AI Act Phase 1: prohibitions + competence duty
What applies
Since 2 February 2025, the AI Act's first two chapters have applied: the ban on certain AI practices (Art. 5) — manipulative systems or social scoring, for instance — and the duty to build AI literacy (Art. 4).
Art. 4 is the broadest-reaching duty in the whole Act: it applies to every company that uses AI systems. Not only once you reach high-risk AI, not only above a certain company size — access to ChatGPT in your sales team is enough.
Important since 27 July 2026: the Digital Omnibus Regulation (EU) 2026/1744 rewrote Art. 4. What's required now are measures that support the development of AI literacy — you no longer have to guarantee a specific literacy level. The duty itself stays: without a documented measure that fits your use case, there's no evidence trail.
Who it affects
Practically every company where staff use AI tools — from text assistants to applicant screening.
Example (fictional): The applicant who asked back
A retail company with 80 employees has an AI tool pre-screen job applications. A rejected applicant invokes the GDPR and asks how the decision was made — and whether staff are trained on the tool.
HR management can document neither. The case lands with the state data protection authority; the missing AI literacy under Art. 4 becomes part of the file. What started as an HR matter is now a compliance case spanning two areas of law.
The risks, plainly stated
Fines for prohibited practices
Violations of Art. 5 carry fines of up to €35 million or 7% of worldwide annual turnover (Art. 99(3) AI Act) — the highest fines in the entire Regulation. For SMEs and start-ups, the lower of the two figures applies, not the higher (Art. 99(6) AI Act).
Burden of proof in a dispute
Without documented training, you lack evidence of careful organisation in a damages claim, a customer audit, or before an authority.
Shadow AI
Untrained teams use AI anyway — just uncontrolled: customer data in outside tools, hallucinations in proposals, nobody checking.
Your next steps
- 01Build an AI inventory: which tools does who use, and for what?
- 02Tailor training to each use case's risk and document it with a certificate
- 03Set guardrails: which data may go into which tools?
In Compliverse
The compass turns exactly these steps into measures in your plan automatically — with deadlines, owners, and evidence.
Plain-language product content, not legal advice · Case studies are fictional · Fine amounts as stated in the legal act (“up to”)