‘There’s no hiding from it’ – New AI law will be a game-changer on a par with GDPR, says expert, with fines of up to €35m

With the use of AI now mushrooming in many workplaces – from CV selection tools to employee monitoring systems – the new laws are likely to be relevant to almost every Irish employer and could mean huge fines for anyone caught in breach of the rules, said Ciara O’Kennedy, a partner at LK Shields and an expert in employment law.

“It is coming in a little under the radar and the impact for businesses has not yet quite hit home. But like GDPR, it is going to have a big impact.

"The new law will affect all businesses. There's no hiding from it. There are very few businesses now who don't use some form of AI.

“And similar to GDPR, they've introduced very severe penalties for those who just ignore it.”

Non-compliance with certain AI practices can result in fines up to €35m or 7pc of a company’s annual turnover. Other violations can result in fines up to €15m or 3pc of a company’s annual turnover.

The EU’s new AI act is intended to be a comprehensive legal framework for AI in Europe and is expected to become law over the next number of weeks.

The new legislation will then be implemented in stages over the next two years

“This is coming down the track for employers in Ireland and companies need to be thinking about this when it comes to AI systems and then their workplace,” she said.

The new regulations take a risk-based approach, classifying certain AI systems into risk categories based on their potential use or the impact they might have in a business or on society.

It's hard to legislate for the evolution of technology at the pace at which it is currently changing

The highest “unacceptable risk” category will be outlawed within six months, with rules for the use of generative AI services such as ChatGPT coming into effect after a year.

“It's hard to legislate for the evolution of technology at the pace at which it is currently changing,” said O’Kennedy.

“But one of the areas that has been identified as being an unacceptable risk, for example, is the untargeted scraping of the internet or CCTV for facial images to build a database.”

O’Kennedy said a number of systems used commonly by Irish employers in the management of workers and in the recruitment process had been identified under the high-risk category that could be more relevant to many Irish employers.

A CV selection type of AI system will need to be monitored and assessed to ensure that it complies with the rules

“One such system for example would be to help an employer filter through CVs and job applications.

“It's a great way of improving efficiencies in the interview process but that type of AI system will need to be monitored and assessed to ensure that it complies with the rules and requirements being introduced under the Act.

“There have been examples in the US where a big-tech employer was sued for discriminatory treatment by a candidate whose CV didn't get through the filtering process and it transpired the filtering process was not letting through applications for anyone over 55.

"There are other examples where people with speech impediments did not get through initial interviews conducted using AI systems.”