The draft regulation on artificial intelligence (AI) passed by the EU Parliament in mid-March was more than 500 pages long. On the other hand, the official final version published in the EU Official Journal on Friday is much more concise at 144 pages including appendixes. Now it is clear: the AI Act will come into force twenty days later, i.e. on August 1, 2024.
Advertisement
This begins the implementation deadline of the regulation, with which the EU wants to promote investment in safe and trustworthy AI systems. From February 2, 2025, a ban will come into force on certain AI practices such as social scoring, which is used to automatically evaluate social behavior and threatens exclusion from public services.
Biometric Surveillance
In principle, from February, the use of biometric remote monitoring systems in public places for law enforcement purposes, for example the use of automated facial recognition, will be prohibited. However, the agreement reached in December already opened the backdoor for the use of such technologies by the police. The EU Council also removed the actually agreed list of crimes and the judge’s reservations. However, the Traffic Light coalition, which is against biometric mass surveillance, does not want to follow this course.
By August 2, 2025, Member States must adopt implementing laws that, among other things, establish a common market surveillance authority for implementation Regulation The question of who should be given the name has sparked controversy in the country. The Federal and State Data Protection Conference (DSK) sees itself as ideally suited to take on this task. At a recent hearing in the Bundestag, experts such as Robert Kilian of the Federal Association of Artificial Intelligence Companies advocated a Federal Network Agency and, in the medium term, a separate higher federal authority for digital. This is the only way to ensure a “uniform level of supervision”.
Qualification confusion in Germany
In general, under the AI Act, market surveillance authorities must be independent, impartial and unbiased to ensure the fairness of their activities and to ensure the application and implementation of the regulations. Sufficient technical, financial and human resources as well as an appropriate infrastructure are also required to effectively carry out the tasks. Competent authorities should always have a sufficient number of staff whose skills and expertise include a comprehensive understanding of AI technologies and the relevant requirements, in particular for data and product safety.
The data protection authorities in Hamburg and Baden-Württemberg explained on Friday that “market monitoring for a large part of the high-risk catalogue of AI systems” will be assigned to data protection supervisory authorities anyway. In the areas of law enforcement, the administration of justice and migration control, as well as AI influencing elections, they are “set” as the appropriate authorities. This also applies to software companies and cloud providers that develop appropriate solutions for these areas.
The telco association VATM emphasizes: The industry needs a supervisory authority as a liaison “whose aim should be to support German companies in international competitiveness.” There is a need for “a central authority that not only puts data protection at the center of its work, but also monitors the benefits of innovative AI applications for citizens”. Under no circumstances should there be confusion about AI skills in the 16 federal states.
(vbr)
