AI literacy is now law: what does the AI Act mean for your business?

What once seemed like future music has now become reality: since February 2025, the European AI Regulation (AI Act) has officially come into force. In doing so, the European Union is making history as the first legal order to comprehensively regulate artificial intelligence by law. The ambition is twofold: to stimulate innovation and to protect fundamental rights. But what does this mean concretely for you as an entrepreneur? And why not wait until tomorrow to take action? Lauren D'hooghe, attorney at NOMA, guides you through the core obligations and the implications for your business.

Four risk categories: which AI systems fall under supervision?

The AI Act employs a tiered, risk-based approach. Each AI system is placed in one of four risk categories, each with its own legal obligations:

• Prohibited AI systems, such as social scoring or emotion recognition in the workplace
• High-risk AI, such as applications in hr, education or law enforcement
• Limited-risk AI, such as chatbots or AI-generated content, subject to transparency obligations
• Low- or negligible-risk AI, such as spam filters or AI in games, for which voluntary guidelines apply

Important: even those who do not develop artificial intelligence themselves, but only use it, do not escape regulation. Many companies, including SMEs, will be designated as user agents under the AI Act, with direct obligations of their own. Thus, a first essential exercise for any business is to map all AI systems being deployed.

A user agent is any natural or legal person - including governments, agencies or other public bodies - that deploys an AI system under its own responsibility. The exception is applications in a strictly personal, non-professional context.

As of February 2025, what is legally required of businesses?

Ban on AI systems with 'unacceptable risk'

The law provides an exhaustive list of AI systems banned within the EU. These include applications that assess individuals based on their behavior, ethnicity or socioeconomic profile. Emotion recognition systems in the workplace, in schools or in recruitment are also prohibited. Those who do deploy such applications expose themselves to severe penalties.

Promoting AI literacy within your company

AI literacy: skills, knowledge and understanding that enable providers, users and affected persons, taking into account their respective rights and obligations under this Regulation, to use AI systems in an informed manner and to become more aware of the opportunities and risks of AI and the potential harm it may cause.

A first in European law: companies are now legally obliged to promote AI literacy among their staff. This obligation applies to all AI systems, regardless of their risk profile.

In concrete terms, this means that employees must have sufficient understanding of the operation, risks and limitations of the AI tools they use. That knowledge transfer should preferably be done through training tailored to their job and type of use: after all, what a developer needs is fundamentally different from what an administrative assistant requires.

The AI Act forces companies to be intentional about artificial intelligence. From now on, AI literacy is no longer a nice-to-have, but a legal requirement.

Although an AI policy or code of conduct is not (yet) required by law, the European AI Office recommends that companies establish clear ground rules around the use of artificial intelligence. Such a document allows to organize AI use within the company in a structured and compliant way: who is allowed to use what, under what conditions, and how is it monitored?

NOMA as a legal sparring partner in AI transition

Do you want to know if your company is correctly positioned under the AI Act? Are you looking for a clear framework to structure AI use within your organization?

From risk assessment to drafting policies and training, NOMA's attorneys will guide you through the complex legal framework with tailored advice. Get in touch.

In our next blog, we explain the additional obligations that will apply as of Aug. 2, 2025, with a particular focus on commonly used AI tools such as chatbots and Copilot.