Upcoming EU AI Act Obligations: Mandatory Training and Prohibited Practices
From 2 February 2025, AI system providers and deployers will need to ensure AI literacy among their workforces, while also eliminating prohibited AI practices. The EU AI Act came into effect on 1 August 2024, and the first obligations under the Act will become applicable from 2 February 2025.
AI Literacy
Article 4 of the AI Act imposes a high-level requirement for AI literacy: “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”
Companies therefore have significant flexibility in devising the content and format of their AI training for their staff, to meet this obligation by 2 February. While countering allegations of non-compliance can be challenging if companies fail to implement any form of AI training or learning resources, defending against regulators or civil claimants arguing that the AI training provided was inadequate will be much easier. Base-level training is certainly better than doing nothing in this context.
Consequences of Non-Compliance
No direct fines or other sanctions will apply for violating the AI literacy requirements under Article 4 of the AI Act. However, from 2 August 2026, providers and deployers of AI systems may face civil liability if the use of AI systems by inadequately trained staff causes harm to consumers, business partners, or other third parties. Furthermore, regulators will likely criticize obvious non-compliance with AI literacy requirements in any later inquiries and investigations.
What Can Companies Do Now?
A useful first step is to analyze what trainings or other resources to achieve AI literacy the company has provided to its workforce in the past and document these measures to evidence compliance and defend against future inquiries from regulators or claims from third parties.
If an analysis is either not feasible or indicates gaps in AI training, companies may opt to quickly implement AI literacy measures to close existing gaps in an efficient and effective manner before 2 February 2025.
Failing to ensure compliance with AI literacy obligations ahead of 2 February comes with particular risks in all EU Member State jurisdictions where director or managerial liability regimes apply.
Practical Solutions to Mitigate Risk
- Assess AI training needs: Evaluate current training programmes to identify gaps in AI literacy.
- Document existing measures: Keep records of all training initiatives to demonstrate compliance.
- Choose a layered approach: Offer a general basic training to all employees and rollout more sophisticated or role-specific trainings as needed.
- Consult with legal advisors: Implement AI literacy workshops or online courses tailored to various teams.
Prohibited AI Practices
What AI Practices Does the AI Act Prohibit?
Article 5 of the AI Act lists a number of prohibited AI practices and use cases. These prohibited practices include:
- Manipulative AI systems: AI systems that use subliminal techniques beyond a person’s consciousness to significantly alter behavior, potentially causing physical or psychological harm.
- Exploitive AI systems: AI systems that exploit vulnerabilities of specific groups, such as children or individuals with disabilities, to significantly alter behavior in a harmful manner.
- Emotion analysis in the workplace: AI systems that perform emotion analysis or biometric categorization of employees in the workplace, leading to privacy infringements and discriminatory practices.
- Social scoring for unfair commercial purposes: AI systems used for social scoring that evaluate or classify individuals based on their social behavior or personal characteristics, leading to unfavorable or unjustified treatment.
Consequences of Non-Compliance
Article 99 of the AI Act provides for severe sanctions for engaging in prohibited AI practices, including fines of up to the greater of €35 million or 7% of the previous year’s global turnover per violation. Engaging in prohibited AI practices from 2 February 2025 may lead to civil, administrative, or criminal law exposure under other EU or EU Member State laws.
What Can Companies Do Now?
Companies can access various practical ways to mitigate the risks of engaging in AI practices prohibited by Article 5 of the AI Act. In particular, companies should identify, assess, and document the AI systems they use in their business processes, especially those that may potentially fall within the categories of prohibited AI practices.
Practical Solutions to Mitigate Risk
- Identify and assess AI systems: Review AI systems to ensure they do not fall under prohibited categories.
- Document compliance efforts: Document rationale for why certain AI uses do not violate the prohibitions under Article 5.
- Other possible objectives: Analyze AI systems for potential high-risk activities and ensure transparency obligations are met.
