The AI Act aims to promote responsible AI use and development within the European Union, establishing a framework for ethical innovation and ensuring the responsible advancement of technology.

"With the entry into force of the regulation, companies will not have to change their AI-based products and processes immediately, but will be given a transition period of six months to two years, depending on the specific AI model. However, as product development is a time-consuming process, companies should align their processes and products under development today with the future requirements to avoid future disputes and costs," said Toomas Seppel, an attorney-at-law at Hedman Law Firm.

If a company develops an AI-based product today that will be on the market in two years' time, it will already have to comply with all the requirements of the regulation in advance.

"For example, the AI Act concerns the choice of data sources used to train AI, and in the future there may be disputes about what it means for a human being to sell their data to train AI models, as has been the case with the social media platform Reddit. For large corporations, the quality of training data is a major issue that needs to be addressed within two years," said Seppel.

Large corporations must understand that the AI Act's obligations and requirements extend to companies outside the EU if they provide AI-powered products and services in the EU market. This includes US-based companies like OpenAI, whose GPT series is available to EU consumers.

However, for prohibited AI systems, the AI Act will come into force in six months, which means that the use of such systems will have to be abandoned. Prohibited systems include biometric categorisation systems using sensitive data and facial recognition databases. "The EU will ban the use of systems that manipulate people's subconscious behaviour and exploit their vulnerabilities," said Seppel.

However, in a swift change, people may notice that the artificially generated content circulating on the internet needs to be clearly distinguishable. "We are already seeing that it is difficult for the average person to distinguish whether a text, image or video has been created by a human or artificially. Developers of large AI models will have to add watermarks to AI-generated content in the future, and developers of Facebook and Instagram have also promised to put 'AI-generated' or similar labels on generated content," explained Seppel, adding that the new requirement will come into force 12 months after the entry into force of the regulation.

An AI system that interacts with humans will have to inform users that they are interacting not with another human, but with a machine. The notification obligation covers chatbots ranging from customer service in banking to social media such as Snapchat and ChatGPT.

Legal entities can face fines of up to €7.5 million, or 1.5% of the company's annual turnover, for non-compliance with the AI Act. For global companies, fines could reach €35 million and represent up to 7% of global turnover. No fines are foreseen for individuals under the AI Act. "However, this does not exempt individuals from liability, because if AI-generated content is used to spread false information or to defame a person, the content creator can be held liable on general grounds," stressed Toomas Seppel.