Landmark EU AI Act Sets Benchmark for AI Regulation, but Fails to Meet the Bar on Human Rights Protection

(BRUSSELS) — Today, the European Parliament agreed to the EU’s Artificial Intelligence Act in its Plenary session. The final Act is a landmark piece of legislation that many will look to as the tone-setter globally. Whilst human rights and privacy protections run throughout the Act, and great progress was made since its first version, the Centre for Democracy & Technology Europe (CDT Europe) notes with disappointment that too much ground was lost on human rights in the final compromise negotiations. The resulting compromise text leaves many of civil society’s previously articulated concerns and demands unaddressed. 

“For those advocating for human rights, the AI Act is a mixed bag,” commented Laura Lazaro Cabrera, CDT Europe’s Counsel and Director of the Equity and Data Programme. “Whilst we can rightly celebrate that privacy and other human rights are foregrounded in the law, there are too many exemptions that could lead to harmful AI systems posing serious risks to citizens, particularly those in vulnerable situations such as at borders.”

“This is only the beginning, however,” continued Lazaro Cabrera. “There’s so much at stake in the implementation of the AI Act and so, as the dust settles, we all face the difficult task of unpacking a complex, lengthy, and unprecedented law. Close coordination with experts and civil society will be crucial to ensure that the Act’s interpretation and application mean that it is effective and consistent with the Act’s own articulated goals: protecting human rights, democracy, and the rule of law.”

CDT Europe welcomes one of the key features of the AI Act: the obligation for deployers of high-risk AI systems to conduct fundamental rights impact assessments (FRIAs). Disappointingly, this obligation only applies to public sector bodies and a narrow subset of private sector bodies.

The Act introduces important limitations on law enforcement’s use of AI, yet lawmakers failed to implement a total ban on the use of untargeted facial recognition by law enforcement. CDT and other human rights advocates warned that such use would pose unacceptably high human rights risks, in particular for marginalised and at-risk communities.    

Serious risks to human rights when it comes to AI remain in the AI Act. For example, the law’s exemptions for facial recognition threaten to “swallow the rule” and allow for widespread facial scanning by law enforcement on the EU’s streets – a serious threat to, for example, the right to protest. The law’s limitations on the use of live facial recognition only apply to law enforcement use in publicly accessible spaces, and explicitly exclude borders, which are known sites of human rights abuses.  

The Act also creates what could easily be an over-exploited exemption for national security. While the Act does ban use of emotion recognition technologies, that ban only applies to education and the workplace, leaving unanswered questions as to why the Act did not adopt a ban on the use of these technologies as the starting position. 

As the EU implements the AI Act, CDT Europe will continue to monitor the impacts of the AI Act on fundamental rights, clarify how the AI Act will intersect with other EU digital regulations, and push for civil society voices to be part of the conversation.

***

The Centre for Democracy & Technology Europe (CDT) is the leading nonpartisan, nonprofit organisation fighting to advance human rights in the digital age. We shape technology policy, governance, and design with a focus on equity and democratic values. Established in 1994, CDT has been a trusted advocate for digital rights since the earliest days of the internet. The organisation has offices in Washington, D.C., and in Brussels, Belgium.