe, a law firm based in Brussels. I lead the EU AI, Data, and Digital Practice, which includes data protection, privacy, cybersecurity, digital services regulation, and AI. I advise clients on compliance with EU law in these areas and represent them in investigations and enforcement cases. My focus is primarily on the tech and life science sectors.

Awesome, that's incredible. Let's jump into the EU AI Act. Can you provide a broad overview of the act and discuss a potential timeline for its enforcement?

Anne-Gabrielle: Certainly. This is a significant topic as it's the first AI regulation worldwide on the brink of adoption. However, it's not yet formally adopted, garnering attention globally. The EU AI Act is a comprehensive regulation with cross-sector applicability, covering a broad range of AI systems. These systems, defined in the act, exhibit characteristics like autonomy and adaptiveness. Importantly, the act extends its reach beyond EU-based companies to those impacting the EU market. For instance, a Medical Device company, based in Atlanta, Georgia, would be subject to these guidelines if its AI system is used in the EU. As for the timeline, the act is expected to be approved by the EU Council next week, followed by publication and translation. Some provisions, such as those prohibiting certain AI systems, could come into force by early 2025, while others may be delayed until 2027.

Fascinating. Given its broad scope, have companies fully grasped the implications of this act?

Anne-Gabrielle: The response has been mixed. While some stakeholders pushed for its adoption, others expressed concerns about potential innovation stifling. Awareness of the act's extent varies, but given its reach across the AI value chain, companies must prepare for compliance.

It sounds like compliance efforts will be extensive. How can companies, especially smaller ones, navigate this regulatory landscape?

Anne-Gabrielle: Anticipation and planning are crucial. Companies should establish cross-departmental teams and assess their AI systems' qualifications and roles. They must also conduct a gap analysis to identify compliance needs and set up a roadmap accordingly. While smaller companies may face resource challenges, their experience in highly regulated sectors like life sciences could offer a competitive advantage.

Enforcement of such regulations sounds complex. What can companies expect in terms of enforcement mechanisms and penalties?

Anne-Gabrielle: Enforcement will involve multiple stakeholders at EU and national levels, with penalties for non-compliance being severe, reaching up to 15 million euros or 3% of global turnover for high-risk AI systems.

Thank you for sharing these insights, Ann Gabrielle. For those seeking more information or assistance, how can they reach out to you?

Speaker B: They can find my contact information on the Steptoe website or connect with me on LinkedIn.