Part 2: What Already Applies at Work

AI literacy, the practices banned outright, the transparency duties of Article 50 and the rules for general-purpose AI models, then the fines and who enforces them. This is what the AI Act asks of a workplace today, explained and not advised.

Tue, 03 Nov 2026 · 14 min

Made for you, by AI, from the sources below.

Listen to it in The AI Act, Explained for Your Workplace

Transcript

The script the two voices were given, with the sound cues taken out. A voice may say a word a little differently, so the audio is the episode.

Mia: Welcome to Walking Points. Picture a mid-sized company that rolls out a chatbot assistant to all its staff. Some people draft emails with it, some paste in customer data, and one person has it summarise contracts. Nobody has told any of them what it gets wrong.

Adam: That sounds like a lot of workplaces. Is that a legal problem, or just a bad habit?

Mia: Since 2 February 2025, it's a legal problem too. And that's what this episode is about: What already applies at work under the EU's AI Act. This part was made in October 2026.

Mia: The AI Act is Regulation (EU) 2024/1689, a law of the European Union. It switched on in stages, so people assume everything starts in 2027. It earns a whole episode because four pieces are already live, and we'll take them in order. First AI literacy, then the practices the Act bans outright, then the transparency duties together with the rules for the engines under chatbots, and last, fines and who enforces.

Adam: And where did we leave things?

Mia: Last Tuesday we covered what the Act is: the risk tiers, the difference between providers and deployers, and the Digital Omnibus dates that moved the high-risk obligations.

Adam: Right, so the Omnibus is the amending law. When did it actually land?

Mia: It was published in the Official Journal on 24 July and entered into force on 27 July, according to summaries from the law firms Lewis Silkin and Hunton. A quick note while we're on the law: this is a briefing, and it isn't legal advice. The headline change is that the heavy obligations for high-risk systems, like hiring tools, moved from 2 August to 2 December 2027.

Adam: So that part is a building site that isn't finished.

Mia: Yes, and the four pieces we're covering are the parts of the building people already walk through every day. Start with AI literacy. Article 3 defines it as the skills, knowledge and understanding that let people make informed use of AI and be aware of the opportunities, risks and possible harm. Article 4 then says that providers and deployers of AI systems must take measures on it for their staff, and for others who operate AI on their behalf.

Adam: Remind me, who counts as a deployer?

Mia: A deployer is an organisation using an AI system under its own authority. So if you use a chatbot at work, your organisation is a deployer. And what makes Article 4 unusual is that it doesn't depend on risk level. A company using a low-risk drafting assistant is covered the same way as one using a hiring tool.

Adam: Does that mean every employee has to be certified?

Mia: No. There's no mandatory certificate, no minimum number of training hours and no uniform test, as Praxikon, a legal monitor, summarises the Commission's guidance. What the measures look like depends on people's technical knowledge, their training and the context. Someone brainstorming needs different preparation than someone using AI to screen job applicants.

Adam: But I thought the duty got weaker this summer.

Mia: It did change, and the details matter. The Commission originally proposed softening it. Lewis Silkin and Praxikon both describe the final regulation as dropping the idea that an organisation must ensure a sufficient level of literacy in each individual. What stays is the organisation's duty to take measures that support AI literacy. Praxikon puts it as: the individual outcome expectation is removed, but the duty to take appropriate measures remains.

Adam: That sounds clear enough.

Mia: Mostly, but one caution. The wording on artificialintelligenceact.eu shows the old and new versions side by side, and sources describing the final law summarise it differently. So the safest plain statement is that the final duty is about taking measures, not guaranteeing results.

Adam: So what would an employer actually be expected to show?

Mia: Practitioners suggest an employer should be able to say which AI is used in which role, what risks come with it, and what was done about it. That's the commentary's suggestion, not something the Act spells out. The Commission also updated its AI literacy Q&A on 27 July, after the Omnibus came into force, and Praxikon's summary says Article 4 has not expired.

Adam: Then what happens if a company simply ignores it?

Mia: That's the honest weak spot. Article 4 contains no fine of its own. National authorities supervise the Act and member states set the penalty rules, so how hard it bites differs by country.

Adam: Mia, a duty with no fine of its own sounds toothless to me. Is that a fair reading?

Mia: Partly fair, and I'll concede that much. The law as written names no penalty, so take that as the state of things today, not a prediction. But it's still a duty, and the supervisors exist.

Adam: Okay. So for anyone using AI at work, the sentence reaches almost everyone, but it asks for effort, not a result.

Mia: Exactly. Now the bans. Article 5 lists practices the Act treats as unacceptable, prohibited since the same February day. This is the top of the risk pyramid from last Tuesday. These aren't high-risk with conditions. They're banned.

Adam: What's on the list?

Mia: Eight groups, and here are seven of them. Manipulative techniques that distort behaviour and cause significant harm. Exploiting vulnerabilities like age or disability. Social scoring. Predicting crime solely from profiling. Scraping faces from the internet or CCTV to build recognition databases. Biometric categorisation that infers things like religion, political opinions or sexual orientation. And real-time remote biometric identification in public spaces for law enforcement, with three narrow exceptions. Adam, which of those do you think touches an ordinary office?

Adam: Probably the one that's missing from your list so far, which I'd guess is about reading emotions.

Mia: That's the eighth. Article 5(1)(f) bans AI systems that infer the emotions of people in the workplace or in education, and in plain words that means software guessing how you feel at work. The exception is where the system is intended for medical or safety reasons.

