Unpacking the EU AI Act: Key Concepts and What They Mean for Researchers
Unpacking the EU AI Act: Key Concepts and What They Mean for Researchers lays the groundwork by exploring the Act’s foundational concepts, including definitions of AI systems and General-Purpose AI models, clarifying what falls under its scope.
It's the first part of the series "Unpacking the EU AI Act", by Patrick Brunner.
The EU AI Act came into force on August 1, 2024. It is a groundbreaking legal framework for artificial intelligence (AI) in Europe. This first blog post provides an overview of the EU AI Act, its framework, and key definitions. It highlights the Act’s relevance to the research community and introduces fundamental concepts such as "AI systems" and "General-Purpose AI models."
What Is the AI Act?
On August 1, 2024, Regulation (EU) 2024/1689, commonly known as the AI Act, came into effect. It establishes a horizontal legal framework for artificial intelligence (AI), meaning it regulates AI comprehensively rather than focusing on specific sectors such as healthcare or manufacturing. This broad perspective addresses potential AI use cases holistically.
The regulatory scope of the AI Act covers products—specifically AI systems and General-Purpose AI models (GPAI models). It categorizes AI regulation along the lifecycle of these products:
The lifecycle focus divides the regulation into three major sections: a) Development, including research and most testing activities, b) Provision, and c) Use of AI systems. This means that the AI Act regulates more than just the testing of AI products or finished products placed on the market—it covers the entire lifecycle of AI systems with some exceptions as well will see. AI systems specifically developed and used solely for scientific research, development, or prototyping are excluded. This exemption intends to encourage innovation and experimentation without imposing regulatory burdens. Once such systems transition into commercial use or other regulated applications, the AI Act applies.
While this division offers a clear framework, it also recognizes that AI is an adaptive technology, potentially changing throughout its lifecycle. Consequently, the AI Act includes cross-cutting rules that address these adaptive characteristics. In the following sections, key terms will be discussed, followed by an examination of their implications for the research community.
Key Terms: The difference between AI Systems and GPAI Models
According to Art. 3 nr. 1 AI Act[1] an “AI system”
“means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”.
An AI system consists of various components that facilitate its functioning. AI systems are composed of various components, including software and data. While these terms are not explicitly defined in the AI Act, they are generally interpreted broadly under EU secondary law[2];[3]. For this blog entry, it suffices to note that AI systems incorporate both: software and data.
The EU legislator clarifies the definition of an AI system in recital 12. Importantly, the term excludes software systems that simply perform pre-determined functions based on fixed human-defined rules. The definition is intentionally broad to include emerging technologies, ensuring the framework remains adaptable over time. Examples of relevant techniques include machine learning and logic- or knowledge-based approaches, which enable an AI system to make inferences. AI systems can function independently or as components within other products, regardless of integration. This definition aligns with the OECD’s understanding of AI systems stated in their principles on trustworthy AI.[4]
On the other hand, a General-Purpose AI model is defined under Article 3(63) as:
“an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market”.
In summary, a General-Purpose AI (GPAI) model is a versatile AI model trained on large datasets, capable of performing diverse tasks across various applications. It is regulated only when provided commercially, not during its use in research, development, or prototyping phases prior to market placement.
The EU legislator highlights that an AI model, while a crucial part of an AI system, is not a system on its own. To function as an AI system, it needs additional components, such as a user interface, to make it operational. This understanding aligns with the OECD's view, which describes AI models as tools that represent external environments or contexts (e.g., processes, objects, or interactions).
Because of this, the AI Act doesn’t regulate the use of standalone AI models after their development and provision. Their utilization falls under the Act when integrated with other components to create a fully functional AI system.
For GPAI models, the Act specifies that they must demonstrate a high level of generality, allowing them to perform a wide range of tasks. This is often achieved with advanced techniques like self-supervised training using vast datasets and models with billions of parameters. These characteristics generally require significant financial investments beyond typical public research funding. Since the focus is on the implications of the AI Act on the research community, this blog series will primarily discuss the regulation of AI systems and not look into GPAI models further.
[1] Wherever no reference is made to a certain legal act in relation to an article or recital mentioned in this blog entry, the respective article or recital refers to the AI Act.
[2] Cf. Recital 103.
[3] Cf. for example the notion of data under Art. 2 nr. 1 of the EU Data Act or the notion of software as explained by the EU legislator in recital 14 under Directive (EU) 2024/2853 (the new product liability directive).
[4] OECD, Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449, available at: https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449; for an explanation of the OECD’s notion of AI systems, see: OECD (2024), Explanatory memorandum on the updated OECD definition of an AI system, OECD Artificial Intelligence papers No. 8, available at: https://www.oecd-ilibrary.org/science-and-technology/explanatory-memorandum-on-the-updated-oecd-definition-of-an-ai-system_623da898-en
