AI Act – Key points of attention in 2025 for your business

In this article, we explain the main obligations and what this concretely means for your business. For more general information about the AI Act and its deadlines/entry into force, you can read our previous article.

Ban on AI systems with unacceptable risk

As of February 2, 2025, it is prohibited to use AI applications that pose an “unacceptable risk” to EU citizens. These include, for example:

• AI systems for so-called “social scoring,” where individuals are assessed and given a score based on their behavior, socio-economic status, or personal characteristics;
• AI systems for emotion recognition in the workplace and education.

The likelihood of such systems being used in your business is probably small. However, an important consequence of this ban is that you now have the obligation to check which AI applications are used within your business and to see in which risk category of the AI Act these applications fall.

AI Literacy: A new responsibility for businesses

In addition, every business must ensure that its employees have a certain level of “AI literacy.” This means that every business that uses AI, either as a provider or as a user, must ensure that its employees have sufficient knowledge about AI to use this technology responsibly and, above all, to assess the risks.

The AI Act gives businesses some flexibility in defining the concept of “AI literacy.” For example, an employee in the IT department who helps develop applications must have a deeper knowledge of AI and the associated risks compared to someone who uses a generative AI application solely to rewrite texts.

What can (or must) you do concretely as a business?

To meet the requirement of “AI literacy,” it is strongly recommended to establish a clear “AI policy” with basic information about AI, tailored to your business and taking the context into account.

The AI policy should include, among other things, an overview of which AI applications are allowed (or not), who your employees should contact when they want to use new AI applications that are not yet on the list, what (business) information can, and especially cannot, be entered into AI applications, etc. It is important to communicate the AI policy to all employees and to indicate that they must also comply with these rules or face possible sanctions.

Finally, depending on the needs of the business and the functions of the employees, tailored “AI awareness training” can be rolled out.

Some important deadlines for the AI Act

The entry into force of the AI Act takes place in several phases. The next important date for businesses is August 2, 2025:

• The rules on the use of “General Purpose AI” systems (or generative AI, such as ChatGPT) will come into effect from that date. These generative AIs are subject to transparency obligations. This means, among other things, that AI applications must indicate that the content was generated by AI (such as images generated by AI or deepfakes).
• Member states must also designate their national supervisory authority by August 2, 2025, at the latest, which will oversee compliance with the AI Act rules. In other words, this means that from that date, authorities can conduct inspections and impose fines.
• Keep in mind that once this supervisory authority is designated, as is the case with the GDPR, if your business does not comply with the obligations of the AI Act, it risks a fine of up to 35 million euros or up to 7% of the company’s total worldwide annual turnover.

Do you have questions about the implementation of the AI Act within your business?

Our experts from PKF BOFIDI Legal can support you with concrete action points for your business. Feel free to contact our team via info@pkfbofidilegal.com.

This article was written by Jenny Cheung and Tim Fransen.