For most professional services firms, EU AI Act compliance comes down to three things: AI literacy among your staff, transparency about how you use AI, and the GDPR, which still applies in full. You are not building a high-risk system yourself, so the heaviest requirements in the law probably do not affect you.
The official name is Regulation (EU) 2024/1689, usually called the AI Act or the EU AI Act. Both names refer to the same law. Since July 2026 the text has been amended on several points, so some of what you read about it elsewhere is no longer accurate.
Which AI Act obligations apply to your business?
Which AI Act obligations apply to your business depends on what you do with AI. If you use ChatGPT, Claude or Microsoft Copilot in your services, you almost always fall into the lightest risk category.
The law classifies AI systems by risk. Some uses are prohibited, such as social scoring or manipulative techniques. From 2 December 2026 the Digital Omnibus adds two more prohibited practices: AI systems that create or alter realistic intimate images of identifiable people without consent (so-called nudify apps), and AI systems that generate child sexual abuse material. For an office that uses ChatGPT or Claude, this does not change its own obligations. High-risk systems face strict requirements, with AI for recruitment, credit scoring and medical applications as the best-known examples.
Below that is the category with light transparency obligations, and below that the uses with minimal risk. An accounting firm that uses AI to draft documents or summarise data sits in those bottom layers in practice. If you do deploy a high-risk application, you only face a FRIA as a public body or as an organisation providing public services, and otherwise only for systems that assess creditworthiness or set risk and pricing for life and health insurance. The FRIA is the fundamental rights impact assessment under Article 27, mandatory from 2 December 2027.
Most offices that use ChatGPT or Claude sit in the bottom two layers.
AI literacy after the Digital Omnibus
AI literacy has been an obligation under Article 4 of the AI Act since 2 February 2025. The original text required measures to ensure a sufficient level of AI literacy among your staff.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced that wording with effect from 27 July 2026. Article 4 now requires measures that support the development of AI literacy, and adds explicitly that you do not have to guarantee a particular level for each individual employee. The obligation has been changed, not abolished.
How you meet it differs from one organisation to another, because AI literacy at a notary’s office covers different topics from those at a marketing agency. Healthcare has its own rules as well, and there is a separate AI in healthcare course for that sector. A dated overview of what you have organised, with a piece of evidence for each employee, shows which measures you have taken. A certificate is one piece of evidence, not a certification and not proof of compliance.
The law does not require a certificate or a set number of hours. Targeted AI training for businesses helps build that record if the content matches the tools and processes your team actually uses. To give each employee the basics, there is the AI Literacy Course, which ends with a certificate of completion. If you first want to give every employee the same foundation quickly, the AI Literacy Essentials course takes about two hours.
Transparency about your AI use since August 2026
Transparency about your AI use is the second obligation under the AI Act, but most of it lies with the provider of the tool. Telling people that a chatbot is an AI assistant and marking synthetic content in a machine-readable way are provider obligations (Article 50(1) and (2)). As a deployer, you have your own obligations for emotion recognition and deepfakes, and for AI-generated text you publish to inform the public on matters of public interest, unless that text has been through human editorial review and someone holds editorial responsibility for it.
The transparency obligations in Article 50 took effect on 2 August 2026 and, unlike the high-risk rules, have not been postponed. For systems already on the market before that date, a four-month transition period applies to the marking obligations, until 2 December 2026.
You do not need separate compliance software for this. Most offices handle the transparency obligation with a standard clause in their terms and conditions, a notice next to the chat function on their website, and an internal agreement on when you tell a client that a draft was prepared with AI.
What your role is under the AI Act
Your role under the AI Act determines which obligations apply to you. A provider develops an AI system or places it on the market under its own name. A deployer uses an existing system within its own organisation.
Most knowledge-intensive service providers are deployers: you use ChatGPT or Claude, but you did not build them. The line is crossed when you build AI into something under your own name.
If you build a general-purpose AI model, such as the model behind ChatGPT or Claude, into your own service and offer it under your own brand, you move towards the provider role. A client portal with a built-in AI assistant is the best-known example, and that role brings heavier obligations. For an office that uses AI purely internally to work faster, this does not come into play. If you are unsure where the line lies, assess it for each application rather than for the whole organisation at once.
What the Digital Omnibus changed in the AI Act
The Digital Omnibus changed the AI Act on two points that matter for ordinary businesses: the wording of the AI literacy obligation, and the application dates of the high-risk rules. Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July and has been in force since 27 July 2026.
