EU AI Act

While the EU AI Act has not yet fully come into force, the Omnibus Package proposes a number of amendments to make the rules clear, simple and innovation friendly. This includes:

AI literacy

The Omnibus Package seeks to amend the requirements for providers and deployers of AI systems to ensure a sufficient level of AI literacy amongst their staff. As drafted, the proposal suggests that responsibility for AI literacy would shift to the Commission and Member States, who have an obligation to foster AI literacy. It is not clear the extent to which this would negate the obligations of providers and deployers to ensure sufficient AI literacy within their organisation. Given the growing adoption of AI tools and the need to protect against other risks presented by such tools, many organisations may see significant operational value in developing an AI-literate workforc,e irrespective of obligations under the EU AI Act.

Bias detection

To facilitate compliance with the GDPR, a new section will be introduced into the EU AI Act that will permit the use of special category data to train AI models for the purpose of ensuring bias detection and correction. This will be a legal basis for “substantial public interest” under Article 9 of the GDPR.

Extension of SME exemptions to SMCs

The Commission recognises that small and medium enterprises (“SMEs”) and small mid-cap enterprises (“SMCs”) are disproportionately impacted by the burden of complying with EU AI Act. As part of the Omnibus Package, several provisions and exemptions applicable to SMEs would be extended to SMCs, including in respect of technical documentation and quality management systems.

Timeline for compliance with high-risk obligations

Under the Omnibus Package, the timelines for compliance with obligations for high-risk AI systems (“HRAI”) would be graduated to align with guidance provided by the Commission. The upshot of the proposal is that the obligations on HRAI systems will apply between 6 months (for Annex III HRAI systems) to 12 months (for Annex I HRAI systems) following the adoption of a decision by the Commission that “adequate measures in support of compliance” are available. If no such decision is made, the obligations will apply from 2 December 2027 for Annex III HRAI systems, or 2 August 2028 for Annex I HRAI systems. While the impetus of this change appears to have been driven by the need for organisations to require more time for implementation, the application of core parts of the AI Act being subject to a decision of the Commission, introduces more uncertainty into this area and is unlikely to resolve concerns amongst industry.

Introduction of guidelines

The Commission has committed to providing clear, practical guidance to support compliance with the AI Act. The Omnibus Package outlines a non-exhaustive list of 12 proposed guidelines aimed at addressing stakeholder concerns regarding compliance. These include guidelines on the classification of HRAI and a template for fundamental rights impact assessments. Deployers of AI systems will no doubt welcome guidance on the application of the provisions relating to “substantial modification” of AI systems considering that making such substantial modifications to HRAI could trigger provider obligations pursuant to Article 25 of the EU AI Act.