What the AI Actasks of you

The core: rules by risk

The AI Act sorts AI applications by risk. A handful of uses are banned outright (social scoring, for instance). High-risk systems, such as AI that assesses job applicants or estimates creditworthiness, face strict requirements. But the great majority of what you use as a business owner, such as writing assistants, chatbots and transcription tools, falls into the low-risk category, where it’s mainly the transparency rules that apply.

What you do have to arrange

First, AI literacy, the duty from article 4. Since 2 February 2025, every organisation using AI has had to make sure its people understand enough about it to work with it responsibly. That holds even if you employ only two people. A focused training or workshop is often enough; what counts is demonstrable, appropriate knowledge.

Then transparency. If a client is talking to your chatbot, it has to be clear they’re talking to AI. If you publish AI-generated images or audio that look real, you have to say so.

And finally: knowing what you use. You don’t have to keep a register the way a government body does, but you should be able to say which AI tools are running in your business and what they do. A simple list is a perfectly good start.

What you don’t have to do

No expensive certification or audit for ordinary office applications, and no lawyer on call: the obligations for low-risk applications can be met with common sense. And no need to panic about every new tool. The question is always the same: what does it do, with which data, and who could be affected by it?

Start here

Three steps you can take this month: make a list of every AI tool you and your team use, check for each one whether client or personal data ends up inside it, and set aside time to make your team AI-literate.

You don’t have to work that last one out alone: I run an AI literacy workshop that covers exactly this, practical and tailored to your organisation. Questions about your own situation? Email info@kimberleyvanruiven.nl.