EU AI Pact reaches first signatories as companies sign voluntary pledges

The EU AI Pact is a voluntary European Commission initiative that invites companies to commit to early steps toward AI Act compliance before the law's obligations become mandatory. On 25 September 2024, the Commission convened key industry stakeholders in Brussels to celebrate the first signatories of the pledges.

What it is

The Pact was launched with the objective of assisting organizations in planning ahead for compliance with the AI Act and encouraging early adoption of the measures outlined in the Act.

The AI Pact was first launched in November 2023, obtaining responses from over 550 organizations of various sizes, sectors, and countries.

On 25 September 2024, over 100 companies signed the EU Artificial Intelligence Pact, committing to voluntary pledges to promote trustworthy and safe AI development ahead of the AI Act's full application.

The signatories include multinational corporations and European SMEs across sectors like IT, healthcare, banking, and automotive.

What it requires

The pledges call on participating companies to commit to actions including adopting an AI governance strategy to foster the uptake of AI in the organisation and work towards future compliance with the AI Act.

Companies are also expected to commit to identifying and mapping AI systems likely to be categorised as high-risk under the AI Act.

A third core action is promoting AI awareness and literacy among staff, ensuring ethical and responsible AI development.

Over half of these companies have pledged additional AI Pact commitments, such as human oversight, risk mitigation, and transparency in AI-generated content like deep fakes.

These pledges are not legally binding and do not impose any legal obligations on participants.

What security leaders should do

Security leaders whose organisations sign an AI Pact pledge should treat the listed commitments as a working checklist for AI Act readiness rather than a compliance shortcut, since the pledges carry no legal force. Mapping AI systems that could be classified as high-risk is a task security teams are well placed to lead, given overlap with existing asset inventory and risk assessment work. Because additional voluntary commitments cover human oversight, risk mitigation, and labelling of AI-generated content, security teams should coordinate with legal, privacy and communications functions before publishing a pledge so that operational controls match what is publicly declared.