EU AI Act: Parliament and Council reach provisional political agreement

Negotiators for the Council presidency and the European Parliament reached a provisional agreement on the AI Act on 8 December 2023. The deal settled the political shape of the regulation, with technical drafting and formal votes still to follow.

What it is

A provisional agreement is a political compromise, not a published law. The Council's summary said the compromise text would still be confirmed by both institutions and pass legal-linguistic revision before formal adoption.

What it requires

For high-impact general-purpose models with systemic risk, Parliament said the deal requires model evaluations, adversarial testing, serious-incident reporting to the Commission and measures to ensure cybersecurity. Deployers of high-risk systems gained a mandatory fundamental rights impact assessment, including in insurance and banking. A new AI Office inside the Commission was given the job of overseeing the most advanced models. Parliament put the fine range at 35 million euro or 7% of global turnover down to 7.5 million euro or 1.5% of turnover, depending on the breach and company size.

What security leaders should do

The December 2023 deal named cybersecurity and adversarial testing as explicit duties for the most capable models. If your organisation builds on a frontier model, add a line to supplier reviews asking how the provider handles adversarial testing and incident reporting. If you deploy high-risk systems in finance or insurance, start scoping who owns the fundamental rights impact assessment, because it will need security input on data handling and access.