What happened

The European Parliament approved the text by 523 votes to 46, with 49 abstentions. The rules covered prohibited practices, biometric limits, high-risk systems, general-purpose models, and rights to complain and receive meaningful explanations.

This was Parliament's first-reading position. The regulation was not finally adopted until the Council approved it, but organisations gained a stable basis for classification and planning.

Legal status in Norway

Not yet Norwegian law. EEA incorporation and a Norwegian implementing act were still required.

What the sources clarify

The vote also made the risk categories more concrete. Social scoring, certain manipulative practices and biometric categorisation by sensitive traits were among the prohibitions. High-risk systems would require risk management, documentation, logging, human oversight, accuracy and robustness. Organisations therefore needed to map intended purpose and context rather than model name alone.

A tool used for drafting assistance could have a different status from the same technology used in recruitment, credit decisions or access to an essential public service. That use-level analysis determines both classification and the evidence a buyer needs from its supplier.

For a buyer, classification should become a gate before contract signature. The supplier must describe data, performance limits, logging and human override for the intended use. Where a system affects rights or access to employment and services, the organisation also needs workable complaints and understandable explanations before production deployment.

Practical implications

Before approval, the decision owner should receive answers to three questions: which risk category the supplier relies on, which facts could change it, and who can stop use. The answers should sit with test results and exceptions so that a pilot cannot drift into high-risk use without renewed approval.

Sources

European Parliament: “Artificial Intelligence Act: MEPs adopt landmark law,” 13 March 2024.

European Parliament: “European Parliament legislative resolution on the Artificial Intelligence Act,” 13 March 2024.

For discussion

Where is the largest gap between documented control and actual practice?