The European Parliament voted through the bloc’s AI Act on Wednesday, bringing in a range of rules for various AI products — categorized by risk — across the common market that will enter into force in a staggered way over the next two years.

It passed by a wide margin with 523 votes in favor, 46 against and 49 abstentions, and aims to “protect fundamental rights, democracy, the rule of law and environmental sustainability from high-risk AI, while boosting innovation and establishing Europe as a leader in the field.”

The legislation, which is the first comprehensive framework for regulating the technology anywhere in the world, will go through a final check by lawyers and linguists before being formally endorsed by the European Council. It is expected to enter into the EU’s journal of law in May.

It categorizes AI systems by the potential harm they could do if they fail to work as intended or advertised, going from low-risk services such as spam filters through to high-risk tools used in critical infrastructure. The highest risk tier is “unacceptable” and these systems would be prohibited under the new law.

The high-risk systems are covered by a stricter governance regime, with developers obliged to be able to log the system’s activities and processes to ensure that its outputs can be traceable in case they have an impact on something that might be later contested, such as a decision relating to employment.

The move to legislate has been controversial, with several member states including France and Germany warning that the rules could hamper their domestic companies and potentially offer an advantage to competitors in the United States and China.

The first impacts of the AI Act will be felt six months after it enters into force, when its provisions to protect fundamental rights — such as banning “biometric categorisation systems based on sensitive characteristics and untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases” — will apply.

Also prohibited will be the use of emotion recognition technologies in the workplace and schools, as well as social scoring and certain kinds of predictive policing based on profiling individuals.

The use of real-time facial recognition systems by law enforcement is permitted “in exhaustively listed and narrowly defined situations,” when the geographic area and the length of deployment are constrained.

“Such uses may include, for example, a targeted search of a missing person or preventing a terrorist attack. Using such systems post-facto… is considered a high-risk use case, requiring judicial authorisation being linked to a criminal offence.”

A year and a day after the AI Act is published in the official journal of EU law, the rules around general-purpose AI and governance will enter into effect. These introduce obligations on developers to meet transparency requirements, including compliance with copyright law, and will force developers to be able to publish detailed summaries of the content they use for training.

The European Parliament’s co-rapporteur on the legislation, Brando Benifei, said: “We finally have the world’s first binding law on artificial intelligence, to reduce risks, create opportunities, combat discrimination, and bring transparency.

“Thanks to Parliament, unacceptable AI practices will be banned in Europe and the rights of workers and citizens will be protected. The AI Office will now be set up to support companies to start complying with the rules before they enter into force. We ensured that human beings and European values are at the very centre of AI’s development,” Benifei added.

Dragos Tudorache, the co-rapporteur focused on the legislation’s impact on civil liberties, said: “The EU has delivered. We have linked the concept of artificial intelligence to the fundamental values that form the basis of our societies. However, much work lies ahead that goes beyond the AI Act itself.

“AI will push us to rethink the social contract at the heart of our democracies, our education models, labour markets, and the way we conduct warfare,” Tudorache added. “The AI Act is a starting point for a new model of governance built around technology. We must now focus on putting this law into practice.”