AI Act, 10 key legal questions for users and developers:

3 April 2024

AI Act, 10 key legal questions for users and developers:

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

From May 2024, we expect the final European rules in the field of artificial intelligence (‘AI’), namely the AI Act. There are still some errors in the provisional text that are currently being corrected. That is merely a formality. The law itself has already been accepted by the European legislator.

AI Act
On 13 March 2024, the European Parliament adopted the AI Act. The AI Act mainly revolves around the obligations for the use of AI in the areas of transparency and safety, in order to safeguard the rights of those involved. In the text below we explain the most important answers to questions.

1. What is the AI Act?
The AI Act is a European Regulation that contains rules for all autonomously operating computer systems and algorithms that make decisions, generate text, images or videos, or assist people.

2. What is the purpose of the AI Act?
The purpose of the AI Act is to create European regulation in a jungle full of emerging AI systems. This is intended to ensure that people and businesses in the European Union can rely on safe, transparent, unbiased AI systems.

3. What is the definition of AI under the AI Act?
An AI system is “a machine-based system that, for explicit or implicit objectives, infers from the input it receives how outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments should be generated.”

4. Who will the AI Act apply to?
The new European rules from the AI Act will apply directly to everyone who develops, places on the market or uses AI. And also to citizens who are unlawfully affected by the output of the AI system. Think, for example, of developers of AI systems, platforms or software. Anyone who uses this AI must demonstrate for themselves that the AI system complies with the requirements. That is why, as a user, you must also be given clarity about this by the supplier. The AI Act contains a few exceptions to this, with adapted rules for investigative and security services.

Most of the obligations under the AI Act are aimed at providers or developers that place high-risk systems on the market or put them into service in the European Union (regardless of whether they are established in the EU or not).

5. How is the AI Act structured?
The AI Act uses a risk-based approach to AI systems, divided into:

1. Unacceptable risks (these systems are prohibited)
2. High risks (these systems lead to many obligations)
3. Limited risks
4. Minimal risks

Different rules apply to the various risk categories above. Although the complexity and length of these rules prevents us from going into detail here, it is important for companies to be aware of the impact on their AI activities.

6. What about language models, such as ChatGPT?
Large Language Models (‘LLMs’) fall under ‘general purpose AI’, which means they can be used for multiple purposes. LLMs are trained on an extremely large amount of words, in certain contexts. As a result, these systems can generate answers and optimize language.

ChatGPT, one of the best-known LLMs, falls under a separate chapter in the new AI Act: the General Purpose AI (hereinafter ‘GPAI’) chapter. In the original version of the AI Act, GPAI still fell under the ‘limited risk’ category. But with the arrival of ChatGPT in November 2022, it was nevertheless decided to devote a separate chapter to GPAI. That chapter contains separate rules for GPAI.

7. What is the relationship between the AI Act and the GDPR?
The text of the AI Act does not pay attention to the GDPR. However, it is good to realize that where personal data is concerned, the GDPR naturally continues to apply. In such cases, for example, the Data Protection Officer (DPO) will also have to assist. The GDPR (General Data Protection Regulation) of course also remains in force alongside the AI Act.

8. How high are the fines under the AI Act?
Violators of the AI Act face very high fines (just as under the GDPR). These fines go up to 35 million euros per violation or 7% of the worldwide turnover of the group within which the violation is committed. For ‘minor’ administrative violations, this is 7.5 million or 1.5%. Lower fines apply for SMEs, but this still needs to be worked out in more detail.

9. When does the AI Act enter into force?
The law is expected to be officially published in May 2024, after which the rules will take effect in phases. A European regulation has direct effect in the member states, which means that the rules automatically take effect in the Netherlands and can be invoked directly by citizens of the member states.

The AI prohibitions apply to everyone six months later. The large tech companies will then be up in May 2025, with the rest following in 2026.

10. Will there be more rules on AI?
In addition to the AI Act, there is another European legislative proposal pending, called the AI Liability Directive. The directive must then be transposed into national legislation by the Dutch legislator. That legislation must then regulate civil (between companies and citizens) risk liability, regulating claims for compensation for damage caused by an AI system.

Conclusion AI Act
The rules from the AI Act focus on transparency and safety in the development and use of AI and apply to everyone who develops, places on the market, deploys or experiences AI. The law introduces a risk-based approach and marks an important step towards a regulated and safe AI environment.

The corporate lawyers at The Legal Company are prepared for these changes and can advise you on this new regulation. Are you curious how your AI systems comply with the requirements of the AI Act? Or do you have other questions in the field of AI? Then contact us via info@thelegalcompany.nl or 020 345 0152.

Nothing is as changeable as legislation and regulation. Please note that our blogs may no longer align with current legislation and regulations and may therefore be outdated. If you have questions or a problem relating to this blog, or if you require legal assistance, please contact us.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.