---
id: CP-368
slug: eu-ai-act-risk-pyramid
lang: en
title: The EU AI Act
description: The EU AI Act sorts uses of AI into four risk levels and requires employers to build their staff's AI literacy.
canonical_url: https://startbrain.io/cyberpedia/en/articles/eu-ai-act-risk-pyramid/
markdown_url: https://startbrain.io/cyberpedia/en/articles/eu-ai-act-risk-pyramid.md
publisher: Brain (https://startbrain.io)
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
cite_as: Brain, "The EU AI Act", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/eu-ai-act-risk-pyramid/ (CC BY 4.0)
wing: 6
theme: use_responsibly
reflex: air-051
schema: G3
updated: "2026-11-03"
translations:
  en: https://startbrain.io/cyberpedia/en/articles/eu-ai-act-risk-pyramid/
  fr: https://startbrain.io/cyberpedia/fr/articles/reglement-europeen-ia-ai-act/
  de: https://startbrain.io/cyberpedia/de/articles/eu-ki-verordnung-ai-act/
  es: https://startbrain.io/cyberpedia/es/articles/reglamento-europeo-ia-ai-act/
sources:
  - "n": 1
    title: AI Act enters into force
    publisher: European Commission
    url: https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en
    published: "2024-08-01"
    accessed: "2026-11-03"
  - "n": 2
    title: Législation sur l’IA
    publisher: European Commission
    url: https://digital-strategy.ec.europa.eu/fr/policies/regulatory-framework-ai
    accessed: "2026-11-03"
  - "n": 3
    title: "Entrée en vigueur du règlement européen sur l’IA : les premières questions-réponses de la CNIL"
    publisher: CNIL
    url: https://www.cnil.fr/fr/entree-en-vigueur-du-reglement-europeen-sur-lia-les-premieres-questions-reponses-de-la-cnil
    published: "2024-07-12"
    accessed: "2026-11-03"
  - "n": 4
    title: AI Literacy - Questions & Answers
    publisher: European Commission
    url: https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
    accessed: "2026-11-03"
  - "n": 5
    title: Bureau européen de l’IA
    publisher: European Commission
    url: https://digital-strategy.ec.europa.eu/fr/policies/ai-office
    accessed: "2026-11-03"
---

# The EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework on AI, according to the European Commission [2]. It sets different rules according to the risks of specific uses of AI [2].

For an employee, the most direct consequence is Article 4: companies that provide or use AI systems must take measures to build the AI literacy of their staff [4].

## In 30 seconds

- Where it happens: in any organisation that provides or uses an AI system, including a simple writing or translation assistant [4].
- What the text provides: four risk levels, from prohibited practices down to minimal risk, with no rules for the latter [1].
- The reflex: be informed of the risks specific to the tool in use, such as invented answers [4], and ask your employer what AI training is planned.
- If it is not done: the Article 4 obligation has applied since 2 February 2025 and enforcement since 2 August 2026 [4].

## Straight answers

### What are the four risk levels?

The Act distinguishes unacceptable risk, high risk, transparency risk and minimal risk [2].

At the top, prohibited practices. The Commission counts nine, including social scoring, emotion recognition in workplaces and educational institutions, and harmful AI-based manipulation and deception [2].

At the second level, high risk: use cases that can pose serious risks to health, safety or fundamental rights. The Commission cites in particular AI tools for employment and worker management, such as CV-sorting software for recruitment [2].

At the third, transparency. A chatbot must say that you are talking to a machine, and some AI-generated content, such as deepfakes, must be labelled clearly and visibly [2].

At the base, minimal risk: the Commission cites spam filters and AI-enabled video games, which carry no obligations [1][2].

### What does Article 4 say?

Article 4(1) requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and of other people who use these systems on their behalf. These measures take into account each person's technical knowledge, experience, education and training, as well as the context of use [4].

### Is training mandatory, with a certificate?

The Commission answers that no strict mandatory training is imposed and that there is no single format [4]. A certificate is not necessary: the organisation can keep an internal record of training or other actions [4]. No particular governance structure is required either [4].

### Must the employer measure employees' skill level?

No. Article 4 does not require measuring employees' knowledge of AI, and it does not require guaranteeing a precise level for each person [4].

## What it changes for employees

According to the Commission, an employee who uses ChatGPT to write advertising copy or translate must be informed of the risks specific to the tool, for example hallucination [4]. Reading a system's instructions may not be enough: in many cases, asking staff to read them could be ineffective [4].

