The practices prohibited by Article 5 AI Act relate to the placing on the market, the putting into service , or the use of specific AI systems.5 As regards real-time remote biometric identification (‘RBI’) systems, the prohibition in Article 5(1)(h) AI Act only applies to their use. Article 3(1) AI Act defines what constitutes an A I system. The Guidelines on the Definition of an AI system provide the Commission’s interpretation of that definition.
According to Article 3(9) AI Act, the placing on the market of an AI system is ‘the first making available of an AI system […]on the Union market’. ‘M aking available’ is defined as the supply of the system ‘for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.’6 The making available of an AI system is covered regardless of the means of supply, such as access to the system and its service through an application programm ing interface ( ‘API’), via cloud, direct downloads, as physical copies , or embedded in physical products. For example, a RBI system developed outside the Union by a third-country provider is placed on the Union market for the first time when it is offered in return for payment or free of charge in one or more Member States. Such placing on the market may occur by providing access to the system online through an API or other user interface.
Article 3(11) AI Act defines putting into service as ‘the supply of an AI system for first use to the deployer or for own use in the Union for its intended purpose’, therefore covering both supply for first use to third parties, as well as in-house development and deployment. The intended purpose of the system is the ‘use for which an AI system is intended by the provider, including the specific context and condition s of use, as specified in the information supplied by the provider in the instructions of use, promotional or sales materials and statements, as well as in the technical documentation.’7 For example, a provider builds a RBI system outside the Union and supplies that system to a law enforcement authority or to a private company established in a Member State to be used for the first time, thereby putting it into service. For example, a public authority develops a scoring system in-house and deploys it to predict the risk of fraud of household allowance beneficiaries, thereby putting it into service.
While the ‘use’ of an AI system is not explicitly defined in the AI Act, it should be understood in a broad manner to cover the use or deployment of the system at any moment of its lifecycle after having been placed on the market or put into service. This may also cover the integration of the AI system in the services and processes of the person(s) making use of the AI system, including as part of more complex systems , processes or infrastructure. While providers of AI systems must consider the conditions of use which may be reasonably foreseen prior to placing their AI systems on the market (intended use and reasonably foreseeable misuse8), deployers remain responsible for taking the lawful conditions for the use of the system into account.9 For the purposes of Article 5 AI Act, the reference to ‘use’ shouldbe understood to include any misuse of an AI system (‘reasonably foreseeable’ or not)that may amount to a prohibited practice.10 For example, an AI system used by an employer to infer emotions at the workspace is prohibited, except when used for medical or safety purposes (Article 5(1)(f) AI Act). The prohibition applies to deployers regardless of whether the provider (the supplier of the system) has excluded such use in its contractual relationships with the deployer (the employer), i.e. in the terms of use.