That differs from what many web pages still say. Until the end of July 2026, the Omnibus was an agreement on which the European Parliament had voted on 16 June, and the original dates still applied legally. That phase is over: the amended text applies.
| Part of the AI Act | Applies since or from |
|---|---|
| Prohibited AI practices, Article 5 | 2 February 2025 |
| AI literacy, Article 4 | 2 February 2025, wording amended from 27 July 2026 |
| Rules for general-purpose AI models | 2 August 2025 |
| Transparency obligations, Article 50 | 2 August 2026 |
| New prohibited practices (nudify apps and abuse material), Article 5 | 2 December 2026 |
| High risk under Annex III | 2 December 2027, was 2 August 2026 |
| High risk under Annex I | 2 August 2028, was 2 August 2027 |
Annex III covers AI in recruitment and selection, credit scoring, education and a number of other areas. Annex I covers high-risk AI built into regulated products, such as lifts and toys. Both are fixed calendar dates in the regulation and do not move automatically if the related standards are ready later.
The extra time is meant for better preparation, not for waiting.
Which AI Act infringements carry a fine
Article 99 sets out which AI Act infringements carry a fine, and it names specific provisions rather than the regulation as a whole. That distinction determines the risk you actually run.
Paragraph 3 covers only Article 5, the prohibited AI practices, with a ceiling of up to €35 million or 7 per cent of worldwide annual turnover. Paragraph 4 contains an exhaustive list, including the obligations of providers, importers, distributors and deployers and the transparency obligations in Article 50, with a ceiling of up to €15 million or 3 per cent. Supplying incorrect or misleading information to authorities can cost up to €7.5 million or 1 per cent.
Article 4 appears in none of those lists. So none of these fines applies to inadequate AI literacy, even though many articles suggest otherwise. What does apply is that Article 99(1) requires member states to lay down penalties for infringements of the regulation, so national enforcement is not legally ruled out.
Lower, proportionate ceilings apply to SMEs and start-ups. For a typical service provider, the more direct risk is not the AI Act fine itself but a data breach through an AI tool an employee used without any agreements in place, with a notification obligation to the data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens) and the reputational damage that comes with it. That is why the GDPR and responsible AI use remain just as important as the AI Act itself.
Who enforces the AI Act? The example of the Netherlands
Supervision of the AI Act in the Netherlands is still taking shape. The Dutch AI Act Implementation Act (Uitvoeringswet AI-verordening), which is to set up supervision and enforcement in the Netherlands, has not yet become law. The public consultation on the draft bill ran from 20 April to 1 June 2026.
Under the proposal, the coordinating role lies jointly with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI). For high-risk AI without its own sector supervisor, the AP is intended as the fallback supervisor. Sector supervisors also stay involved: the AFM and DNB for financial services, the IGJ (Health and Youth Care Inspectorate) for AI in healthcare and the Netherlands Labour Authority for AI in the workplace.
That does not mean you can set the regulation aside. An EU regulation applies directly, so the obligations apply even without a national implementation act. What is still missing in the Netherlands is the national toolkit for fines and enforcement, because the market surveillance authorities only receive their formal tasks and powers once that act takes effect.
In practice the balance is lopsided. The chance of a Dutch fine is small for now. The chance that a client, a professional body or your liability insurer asks how you have organised your AI use is not.
What an AI policy for businesses should contain
An AI policy for businesses sets out what is and is not allowed with AI in your organisation, and in practice it covers most obligations in a single document. An AI policy matters because otherwise employees choose their own AI tools and enter client data into accounts not covered by any agreement with the business, while the business remains responsible for that data under the GDPR. Such a policy does not have to be a thirty-page legal document. A workable AI policy fits on a few pages and mainly answers the question of what an employee may and may not do tomorrow.
What an AI policy should include at minimum
An AI policy contains at least six elements. The order matters less than completeness.
- An AI register of which AI tools are used, by whom and for what, including the AI built into software you already have, such as Copilot in Microsoft 365 or AI features in your CRM.
- A data boundary that sets out which data never goes into an AI tool, with the account type and data processing agreements for each approved tool.
- Responsibility for the output: who signs off on what leaves the office under its name.
- The transparency notices: where and how you tell clients that AI is involved.
- Review points per task type: which check follows which kind of AI output.
- A record of AI literacy, with a dated overview per employee of what has been done to build knowledge.
In practice, the AI register is the element most often missing. Tools that nobody approved but that are in use anyway, also known as shadow AI, fall outside any policy you put in place.