Adam: Can you make that concrete?

Mia: A call-centre tool that scores agents' voices for frustration or enthusiasm is the kind of thing the ban is aimed at. So is a webcam product that rates how engaged people look in a meeting. A system that detects a driver falling asleep is different, because of the safety exception. The Commission has published guidelines on prohibited practices with examples, and anyone assessing a specific product should read them rather than rely on this summary.

Adam: So what does that mean for an employer?

Mia: For a typical employer, this list is mostly a do-not-buy list. If a vendor ever pitches you a product that reads employees' feelings from their faces or voices, its workplace use is prohibited. It isn't one that needs a risk assessment.

Adam: And there's something new on the list?

Mia: One new entry from the Omnibus: a ban on AI systems that generate non-consensual intimate imagery, the so-called nudifier tools, and child sexual abuse material. Gibson Dunn's summary and the Article 5 text say a transitional period runs until 2 December. Parliament added it during negotiations, as Lewis Silkin reports.

Adam: Okay, and the rule about being told you're talking to a machine?

Mia: That's the transparency article, Article 50, the part people meet most often as a user. It's about being told when you're dealing with a machine, or looking at something a machine made. It applies from 2 August 2026, whatever the risk level.

Adam: Who has to do the telling?

Mia: It splits between the two roles. Providers must design systems that talk directly to people so those people are told it's an AI, unless that's obvious to a reasonably well-informed, observant person. Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable way, as far as technically feasible. There's a grace period: systems already on the market before that August date have until the following December for the marking.

Adam: And the employers using the tools?

Mia: Deployers have three duties. If they use an emotion recognition or biometric categorisation system where it's allowed at all, they must tell the people exposed to it how it works. If they publish a deepfake, meaning AI-generated or manipulated media that resembles real people, places or events, they must disclose it, with a lighter form for evidently artistic or satirical work. And if they publish AI-generated text to inform the public on matters of public interest, they must say so.

Adam: Even if a person checked it?

Mia: There's an exception there. If a human reviewed it or exercised editorial control, and someone holds editorial responsibility, the labelling duty for text doesn't apply. So a press office where an AI drafts a public-interest article and a person edits it and takes responsibility is outside that duty. But a communications team making a realistic video of an executive saying something they never said, even for an internal campaign, is making a deepfake and needs to label it.

Adam: That second example is the one that could happen by accident.

Mia: Yes. And if you work anywhere near communications or marketing, that's the one to watch. Now the engines under the chatbots. A general-purpose AI model is one trained on large amounts of data that can perform a wide range of tasks and be built into many downstream systems. The large language models behind chatbots are the standard example. Those rules have applied since 2 August 2025, and the Omnibus left them unchanged, per Gibson Dunn.

Adam: Does that land on the company using the chatbot?

Mia: No, and that's the distinction to hold on to. These obligations sit with the model's provider, the company that trains and releases it. Under Article 53, the provider must keep technical documentation and give it to authorities on request, give downstream builders the information they need to understand the model's limits, have a copyright policy that respects rights holders' opt-outs, and publish a detailed summary of the training content.

Adam: What about the really big models?

Mia: Article 51 sets a second tier for systemic risk, which means models with high-impact capabilities. One presumption is training compute above ten to the power of twenty-five floating-point operations, which the Commission can change. Those models carry extra duties, including evaluations and incident reporting. And enforcement here is centralised in the Commission through the AI Office, rather than in national authorities.

Adam: So what does an employer do with that?

Mia: Mostly nothing directly. The employer is a customer, and the provider's documentation is what lets you learn what the tool can and can't do. That's why vendor questions matter, which is part three.

Adam: Now the question people ask first: how big are the fines?

Mia: Article 99 sets ceilings, and member states set the actual rules. Three tiers. Up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, for breaches of the Article 5 bans. Up to 15 million euros or 3 percent for most other obligations, which includes the transparency duties. And a lower tier for giving authorities misleading information.

Adam: Is that the same for a small company?

Mia: No. For small and medium-sized enterprises and start-ups, the cap is the lower of the two figures, not the higher. The Omnibus extends that lower-of rule to small mid-cap companies for the middle and lowest tiers. And these are ceilings, not prices. Member states can use warnings and non-monetary measures, and the rules must be effective, proportionate and dissuasive.

Adam: Who actually knocks on the door?

Mia: Three layers. National market surveillance authorities supervise most of the Act, including the bans and the transparency duties. The AI Office handles general-purpose models. And data protection authorities already police the personal-data side of emotion recognition and biometrics under GDPR.

Adam: And has anyone been fined yet?

Mia: This research found no reported fine under the AI Act so far. I couldn't verify that against an official register, so read it as none found, not none exist. The rules are in force, but the authorities and penalty rules are still maturing.

Adam: So what could a listener try this week?

Mia: One small step, tied to that chatbot at the start. Pick one AI tool you use at work, and write down one mistake it makes. Writing that down is the start of being able to say which AI you use, what its risks are and what you did about them. That is exactly what the literacy duty asks for.

Adam: AI literacy asks for real effort from anyone using AI, the bans say which products to refuse, the transparency duties say what must be disclosed, and the fines are ceilings spread across several enforcers.

Mia: That was part two of three. Part three is called The systems that decide about people, and it is about what an organisation that uses a high-risk system has to do.

Heard something wrong? Tell us