What happened

After three days of negotiations, the Council and European Parliament reached a provisional political agreement on the AI Act on 9 December 2023. The deal established the main structure of what would become the EU's first comprehensive, risk-based framework for artificial intelligence. It was a major milestone, but it was not yet final, applicable law.

The framework links obligations to the risk created by a system and its intended use. Some applications would be prohibited as unacceptable. High-risk systems in areas such as critical infrastructure, education, employment, essential services, law enforcement and border control would face stricter requirements for risk management, data, documentation, logging, human oversight, accuracy and security. The agreement also included dedicated rules for general-purpose AI models and stronger duties for models posing systemic risk.

What this means for organisations

For organisations, the practical signal was that AI needed to become part of ordinary governance. Useful preparation starts with an inventory of systems, suppliers, purposes, data and affected people. An organisation can then identify whether it acts as a provider, importer, distributor or deployer and assess whether a system could fall into a high-risk category. Supplier contracts should provide access to the documentation and incident information that customers need to meet their own duties.

The political agreement was not the final legislative step. The text still required technical completion, formal approval by Parliament and Council, publication, and phased application. Norwegian organisations also had to distinguish exposure in the EU market from Norwegian law. The regulation was EEA-relevant, but at this point it had not been incorporated into the EEA Agreement or implemented in Norway.

Sources

Council of the European Union: “Artificial Intelligence Act: Council and Parliament strike a deal,” 9 December 2023.

European Parliament: “Artificial Intelligence Act: deal on comprehensive rules for trustworthy AI,” 9 December 2023.

For discussion

Which decisions, defaults or supplier dependencies in our organisation should we examine first in light of this development?