Council of the EU gives final approval to the AI Act

The Council of the European Union formally approved the Artificial Intelligence Act on 21 May 2024. With both co-legislators now on record, only signature and publication stood between the text and entry into force.

What it is

The Council's vote closed a legislative file the Commission had opened with its April 2021 proposal. The Council's release restated the scope limits that matter when mapping systems: the act covers only matters within EU law and exempts systems used exclusively for military and defence or for research.

What it requires

The Council summarised a split regime for general-purpose models: limited duties such as transparency for most, and stricter rules for those with systemic risks. Enforcement sits with an AI Office in the Commission, backed by an AI Board of member-state representatives and a stakeholder advisory forum that feeds technical expertise to both. Penalties are calculated as a share of global annual turnover or a fixed sum, whichever is higher, with proportional caps for SMEs and start-ups. Public-service deployers of high-risk systems must assess fundamental rights impact first.

What security leaders should do

Use the scope exemptions carefully. When a model built in a lab moves toward production, re-check whether any exemption still fits, so tag models in your inventory by intended use and review the tag at each deployment gate. If you sit in a public-service organisation, fold the fundamental rights assessment into the same review that covers data protection and threat modelling, rather than running it as a separate paperwork exercise.