European Parliament Approves Its Position on the AI Act

On June 14, 2023, the European Parliament approved its negotiating mandate on the AI Act; it was an institutional position, not yet the final law.

The European Parliament today approved its negotiating position on the Artificial Intelligence Act (AI Act), the regulation that aims to become the world's first comprehensive legal framework for governing this technology. The vote in the Strasbourg plenary passed with 499 votes in favor, 28 against and 93 abstentions, a broad show of support that gives MEPs a mandate to negotiate the final text with the Council of the EU and the European Commission. Primary source

What the approved text contains

Parliament's position keeps the approach of the Commission's original proposal, presented in April 2021: classifying AI systems according to their level of risk and applying obligations proportional to that risk. The greater the potential danger to people's rights and safety, the stricter the requirements for transparency, human oversight and prior assessment.

The most significant addition compared to the initial proposal is the inclusion of specific rules for so-called generative AI models and foundation models, the category that systems like GPT-4 or Stable Diffusion belong to. MEPs have agreed that companies developing this type of model will have to clearly disclose which content has been generated by artificial intelligence, design systems to prevent the generation of illegal content, and publish summaries of the copyrighted data used to train their models. This last point responds directly to the controversy that has surrounded text- and image-generation tools in recent months, with authors, illustrators and publishers accusing them of having been trained on protected works without authorization or compensation.

The bans Parliament is introducing

The text voted on today expands the list of prohibited uses already present in the Commission's proposal. Among the practices the European Parliament wants to ban are real-time remote biometric identification in public spaces, emotion recognition systems in the workplace, education, policing, border management and law enforcement, biometric categorization based on sensitive characteristics such as sexual orientation or religion, and predictive policing systems based on profiling or location.

This expansion of the bans was one of the most contentious points during internal negotiations among the parliamentary groups, with parties like the European People's Party pushing for exemptions for security forces that ultimately did not make it into the approved version.

Why this vote matters

The European Union has spent more than two years working on this regulation, which aims to become a global reference standard in a similar way to how the General Data Protection Regulation (GDPR) set the international pace on privacy starting in 2018. The Council of the EU, representing the governments of member states, had already set its own general position in December 2022. With today's vote, the three European institutions —Parliament, Council and Commission— enter the trilogue phase, the three-way negotiations in which the regulation's final text will be settled.

The political calendar adds pressure to the process: Spain takes over the rotating presidency of the Council of the EU next July, and the Spanish government has expressed its intention to push for a close to the negotiations during its six months at the helm of the institution, before the 2024 European Parliament elections complicate the legislative agenda.

What remains to be decided

The thorniest points of the negotiation remain open. Council and Parliament start from different positions on matters such as the exact scope of obligations for foundation models, how small and medium-sized enterprises that integrate these systems without having developed them themselves should be treated, and the role national authorities will play alongside a potential European AI oversight office.

While these negotiations move forward, the law will remain unenforced for months, even years: once the final text is agreed, the regulation typically allows for two-year adaptation periods before coming fully into force. For companies already deploying generative AI systems in Europe, today's message is clear: the rules of the game are taking shape, and transparency about the origin of training data and machine-generated content is set to stop being a voluntary option and become a legal obligation.

The first question is which version of the text we are reading

In a legislative file, “the AI Act says” can hide several different stages. The Commission proposes, the Council sets the member states' position, Parliament adopts amendments and the institutions then negotiate. The text adopted by Parliament shows the wording voted on that day; the press release summarises priorities. Neither document alone was yet a rule binding a company.

A minimum reading record should name the institution, date, document type and stage. Preserve the procedure number and locate the article or amendment behind each claim. This prevents a ban supported by Parliament being confused with wording that may emerge from trilogue negotiations. A large majority provides a political mandate but does not prevent later changes.

The risk-based approach does not classify an entire company either. It classifies uses or systems according to purpose and context. The same technique may fall outside a category in a creative tool but face strict duties when used in employment, credit, education or essential services. A buyer should ask which decision the software informs, about whom and with what consequences.

How to build an inventory before a rule arrives

An organisation need not predict the final text to collect facts. It can list every system, provider, purpose, data source, affected people, human oversight and appeal route. Link contracts, evaluations and change logs. That inventory makes it possible to adapt controls as legal categories change without starting again.

Provider and deployer duties must also be separated. The developer of a general model knows some properties; the organisation placing it in an employment or education process knows the context and possible harm. A summary that merely says “companies must” erases that distribution of responsibility.

The transferable skill is to date and label every regulatory claim. Before acting, ask who approved the document, at what stage, which version is open and which article contains the rule. If those questions cannot be answered, a political proposal is probably being treated as law in force.

The application date deserves its own timeline. Publication, entry into force and enforceability can occur at different moments, with exceptions or transition periods. An organisation should preserve the official source and check the calendar rather than infer it from an old article. The method works for any technology regulation: keep version, regulated actor, required conduct, date and supervisory authority in separate columns.

Press summaries remain useful for orientation, but decisive work begins by opening the linked document and finding the exact term. The right combination is news for discovery, official text for verification and specialist advice for a real legal application. None of the three replaces the others or freezes a future version.