The obligation also covers people who work for the organisation without being employees, for example a contractor [4]. In case of damage, the provider of an AI system can be sued under national law, and the Commission states that the Act creates neither a criminal offence nor a right to compensation [4].

For high-risk systems, a separate point applies: deployers must ensure that the staff who use them are trained to carry out human oversight [4]. For such a system, additional measures may be relevant so that employees know how to handle it [4]. The rules for high risk under Annex III apply only from 2 December 2027 [2].

## What it changes for management

An organisation that uses AI systems should examine its role (provider or deployer) and the risk of the systems concerned. The Commission suggests at least the following steps and questions, four here: what AI is and which AI the organisation uses, its role, the risk of the systems, then the gaps in staff knowledge and the context of use [4].

A person with a degree in AI development is normally considered trained, but the organisation must check that they know the company's systems and their risks [4]. Several levels of training can coexist [4].

The obligations of Article 4 were amended by the digital omnibus on AI: AI literacy remains an obligation, with no specific level imposed, and the Commission and the Member States must continue to support organisations, notably through compliance examples published on the single information platform [4]. Copying the practices in the Commission's repository does not automatically grant a presumption of compliance with Article 4 [4].

## What the text says

The Act was proposed by the Commission in April 2021, then agreed between the European Parliament and the Council in December 2023 [1]. It entered into force on 1 August 2024 [1].

For high risk, strict obligations will apply before placing on the market from 2 December 2027 (Annex III): risk assessment and mitigation, high-quality data, logging, documentation, information to the deployer, human oversight, robustness, cybersecurity and accuracy [2].

General-purpose AI models, such as large language models, fall into a separate category, with obligations ranging from minimal transparency to the assessment of systemic risks [3]. The Act does not replace the GDPR: it complements it [3].

## Where implementation stands

According to the Commission, the Act became applicable on 2 August 2026, with exceptions [2]. The CNIL details the stages of the revised timetable [3]:

- 2 February 2025: prohibitions, except the one on child sexual abuse content and sexual deepfakes (for the Commission, prohibitions 1 to 8 and the AI literacy obligations) [2][3].
- 2 August 2025: rules for general-purpose AI models and appointment of competent authorities [3].
- 2 August 2026: transparency obligations for certain systems [3].
- 2 December 2026: prohibition of systems generating child sexual abuse content and sexual deepfakes [3].
- 2 December 2027: rules for high-risk systems under Annex III, including employment [2][3].
- 2 August 2028: rules for high-risk systems under Annex I (toys, medical devices, etc.) [2][3].

These postponements result from the AI omnibus. The Commission writes that a political agreement was reached on 7 May 2026 and that the text entered into force on 27 July 2026 [2]. The CNIL states that the amended version was adopted on 24 July 2026 [3].

On enforcement, Article 4 is not supervised by the AI Office but by the national market surveillance authorities, which have been enforcing it since 2 August 2026 [4]. These authorities could impose penalties based on national law, proportionate to the nature and gravity of the infringement; this would be more likely in the event of an incident caused by a lack of training [4]. Each Member State chooses the structure of these authorities, and one of them serves as the national point of contact if several are designated [3].

The AI Office, created within the Commission, supervises general-purpose AI models. It can investigate, request corrective measures and impose fines [5]. It supports the European Artificial Intelligence Board, which brings together representatives of each Member State [3][5].

## Sources

1. European Commission, "AI Act enters into force", 1 August 2024. https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en (accessed 3 November 2026)
2. European Commission, "Législation sur l’IA". https://digital-strategy.ec.europa.eu/fr/policies/regulatory-framework-ai (accessed 3 November 2026)
3. CNIL, "Entrée en vigueur du règlement européen sur l’IA : les premières questions-réponses de la CNIL", 12 July 2024. https://www.cnil.fr/fr/entree-en-vigueur-du-reglement-europeen-sur-lia-les-premieres-questions-reponses-de-la-cnil (accessed 3 November 2026)
4. European Commission, "AI Literacy - Questions & Answers". https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers (accessed 3 November 2026)
5. European Commission, "Bureau européen de l’IA". https://digital-strategy.ec.europa.eu/fr/policies/ai-office (accessed 3 November 2026)

---

Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/eu-ai-act-risk-pyramid/
You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.