The European Parliament voted to completely ban real-time, remote biometric surveillance — a decision that will put lawmakers at odds with the EU’s 27 countries in upcoming negotiations.

The blanket ban, which was previously agreed by lawmakers, was up in the air after a political deal fell apart late last week.

Lawmakers also passed additional measures for general purpose AI and foundational models like GPT-4. Under the parliament’s plan, companies such as OpenAI Inc. and Google would have to perform risk assessments and summarize the copyrighted material used to train their models — regardless of how they’re used.

“Going forward, we are going to need constant, clear boundaries and limits to artificial intelligence,” Parliament President Roberta Metsola said in a press conference. “And here there is one thing that we will not compromise on: anytime technology advances, it must go hand in hand with our fundamental rights and democratic values.”

The parliament’s entire draft of the AI Act passed on Wednesday, with 499 voting in favor, 28 against and 93 abstaining. The vote paves the way for the so-called “trilogue” negotiations between the parliament, EU member states and European Commission to start later on Wednesday. The commission wants a deal by the end of the year, after which the new AI Act rules could impact companies by 2026.

Brando Benifei, one of the lead authors of the act, said at the press conference that negotiators may seek to have some rules apply earlier than that. In the meantime, officials like Executive Vice President Margrethe Vestager are pushing a “code of conduct” with companies that would be voluntary rules across the G7, plus India and Indonesia.

EU member states previously agreed that public facial scanning would be allowed for certain law enforcement situations, in an approach agreed at the end of last year. The provisions are a red line for a number of member states as they head into negotiations with the parliament and the European Commission.

Some members of the center-right European People’s Party wanted to include exceptions for finding missing children and preventing terrorist attacks, but these amendments overwhelmingly failed in the plenary vote on Wednesday.

“The result of today gives us even a stronger position,” said Benifei. “It’s clear that the parliament doesn’t want us to recede on such important topics, on avoiding mass surveillance.”

The commission first proposed the AI Act in 2021 with a risk-based approach. The idea was to regulate the use of AI, rather than the technology itself, completely banning certain practices like social scoring and setting standards for how the technology can be used in “high risk” situations.

However, EU member states pushed to include general purpose AI, systems that can be used in a wide variety of situations. Members of the parliament went further and added controls to “foundational models,” the large language models that form as the backbone for chatbots like ChatGPT, which has caught the public and regulator’s attention in recent months.

“I expect clear and proportionate rules on generative AI to be among the key discussion points for the trilogues,” Internal Market Commissioner Thierry Breton said in a statement. “We need effective transparency requirements on AI-generated content and strict rules against ‘deep fakes.’”

Just how far the EU goes in regulating generative AI could have a huge impact on the field, estimated to be worth more than $1.3 trillion in the next decade, as breaking the EU’s regulation could lead to fines of as much as 6% of a company’s annual revenue.

(Updates with European Parliament President comments in fourth paragraph.)