The application scope of the Artificial Intelligence Regulation (AIR)

April 16, 2024

In this article we continue the series of posts we started last week where we address different issues related to the Artificial Intelligence Regulation (AIR). After its approval, this regulation will entail the creation of new differentiated legal obligations for the different people involved in the value chain of an AI system.

The purpose of this publication will be to examine in detail the framework of application of the AIR, identifying the different roles that the subjects bound by the AIR may have and in which situations the obligations established by this standard are applicable.

In general terms, the scope of application of the AIR is quite broad, covering a multitude of subjects (who may be located both inside and outside the EU), but certain exceptions are also foreseen, such as national security issues or to support innovation, respect freedom of science and not undermine research and development activities (Considering 25, AIR.)

In general terms the AIR's scope of application is quite broad, but certain exceptions are also foreseen.

What roles can the parties bound by the AIR play?

In order to properly understand the scope of application of the AIR, we should first identify the different roles that can be adopted by the regulated entities under this Regulation, which may be both individuals and legal entities. Among these subjects, we distinguish:

Supplier: Those individuals who develop a general-purpose AI system or AI model for introduction into the EU market under their own name or trademark. As an example, when distributing its AI system ChatGPT, OpenAI acts as a supplier under the AIR.
Deployer: Any person who uses an AI system under his own authority in a professional environment. Any company that incorporates an AI system in its processes would thus act as the person responsible for the deployment of such a system.
Authorized Representative: Any person located in the EU territory who has been designated - provided that he/she previously accepts such designation - by a supplier located outside the EU to fulfill the obligations and carry out the actions required by the AIR on its behalf. This is, in any case, a concept similar to that included in other European regulations such as the General Data Protection Regulation.
Importer: A person established within the territory of the EU who markets or puts into service an AI system under the name or trademark of another person established outside the European territory.
Distributor: Those individuals, other than the supplier and the importer, who place an AI system on the EU market.
Subsequent supplier: Those suppliers who place on the market or put into service an AI system that incorporates a general-purpose AI model, regardless of whether it is their own or a third party's model.

✅ The reference to an “Operator” is generic, as it constitutes an umbrella term that encompasses, in addition to the terms defined above, also the manufacturer of the AI system or model. In the context of AIR, any of these individuals may be referred to as an “operator”.

In which situations does the AIR apply?

Taking into account these different roles that people can play in the value chain of an IA system, the Regulation will apply to:

Vendors marketing AI systems or AI models for general use in the EU, regardless of whether such vendors are established or located in the EU or in a third country.
Those responsible for the deployment of AI systems located in the EU.
Suppliers and deployers of AI systems that are located outside the EU, when the output information generated by the AI system is used in the EU.
Importers and distributors of AI systems.
Manufacturers of products that place on the market or put into service an AI system together with their product and under their own name or trademark.
Authorized representatives of suppliers who are not established in the Union.
Affected persons who are located in the EU.

As we can see, similar to the General Data Protection Regulation, the scope of application of the AIR is extraterritorial in scope as it applies to providers and deployers located outside Europe when they market AI systems or AI models for general use in European territory or when the output generated by their AI systems is used in European territory.

Are there any exceptions to the scope of the AIR?

The AIR also establishes a few exceptions that provide for specific circumstances in which the AIR obligations will not apply. These exceptions are as follows:

The obligations under the AIR do not apply to Member States' national security competences or in the case of AI systems used exclusively for military, defense, or national security purposes. Nor does it apply when outputs from AI systems located outside the EU are used for these purposes.
It will also not apply to public authorities of third countries or international organizations using AI systems in the framework of international agreements for law enforcement and judicial cooperation with the EU or Member States, provided that such authorities or organizations implement adequate safeguards to safeguard the fundamental rights and freedoms of individuals.
The AIR will not affect the application of the provisions relating to the liability of intermediary service providers under the Digital Services Regulation.
Nor shall it affect AI systems or models, including their outputs, that have been specifically developed and put into service for the sole purpose of scientific research and development.
The AIR shall not apply to any activity related to research, development, testing, or activity relating to AI systems or models prior to their being put into service or on the market, with the exception of testing under real-world conditions contemplated in the AIR itself.
The AIR obligations shall not apply to those deployers who are natural persons using AI systems for personal, non-professional activities.
The AIR obligations shall not apply to free and open-source AI systems, unless they are high-risk, systems prohibited under Chapter II of the AIR, high-risk systems under Chapter III, or are among those under Chapter IV of the AIR (systems that generate ultra-counterfeits, systems for emotional recognition or biometric categorization, chatbots).

Free and open source AI systems are not subject to the AIR obligations, except for the exceptions provided.

What about other regulatory obligations that may also apply?

Since AI systems can serve a multitude of purposes, it is not difficult to imagine that AIR obligations will have to be applied in a harmonized way together with other obligations that may also be applicable, making this joint application of various regulatory frameworks a challenge. The AIR therefore clarifies that data protection, communication secrecy, consumer protection or product safety obligations established in EU regulations will be applicable together with and without prejudice to the obligations established in the AIR.

As we can see, if we seek to comply with the obligations set out in the AIR, the question we should first ask ourselves is whether we fall within both the subjective and objective scope of application. However, understanding the entire framework of application of the AIR can be a difficult task, especially considering the wide material and territorial extension of the scope of application of the Regulation and the complexity that this rule itself presents.