On the current vision
Our view on the current version
The EU AI Act entered into force on August 2, 2024. It applies to nearly all AI models and systems made available in the EU, either independently or as part of a product.
As we approach the first year since the EU AI Act became effective, we have drawn the following conclusions regarding its impact on business regulatory risks and compliance burdens: the burden is high, even though the Act’s provisions still lack legal precision.
1. The EU AI Act functions as a complementary framework to existing legislation.
The EU AI Act repeatedly emphasizes its role as complementary to other EU legislation relevant to AI systems and models. Despite its title, the “AI Act” should not currently be seen as the primary regulatory framework for AI developers to define a full set of obligations. Its current value lies in how it references and integrates with pre-existing legal frameworks that already govern AI-related risks, including:
- Data Protection (GDPR, ePrivacy Directive, etc.): The AI Act clarifies that data subjects retain their rights under data protection law. It means that AI system training, development, deployment, and usage shall respect data subject rights.
- Intermediary Services (DSA - Regulation (EU) 2022/2065, formerly Directive 2000/31/EC): The AI Act complements the obligations for providers of intermediary services embedding AI. It explicitly acknowledges that AI systems can be intermediary services and be subject to the DSA’s risk management framework, compliance with which is presumed to fulfil corresponding AI Act obligations for certain risks.
- Product Safety and Market Surveillance (Regulation (EU) 2023/988, Regulation (EU) 2019/1020, formerly Directive 2001/95/EC, etc.): For high-risk AI systems that are components of products covered by existing product safety laws, the AI Act compliance is assessed as part of the conformity assessment required under those existing laws. Notified bodies under those other acts are entitled to control conformity with the AI Act requirements.
Throughout the EU AI Act, there are many examples of such interconnectivity, either through direct references or by indirectly overlapping with the obligations of other laws.
2. The EU AI Act lacks standalone clarity and relies heavily on future implementing instruments.
The Act repeatedly mandates or empowers the European Commission and the AI Office to develop or facilitate a wide range of supplementary documentation, including guidelines on practical implementation, delegated acts for amendments, implementing acts for common specifications and real-world testing procedures, templates for technical documentation and transparency summaries, codes of practice, and common rules.
The documents related to General-Purpose AI Models must be developed by August 2, 2025, when the obligations for these models and the penalties for non-compliance are set to take effect.
As of now, the Code of Practice for General-Purpose AI Models remains in draft form and fails to clarify several critical points, particularly regarding the treatment of modified or fine-tuned GPAI models.
It is still unclear how current uncertainties will affect those covered by the new rules beginning August 2, 2025. At the same time, it is clear that penalties in Europe are strict and designed to deter breaches of the EU AI Act (Chapter XII).
3. To comply with the EU AI Act, businesses must first comply with other EU laws.
The complex and staggered integration of the AI Act into the EU legal landscape means that an effective compliance strategy begins with:
- Identifying the technical and functional characteristics of the AI system,
- Determining which legal frameworks apply beyond the AI Act itself.
Only after clarifying these factors can businesses assess how the AI Act overlays these obligations, particularly regarding:
- (i) Transparency, which is often addressed through DPIAs and LIAs under the GDPR,
- (ii) Conformity assessments under product safety regulations,
- (iii) Data quality, which under the AI Act blends considerations of copyright, privacy, and consumer protection.
Without any limits
76-78 avenue des Champs-Élysées Staircase D, 2nd floor, 75008 Paris
+33 6 50 37 41 44 info@claimsip.com