European Union: Reached Council and Parliament agreement on AI Act including cybersecurity requirement for "high-risk AI systems"

On 9 December 2023, the Parliament and the Council of the European Union adopted a provisional agreement on the proposal on harmonised rules on artificial intelligence (AI Act). The compromise agreement clarifies the definition of an AI system by aligning it with the OECD's proposed approach, seeking to differentiate AI from simpler software systems. The AI Act specifically exempts systems exclusively utilised for military or defence purposes and those employed solely for research, innovation, or non-professional personal use. The agreement includes amendments related to cybersecurity. Specifically, high-risk AI systems must be designed in a way that achieves an appropriate level of accuracy, robustness and cybersecurity. High-risk AI systems should further be designed so that they are resilient to third-party attempts to alter their use or performance, for example through manipulation of datasets, inputs designed to trigger mistakes, model flaws, model poisoning, and confidentiality attacks. Following the provisional agreement, the next steps involve finalising the document and submitting it to the European Union Parliament and Council for adoption.