EU's landmark AI Act is 'full of loopholes, carve-outs and exceptions'

The EU's Artificial Intelligence (AI) Act was adopted by the European Parliament on Wednesday. While it is being widely celebrated as a world-first, many civil society organisations are pointing out that the legislation fails to take basic human rights principles into account.

The regulation, already agreed in negotiations with Member States in December 2023, was now approved in Parliament (523 votes in favour, 46 against and 49 abstentions). It aims to protect fundamental rights, democracy, the rule of law and environmental sustainability from high-risk AI, while boosting innovation, a press release reads.

"We finally have the world’s first binding law on artificial intelligence, to reduce risks, create opportunities, combat discrimination, and bring transparency," said Internal Market Committee co-rapporteur Brando Benifei (S&D).

"Thanks to Parliament, unacceptable AI practices will be banned in Europe and the rights of workers and citizens will be protected," he added. "The AI Office will now be set up to support companies to start complying with the rules before they enter into force. We ensured that human beings and European values are at the very centre of AI's development."

The new rules ban certain AI applications that threaten citizens’ rights, including biometric categorisation systems based on sensitive characteristics and untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases.

Emotion recognition in the workplace and schools, social scoring, predictive policing (when based solely on profiling a person or assessing their characteristics), and AI that manipulates human behaviour or exploits people's vulnerabilities will also be forbidden.

Dangerous precedent

While the use of biometric identification systems (RBI) by law enforcement is prohibited in principle, the AI Act makes exceptions for a number of situations, underlined human rights organisations. This means that the legislation "does not really protect people from some of the most dangerous uses of AI."

So-called 'real-time' RBI can only be deployed if "strict safeguards are met," meaning if its use is limited in time and geographic scope, and subject to specific prior judicial or administrative authorisation.

Examples include a targeted search of a missing person or preventing a terrorist attack, for example. In practice, however, this sets a dangerous precedent for the use of surveillance technologies against racialised communities and people on the move.

Using these systems retroactively ("post-remote RBI") is considered a high-risk use case, meaning it requires judicial authorisation to be linked to a criminal offence.

Credit: Belga / Nicolas Maeterlinck

However, the European Digital Rights (EDRi) advocacy group stressed that while the AI Act may have positive aspects in other areas, it "enables the use of risky AI systems when it comes to migration" and creates a dangerous precedent by creating a parallel legal framework for the use of AI by law enforcement, migration and national security authorities.

"The AI Act might be a new law but it fits into a much older story in which EU governments and agencies – including Frontex - have violated the rights of migrants and refugees for decades," said Chris Jones, Executive Director of Statewatch in reaction.

"Along with a swathe of new restrictive asylum and migration laws, the AI Act will lead to the use of digital technologies in new and harmful ways to shore up 'Fortress Europe' and to limit the arrival of vulnerable people seeking safety," he added. "Civil society coalitions should work together to mitigate the worst effects of these laws, and continue to build societies that prioritise care over surveillance and criminalisation."

'Outrageous lobbying'

For the non-profit digital civil rights organisation Access Now, the AI Act is "an unambitious piece of product safety legislation" that is "full of loopholes, carve-outs and exceptions" following "outrageous lobbying by industry and law enforcement agencies."

"The new AI Act is littered with concessions to industry lobbying, exemptions for the most dangerous uses of AI by law enforcement and migration authorities, and prohibitions so full of loopholes that they do not actually ban some of the most dangerous uses of AI," said Acces Now's Senior Policy Analyst Daniel Leufer.

While Mher Hakobyan, Amnesty International’s Advocacy Advisor on AI, acknowledged that adopting the world's first rules on the development and deployment of AI technologies is "a milestone," he added that it is "disappointing that the EU and its 27 Member States chose to prioritise the interest of industry and law enforcement agencies over protecting people and their human rights."

Related News

For him, countries outside of the EU should "learn from the EU's failure to adequately regulate AI technologies" and must "not succumb to pressures by the technology industry and law enforcement authorities whilst developing regulation" but instead prioritise people and their rights.

Now that the Act has been approved by Parliament, the regulation must still be subjected to a final lawyer-linguist check and is expected to be finally adopted at the end of May.

It will enter into force 20 days after its publication in the Official Journal, and be fully applicable 24 months after it enters into force, except for bans on prohibited practises, which will apply six months after the entry into force date, codes of practise (nine months after entry into force), general-purpose AI rules including governance (12 months after entry into force), and obligations for high-risk systems (36 months).