226 pages of comments and amendments: far from being a mere technical adjustment, the discussions underway in the EU Council between the EU27 reflect a growing desire to gradually regain control over some of the most sensitive points of the text revising the European regulation on artificial intelligence (AI Act).
In a working document dated Wednesday 11 February that Agence Europe was able to consult, the national delegations detail their reactions to the first version of the compromise proposed by the Cyprus Presidency of the Council of the EU at the end of January (see EUROPE 13794/8). Unsurprisingly, the document clearly shows a willingness on the part of member countries to impose new, stricter cuts to the initial text.
Processing of personal data. Whereas the January compromise simply reinstated the notion of “strict necessity” to allow suppliers of high-risk AI systems to process particular categories of personal data, the comments from the member countries show a desire to go even further in terms of restrictions.
“The proposed provisions [...] could benefit from further clarification regarding privacy safeguards and clearly defined limits”, says Poland. Austria claims that the interpretation of “strict necessity” is still too vague, while Portugal is proposing the introduction of an obligation to systematically consult national data protection authorities for each derogation. Luxembourg is questioning the threshold for a breach of fundamental rights, which it deems “insufficiently defined”, and Latvia is calling for enhanced security measures.
These positions reflect a persistent reluctance on the part of the Member States to give the Commission and AI providers too wide a discretion over the use of sensitive data. The revision of part of the GDPR, which is underway at the same time, is giving rise to the same type of concern on the part of the EU27 (see EUROPE 13785/2).
At this stage, Sweden remains the only delegation that unreservedly supports the addition of Article 4(a) as proposed by the Commission.
Period for establishing the timetable. Another sensitive issue is the question of the date of entry into force of the obligations for high-risk AI models (see EUROPE 13792/20), as well as the question of the transparency of AI-generated content (see EUROPE 13775/22).
Several Member States have expressed reservations about the possibility given to the Commission to trigger the early application of certain provisions, which is seen as a source of legal uncertainty. Bulgaria, Germany, Denmark and Finland are in favour of maintaining the original timetable. Other capitals, on the other hand, are proposing more specific changes: Greece is talking about December 2027 for all high-risk models, while the Czech Republic is suggesting August 2028. Austria, in favour of a fixed timetable, is at the same time paving the way for a delay in the application of fines.
This debate on the timetable is less technical than it might seem: while there is unanimous agreement that the Commission should be given the option of introducing certain obligations prematurely, at the same time the EU27 are outlining a shared willingness to control the ramp-up of the regulation in order to reduce the impact on European businesses.
Registration requirements. Most Member States maintain the need to reinstate the obligation to register in the European database for providers of AI systems that are not considered high-risk, but with a simplification of the procedure. Only France is explicitly in favour of its abolition.
“AI Literacy”. The AI Act requires suppliers and deployers of artificial intelligence systems to guarantee a certain level of competence in this area for their staff and for the people who use these systems on their behalf. And here again, the Member States are divided. Some, including Austria, Poland and Bulgaria, believe that at least some of these requirements should be transferred to the EU27 and the Commission, potentially through the publication of recommendations or a request for standardisation.
Others, such as Malta, Belgium, Spain and France, insist that this obligation should remain primarily the responsibility of suppliers and deployers, but are not opposed to the EU providing technical assistance or guidance. A number of them also called for a more precise definition of the concept of “AI Literacy”.
The Cyprus Presidency’s first compromise, although only a first draft of the negotiations, highlighted the general unease of the EU27 about the general approach of the ‘omnibus’ simplification on AI. The written contributions resulting from this compromise confirm that the EU Council is moving towards a stricter and more politically secure version than that defended by the Commission, at the risk of unravelling its ambitions to ‘simplify’ the digital regulatory framework. (Original version in French by Isalia Stieffatre)