The EU’s AI Act: Implementation of Preliminary Obligations
The AI Act represents a significant step towards establishing a uniform legal framework for the development, market placement, and utilization of AI systems within the European Union (EU). This initiative aligns with the EU’s core values, promoting human-centric and trustworthy AI while ensuring the protection of health, safety, and fundamental rights as outlined in the Charter of Fundamental Rights of the European Union.
The AI Act addresses both providers who place AI systems on the market and deployers who utilize these systems. Notably, employers using AI systems in processes such as recruitment must particularly heed the obligations set forth for deployers.
AI Literacy
As of February 2, 2025, the first obligation under the AI Act mandates organizations to ensure a sufficient level of AI literacy among individuals involved in AI systems. This requirement aims to equip all stakeholders with the necessary skills to make informed decisions and use these technologies responsibly.
To fulfill this obligation, organizations must consider:
- The technical knowledge, experience, education, and training of staff interacting with AI systems.
- The specific context in which these AI systems are deployed.
It is essential for employers to assess the groups impacted by the AI systems to tailor their training and literacy measures effectively. The AI Act does not delineate specific measures for achieving ‘sufficient’ AI literacy, allowing organizations the flexibility to define what sufficiency means for their context.
Organizations are encouraged to implement training sessions focused on AI literacy and to develop comprehensive responsible AI use policies to meet this obligation. Importantly, while not all employees require the same level of literacy, a basic understanding of AI principles is expected from anyone interacting with these systems. Compliance is viewed as an ongoing process, necessitating continuous adaptation and learning.
The EU’s AI Office, established as a center of expertise, has introduced a ‘living repository’ of AI literacy practices. This resource aims to foster learning and knowledge sharing among AI providers and deployers, although adherence to these practices does not automatically equate to compliance with the AI Act.
Prohibited AI Practices
Beginning on February 2, 2025, the AI Act prohibits several practices considered unacceptable due to their violation of fundamental European norms. These practices include:
- AI systems employing subliminal techniques or manipulative methods that could lead individuals to make harmful decisions.
- Systems that exploit vulnerabilities based on age or disability, causing significant harm.
- AI systems engaging in social scoring, resulting in detrimental treatment based on personal characteristics.
- Unregulated expansion of facial recognition databases through unauthorized data scraping.
- AI systems inferring emotions, except for medical or safety purposes.
Violators of these prohibitions may face administrative fines reaching up to EUR 35 million or a maximum of 7% of their total worldwide annual turnover, whichever is greater. SMEs and start-ups may receive reduced fines considering their economic viability.
AI Policy Recommendations
To comply with the AI Act, the EU’s AI Office will encourage the formulation of codes of practice, reflecting international standards. Although the definition of ‘codes of conduct’ is broad and unclear, establishing an AI policy is highly advisable. Such a policy can clarify the acceptable use of AI within organizations, including:
- Guidelines on which AI systems may be employed.
- Specifications on user access and operational limits related to AI.
- Measures to maintain ongoing AI literacy among staff.
Key Takeaways for Employers
The initial obligations outlined in the AI Act are now in effect. As this pioneering regulation begins to influence real-world business practices, it is crucial for employers to recognize their responsibilities. Employers should:
- Identify the AI systems currently in use within their organization.
- Evaluate the risk levels associated with these systems.
- Discontinue the use of any AI systems deemed to carry unacceptable risks.
Following these assessments, organizations should evaluate the existing level of AI literacy among their workforce and identify necessary additional measures, such as training programs and internal guidelines.
While not mandatory, drafting an AI policy with explicit usage guidelines is recommended as a straightforward action towards achieving adequate AI literacy.
Finally, organizations must remain vigilant regarding upcoming regulatory developments, as additional obligations under the AI Act will commence on August 2, 2025. Given the potential consequences of non-compliance, seeking professional legal advice regarding HR, privacy, and AI-related issues is advisable for those uncertain about their obligations or needing assistance in creating an AI policy or training initiatives.
