New EU AI Act obligations coming into force

The EU AI Act entered into force on 1st August 2024. It is the world's first comprehensive AI legislation and advances the development, adoption and distribution of safe, trustworthy and responsible AI systems. Even though many provisions will not be enforced for another year, it is not too early to start adopting responsible AI practices and getting your organisation ready for compliance. This article will focus on helping organisations with a foundational first step: building an inventory of AI systems.

Prohibited AI Practices  

From February 2025 onwards, AI systems that pose an unacceptable risk to fundamental rights and EU values, including safety, and democracy, will be prohibited under the EU AI Act (Art 5). An example of a forbidden AI system under the AI Act is using facial recognition technology for mass surveillance (Recital 43; Art 5). Other unlawful uses are using AI systems: to predict probability for a person to commit a crime; to detect emotions in workplaces and schools; to infer sensitive information, such as political beliefs, sexual orientation or race, based on biometric data; to provide a social score that could impact subjected people or groups negatively: to subliminally deceit or manipulate people to act against theirs or other’s best interests; or to exploit the vulnerabilities of a natural person or a specific group of persons in a way that may cause them or others harm. To clarify these prohibitions, the EU released additional guidance on the 4th of February 2025 explaining why these practices are deemed unacceptable (European Commission, 2025). The use of prohibited AI can lead to financial penalties more severe than those associated with GDPR breaches, with fines reaching up to €35 million or 7% of a company’s global annual turnover (although these penalty provisions will not apply until the 2nd of August 2026). 

AI Literacy 

Organisations must ensure adequate AI literacy within their workforce and among those interacting with or who are affected by AI systems. The EU AI Act defines AI literacy as the ability to make informed decisions regarding AI systems, enabling individuals to maximise benefits while protecting their own and others' fundamental rights and EU values. 

This obligation extends to various stakeholders across an AI system’s lifecycle. The Act states that AI providers and deployers, including their staff and third parties involved in AI use and operation, must be sufficiently AI-literate (Art. 4). Additionally, those affected by AI systems require an appropriate level of AI literacy. The AI literacy journey should therefore start with identifying who should be AI literate. 

The EU AI Act also outlines what AI literacy entails. Stakeholders must understand their rights and obligations under the Act, as well as the opportunities, risks, and potential harms of AI systems (Art 3(56)). As a result, the required knowledge varies depending on the context in which the system is used: stakeholder’s role, the application of the AI system, the (potential) effects of the system on them and others, and the rights and obligations of affected people. The second step is to identify what each stakeholder needs to understand to be considered AI literate.  

Providers and deployers of AI systems also need to account for (a lack of) pre-existing technical knowledge, experience, education and training (Art 4). As public awareness of AI benefits, risks, safeguards, and legal obligations grows, organisations may increasingly assume some prior knowledge. The actual work to ensure sufficient levels of AI literacy may change as a result. The third step is to identify how AI literate the stakeholders are. 

Organisations can take several practical steps to enhance AI literacy. They can offer or contract external training and education. Additionally, AI system design, for example, prioritising traceability, explainability, and clearly communicating their limitations, play a key role in supporting AI literacy. Furthermore, the EU AI Act encourages the Commission and member states to facilitate the development of voluntary codes of conduct to advance AI literacy AI (Recital 20). You can read more about these tools on our article describing why AI literacy is a prerequisite to achieve responsible AI (available here). A fourth step is to identify what practical tools are suitable for each stakeholder to improve AI literacy. 

Our AI Literacy & Training programmes 

Building AI literacy within procurement teams is a foundational step; one of our first reports, AI Governance: Building AI literacy and workforce readiness, addresses this in detail. Trilateral's Responsible AI Team works with organisations across all stages of that journey, from structured training programmes to transparency-by-design approaches for AI products.

To discuss your organisation's specific needs, contact us.