Just over a month after a political agreement was reached on the EU AI Act, which we've previously discussed, an updated draft of the Act was leaked on Monday 22 January. 

The leaks

Although widely publicised as being a final draft, the document initially leaked is actually a 892 page document containing the European Commission proposal, the European Parliament mandate, the Council of the EU mandate, and the most recent draft of the AI Act which reflects the general agreement reached in December 2023. 

It’s been reported that this document was received by EU Member States on Sunday 21 January before a number of upcoming discussions, including the COREPER meeting on Friday 2 February where the Member States will be asked for a “yes” or “no” decision on the draft. 

This leak was followed by a secondary leak which provided a consolidated version of the updated draft at a (slightly) more manageable 258 pages (albeit the first 82 pages are recitals). 

What now?

Although not necessarily final, the leaked text is the most up to date draft available and does reflect the current consensus as to what the Act might look like - providing those designing, developing, and/or deploying AI with a useful indication as to what they need to begin thinking about from a compliance perspective. That said, it is possible for technical changes to be introduced so this draft - at least for the next few weeks - can only be a guide. 

As reported with the initial leak, France are looking into the possibility of blocking the 2 February vote, or at least delaying it, in order to add further concessions into the draft, particularly around regulating foundation models. These attempts to assemble a sufficient blocking minority have, so far, been unsuccessful but it’s expected that France will nevertheless seek to exert some control on the implementation of the AI Act including via secondary legislation.  

After many trials and tribulations, this draft may well end up becoming the final draft of the text, but equally the COREPER meeting could turn out to be another speedbump in the EU's attempts to get the AI Act over the line. That said, on 24 January the European Commission announced the establishment of their European AI Office – which among other things will be responsible for the AI Act’s implementation and enforcement – noting that their Decision should “enter into force as a matter of urgency, ahead of the adoption of that Regulation”. Interestingly, the Commission Decision establishing the Office enters into force the day before the AI Act will if the COREPER vote is successful and the Act is subsequently published in the EU Official Journal on 2 February, suggesting at least a degree of confidence that the Act is nearly there and the text will be passed. However, with different elements of the Act expected to become applicable anywhere from 6 months for “unacceptable risk” AI systems to 3 years for “high risk” AI systems (rather than the 2 years as originally expected) after it enters into force, even if Member States approve the draft on 2 February, this is only the start of an inevitably long story…