The Council of the EU has approved a version of the proposed Artificial Intelligence Regulation (AI Act) on December 6, 2022.

Once adopted by Parliament, the AI Act will be the first horizontal legislation in the EU to regulate AI systems, introducing new rules for the safe placing on the EU market of products with an AI component. 

The Regulation’s extra-territorial scope (namely its application to providers and users outside the EU when the output produced by the AI is used within the EU) and its high fines (the higher of up to €30 million and up to 6% of total worldwide annual turnover) seem likely to shape the regulatory requirements outside the EU, as has been the case with the GDPR  

We first reported on the proposal here, when the Act was first announced in April 2021 here and explained how the EU intends to regulate AI.

The EU Council is proceeding with its risk-based approach to this legal framework. The EU’s approach sounds sensible but the effectiveness and self-proclaimed 'future-proof' status of the Artificial Intelligence Act remains to be seen!   

Key updates now making part of EU’s general approach:


The EU has agreed to narrow the definition of an 'AI system' to systems developed through machine learning approaches and logic – and knowledge-based approaches.

Prohibitions on AI 

The Act will prohibit the private sector using AI for social scoring.  Social scoring is a credit rating development based on peoples’ behaviour, designed to strengthen social stratification. 

The Act will also prevent the use of AI in exploiting a specific category of people, including those particularly vulnerable to their social or economic situation. 

General purpose AI systems

The EU will now recognise a “general purpose AI”; which is an AI subsequently integrated into another high-risk AI system. Here, certain requirements applicable to high-risk AI systems also apply, however, rather than being directly applicable, implementing acts will be required to specify how they should be applied in relation to the general purpose AI.

Scope and law enforcement

This is the most controversial update. The scope of the Act excludes matters such as national security, defence and the military. It will not apply to AI systems used solely for research and development, as well as those used for non-professional purposes. 

While national security, defence and the military are critical aspects entirely under the control of Member States’ governments, questions arise as to whether the exclusion within the Act might enable States’ surveillance powers to go beyond citizens’ freedoms and how those can be monitored.   


There will now be an obligation on public entities as users of high-risk AI systems to register in the EU database. Also, AI deploying emotion recognition systems will have to inform natural users about potential exposure.

Now that the general approach has been adopted, the Council will enter negotiations with the European Parliament to finalise the proposed Act, due into force later this year.