An example of a rule from an AI policy for employees: client names, national identification numbers (such as the Dutch BSN) and financial data never go into an AI tool, and for all other text you use only the business account the company has approved. A rule like that is concrete enough to act on, which a general intention such as “we handle AI with care” is not.
Which checks to set out in your AI policy
The checks in your AI policy decide whether the document is worth anything, because a guideline without a review point is a statement of intent. You do not need compliance software for this, and outside the high-risk category the Netherlands has no recognised quality mark or mandatory audit for AI systems.
From my years at Rabobank, ABN Amro and Van Lanschot, I bring the four-eyes principle into my AI work. In every implementation I translate that into review points on an SME scale: not a full compliance department, but a second pair of eyes on work that leaves the office under your own name. Compliance thinking from banking comes down to three questions here: which data may go in, which claims can you justify, and who is liable for the result.
Not every task has the same risk profile, and the intensity of review should vary accordingly. An internal summary needs less than advice that goes to a client. In regulated sectors this matters even more, because the output falls under professional responsibility, and AI use by lawyers can therefore also have disciplinary consequences.
How to make sure the AI policy is followed
You make sure the AI policy is followed by keeping it short, linking it to the tools people already use and reviewing it periodically. A policy that only lives in a folder on the server loses out to a free account that is one click away. So appoint an internal owner who keeps the AI register up to date, have new employees read the policy when they start, and discuss each quarter which new AI features have appeared in existing software. Once the approved tool is easier to use than the alternative, compliance largely follows by itself.
What EU AI Act compliance costs your organisation
For most service providers, the cost of EU AI Act compliance is modest, because you need no conformity software or certification. The costs are mainly time: drawing up the AI register, writing the policy, setting up transparency notices and training your staff.
The largest cost is mapping all the AI your organisation uses, including the features that sit unnoticed in existing software packages. That work takes real effort once; after that, it is a matter of keeping it up to date.
Starting with one or two processes works better than an organisation-wide project, because a phased AI implementation for SMEs keeps the first step small enough to finish.
The first steps towards EU AI Act compliance
The first steps towards complying with the AI Act do not take an army of lawyers, but they do take discipline. Start with the AI register, because without an overview of what is in use, you are writing a policy for a situation you do not know.
Next, draw up the AI policy by setting out the data boundary and responsibility for output in a short guideline, set up the transparency notices where you use AI externally, and put a fixed review point on AI output before it goes to a client. Finish by recording what you have done on AI literacy, in a dated overview per employee that ties in with Article 4.
Civil-law notaries in the Netherlands, with their own gatekeeper role, need a sector-specific approach: a programme for AI compliance in notarial practice sets fixed review steps for each type of deed and ties in with the AI-weegschaal of the Royal Dutch Association of Civil-law Notaries (KNB).
Only when the whole team works the same way does the AI Act become part of how you work rather than a separate compliance exercise. If you want to build that way of working with your whole team, AI Literacy for Teams gives everyone their own account and a certificate in their own name.
Frequently asked questions about EU AI Act compliance
If you are checking the AI Act for your own business, you will often wonder exactly who the law applies to and since when.
Does the AI Act also apply to freelancers and small businesses?
Yes, the AI Act also applies to freelancers and small businesses, because Article 2 makes no exception based on the size of an organisation. Every deployer established in the EU falls under the regulation. Only a natural person who uses AI purely for personal, non-professional purposes falls outside the obligations under Article 2(10). A freelancer who uses ChatGPT for client work is doing so professionally.
Does the AI Act apply if employees use a personal account for work?
Yes, the AI Act also applies if employees use a personal account for their work, because the exception in Article 2(10) only covers purely personal, non-professional use. So it is the purpose of the use, not the type of account, that determines whether the regulation applies. Such use therefore falls under your organisation’s obligations, such as the AI literacy measures under Article 4.
Does the AI Act also apply to AI providers outside Europe?
Yes, the AI Act also applies to AI providers outside Europe as soon as they place AI systems or general-purpose AI models on the EU market, regardless of where they are established. Under Article 2, providers and deployers from third countries are also covered when the output of their AI system is used in the EU. US providers of tools such as ChatGPT and Claude therefore have their own obligations under the regulation.
When did the AI Act enter into force?
The AI Act entered into force on 1 August 2024, on the twentieth day after its publication in the Official Journal of the European Union. Entering into force does not mean all rules apply straight away: under Article 113, the regulation generally applies from 2 August 2026, with earlier and later dates for parts such as the prohibited practices and the high-risk rules.
