Navigating AI legal risks: What EU/UK laws mean for businesses beyond big tech

Non-compliance with AI regulations in Europe exposes companies to sanctions under cross-border laws like GDPR and the AI Act. Worse still, businesses may face scrutiny from multiple regulators—national data, consumer, and sector-specific—for the same breach. John Hartley, Head of Business Crime and Regulation, highlights the critical risks and outlines effective risk management strategies for non-tech companies.

On 21^st July 2024, the Artificial Intelligence Act (AI Act) was published in the Official Journal of the EU – thus introducing the first piece of legislation intended to harmonise the rules of, and regulate the use of, Artificial Intelligence across the Union. The legislation will be rolled out over the coming months with most sections being in force by August 2026.

Businesses operating in the EU that have been looking at AI to improve the efficiency of business operations will need to be aware of the legislation and the definitions contained within. In particular, it is the providers (i.e. software developers) which are to be most closely monitored. This will include those businesses that intend to place on the market or put into service high-risk AI systems in the EU, regardless of whether they are based in the EU or a third country.

The legislation will also cover third-country providers where any high-risk AI system is used within the EU.

EU legislation is based on differing tiers of risk –

1. Unacceptable Risk – such AI systems will be banned under the AI Act and include systems that may be deceptive, manipulative, use social scoring or, exploit vulnerable traits etc.
2. High-Risk systems will be regulated and are the focus of the legislation. The definitions are very broad and likely to require considerable guidance moving forward but essentially will include:
   1. processing of personal data
   2. any system used as a safety component or product covered elsewhere by EU legislation (which of course covers a vast array of activities)
3. Limited-Risk systems will capture systems that interact with natural persons such as online chat-bots. This will require light touch transparency for the provider and the end user must be informed that they are interacting with an AI system.
4. Minimal-Risk systems will be unregulated and will include existing and available platforms such as video games and spam filters.

It is important to bear in mind that under the legislation the users are those deploying the software – not the end users. It is the providers who are the developers who are going to be the subject of most regulation.

Those businesses operating in the high-risk sector will face onerous tasks of self-regulation including:

• Risk management system
• Data governance
• Technical documents to support compliance
• Record keeping
• Instructions for use
• Factor in aspects for human oversight
• Factor in relevant cyber security
• Establish quality management system

Many may see this as an additional burden for compliance teams who will already be dealing with data protection, consumer protection and anti-money laundering requirements. It has already been flagged by many operating in the healthcare sector that the new Act will face increased challenges as AI is becoming more and more central to medical development.

The implementation of the framework and oversight will be done by the new AI Office which will monitor implementation of the regulations, develop codes of practice, issue guidance and investigate infringement. Whilst it seems that individual Member States may set their own rules on penalties – the general prohibition on banned AI systems may carry a fine of up to €35m or 7% of global turnover – whichever is higher.

It is understood that the AI Office will also be central to collaboration between Member States and to develop a coherent system of application of the Act. It remains to be seen therefore to what extent different regulatory bodies may compete in different sectors.

How Does the UK’s AI Regulation Compare to the EU?

The UK in contrast to the EU, certainly under the previous Conservative Government, has very much left the issue of regulating AI alone. The position has been that there is enough existing, sector-specific, regulation in the UK that will encompass technology as it develops. For example, the Data Protection Act, FCA rules, Money laundering Regulations, Consumer Protection etc – all play a role in protecting members of society already. Any business operating in a regulated sector which adopts AI will need to amend its policies, procedures and risk assessments accordingly to ensure its approach does not contravene its existing compliance obligations.

Likewise, there has been no need for an AI regulatory body as the UK already has oversight from the FCA, ICO, Ofcom and the CMA etc.

However, with a new Labour Government looking to have closer bonds with the EU, there may well be more emphasis on following the EU’s position and having a more structured regulatory position regarding technology and the use of AI.

For more information, please contact our Head of Business Crime and Regulation, John Hartley via john.hartley@primaslaw.co.uk