The EU AI Act

According to the Commission, an employee who uses ChatGPT to write advertising copy or translate must be informed of the risks specific to the tool, for example hallucination⁴. Reading a system's instructions may not be enough: in many cases, asking staff to read them could be ineffective⁴.

The obligation also covers people who work for the organisation without being employees, for example a contractor⁴. In case of damage, the provider of an AI system can be sued under national law, and the Commission states that the Act creates neither a criminal offence nor a right to compensation⁴.

For high-risk systems, a separate point applies: deployers must ensure that the staff who use them are trained to carry out human oversight⁴. For such a system, additional measures may be relevant so that employees know how to handle it⁴. The rules for high risk under Annex III apply only from 2 December 2027².

An organisation that uses AI systems should examine its role (provider or deployer) and the risk of the systems concerned. The Commission suggests at least the following steps and questions, four here: what AI is and which AI the organisation uses, its role, the risk of the systems, then the gaps in staff knowledge and the context of use⁴.

A person with a degree in AI development is normally considered trained, but the organisation must check that they know the company's systems and their risks⁴. Several levels of training can coexist⁴.

The obligations of Article 4 were amended by the digital omnibus on AI: AI literacy remains an obligation, with no specific level imposed, and the Commission and the Member States must continue to support organisations, notably through compliance examples published on the single information platform⁴. Copying the practices in the Commission's repository does not automatically grant a presumption of compliance with Article 4⁴.

The Act was proposed by the Commission in April 2021, then agreed between the European Parliament and the Council in December 2023¹. It entered into force on 1 August 2024¹.

For high risk, strict obligations will apply before placing on the market from 2 December 2027 (Annex III): risk assessment and mitigation, high-quality data, logging, documentation, information to the deployer, human oversight, robustness, cybersecurity and accuracy².

General-purpose AI models, such as large language models, fall into a separate category, with obligations ranging from minimal transparency to the assessment of systemic risks³. The Act does not replace the GDPR: it complements it³.

According to the Commission, the Act became applicable on 2 August 2026, with exceptions². The CNIL details the stages of the revised timetable³:

• 2 February 2025: prohibitions, except the one on child sexual abuse content and sexual deepfakes (for the Commission, prohibitions 1 to 8 and the AI literacy obligations)²³.
• 2 August 2025: rules for general-purpose AI models and appointment of competent authorities³.
• 2 August 2026: transparency obligations for certain systems³.
• 2 December 2026: prohibition of systems generating child sexual abuse content and sexual deepfakes³.
• 2 December 2027: rules for high-risk systems under Annex III, including employment²³.
• 2 August 2028: rules for high-risk systems under Annex I (toys, medical devices, etc.)²³.

These postponements result from the AI omnibus. The Commission writes that a political agreement was reached on 7 May 2026 and that the text entered into force on 27 July 2026². The CNIL states that the amended version was adopted on 24 July 2026³.

On enforcement, Article 4 is not supervised by the AI Office but by the national market surveillance authorities, which have been enforcing it since 2 August 2026⁴. These authorities could impose penalties based on national law, proportionate to the nature and gravity of the infringement; this would be more likely in the event of an incident caused by a lack of training⁴. Each Member State chooses the structure of these authorities, and one of them serves as the national point of contact if several are designated³.

The AI Office, created within the Commission, supervises general-purpose AI models. It can investigate, request corrective measures and impose fines⁵. It supports the European Artificial Intelligence Board, which brings together representatives of each Member State³⁵.