The AI Act: what to keep in mind when deploying AI systems within your company

The AI Act is a regulation (meaning it has direct effect in the Belgian legal order) laying down harmonised rules for the placing on the market, the putting into service and the use of artificial intelligence systems (‘AI systems’), including a.o. prohibition of certain AI systems, specific rules regarding high-risk AI systems and harmonised transparency rules.

An “AI system” is defined as “a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”.

AI systems are deemed “high-risk” if:

• providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the EU, irrespective of whether those providers are established or located within the EU or in a third country;

• deployers of AI systems that have their place of establishment or who are located within the Union;

• providers and deployers of AI systems that have their place of establishment or who are located in a third country, where the output produced by the system is used in
  the EU;

• product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;

• authorised representatives of providers, which are not established in the Union;

• affected persons that are located in the Union.

The AI Act shall not apply to (non-exhaustive):

• AI systems and models, including their output, specifically developed and put into service for the sole purpose of scientific research and development;

• AI systems exclusively used for military, defence or national security purposes;

• research, testing and development activities regarding AI systems or models prior to being placed on the market or put into service;

• natural persons using AI systems in the course of a purely personal non-professional activity;

• AI systems released under free and open source licences (but exceptions apply).

The AI Act holds an extensive array of obligations for providers (as well as importers and distributors) of AI systems, less for deployers of AI systems. Nevertheless, there are important obligations one should comply with and/or considerations one should keep in mind when deploying an AI system within the company (see point 5 below).

In addition, please be aware that a deployer will be qualified as ‘provider’ of an AI system (and thus subject to the extensive obligations placed on such providers under the AI Act) if:

• they put their name or trademark on a high-risk AI system already placed on the market or put into service;

• they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service;

• they modify the intended purpose of an AI system, including a general purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such manner that the AI system becomes a high risk AI system.

4. What AI systems are prohibited?

The following AI practices are prohibited:

• AI systems using subliminal techniques beyond a person’s consciousness or
  purposefully manipulative or deceptive techniques, with the objective to distort behaviour and impair informed decision-making, causing significant harm;

• AI systems exploiting vulnerabilities due to age, disability or a specific social or economic situation, causing significant harm;

• biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;

• AI systems evaluating or classifying individuals or groups based on social behaviour or known, inferred or predicted personal characteristics (‘social score’) leading to detrimental or unfavourable treatment;

• ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, except is specific circumstances listed in the regulation (e.g. targeted search for victims of trafficking);

• AI systems making risk assessments of natural persons in order to assess or predict the risk of a natural person to commit a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics, except if it is used to support the human assessment of the involvement of a person in a criminal activity, which is already based on objective and verifiable facts directly linked to a criminal activity;

• AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage;

• AI systems to infer emotions of a natural person in the areas of workplace and education institutions except in cases where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.

***