If your company works with AI systems and you have not made provisions to give employees working with them sufficient knowledge, then you are missing an obligation that the AI Regulation places on providers and users of AI systems. The Regulation calls this AI literacy: employees must sufficiently understand what an AI system does, where its limits lie and what risks are associated with it, appropriate to their role. If that provision is lacking, a company runs the risk that it cannot demonstrate that it meets this obligation at the moment a supervisory authority asks about it.
What concrete consequences that entails depends on the situation: which AI system is involved, what role the company plays and what a supervisory authority finds during an investigation. A general statement about fines or a fixed approach by supervisory authorities cannot be made, and that is not the intention of this article either. It is possible to describe what the obligation entails, who oversees it and what kinds of consequences the Regulation itself makes possible.
What exactly does the obligation entail
The AI Regulation distinguishes between different roles: who develops or places an AI system on the market, and who uses it within their own organization. Both roles are subject to a form of the obligation to ensure sufficient knowledge among staff working with the system or assessing its results. This does not automatically mean training for everyone; the Regulation leaves room for an approach that fits the role, the employee's experience and the risk of the system used. What exactly is sufficient is not stated in numbers or hours in the Regulation itself, and therefore it is wise to consult the official text in case of doubt rather than rely on assumptions.
For companies dealing with this obligation for the first time, it helps to first determine which AI systems are used within the organization and by whom. That overview is often the missing starting point, not the information itself. In the knowledge base by topic it is set out how this obligation relates to other parts of the Regulation, such as the risk classification of a system.
Who oversees this
In the Netherlands, supervision of the AI Regulation is assigned to supervisory authorities that may differ per sector and per type of obligation; which supervisory authority is competent for which part is not yet fully established for every subject at this time. At EU level, there is also coordination between the Member States. For the current state of affairs, we refer to the competent supervisory authority itself, not to our own interpretations of who is responsible for what.
A supervisory authority may ask for substantiation: which AI systems are used, who works with them and how those employees have been prepared. Without any documentation, that is difficult to demonstrate, even if there is indeed attention paid to it in practice. Documentation is therefore not only a matter of ticking off an obligation, but also of being able to explain what has been done.
What consequences may follow
The AI Regulation provides for an enforcement system with possible sanctions, but their level and form depend on the nature and seriousness of the infringement, and on the assessment that a supervisory authority makes in a specific case. An estimate of the likelihood that a specific company will be inspected, or of the level of any possible sanction, we cannot provide and is also not our role; that is the responsibility of the supervisory authority and, for the interpretation of the text, of a lawyer.
Besides the supervisory process, there are consequences that are less visible but more frequently encountered in practice: a client who asks in a tender how AI literacy is arranged, an insurer who asks about it in a damage claim related to an AI system, or employees who are uncertain about what an AI system is and is not allowed to decide. The latter also touches on employee participation: when introducing a new AI system, the works council may play a role, separate from the AI literacy obligation itself.
What you can do
A good starting point is to make an overview of the AI systems used within the company, who works with them and what risk level is involved. On that basis, you can determine what form of information is appropriate, and it does not have to be complicated. With a few questions get an indication of where your company stands often already provides enough direction to determine the next step.
For those who want to know how other entrepreneurs approach this, or what questions come up frequently, the collection of frequently asked questions is a logical starting point. And for those considering documenting this structurally, you can register with a business account to keep track per obligation of what has already been arranged and what still needs attention.
This description is intended to clarify the obligation, not to assess whether your company complies with it. For that assessment, and for explaining the official text in your situation, a lawyer or the competent supervisory authority is the right contact point.
Do you first want to get an image of where your company stands? The free quick-scan provides an initial indication, and in the knowledge bank you will find the topics that often go together here, from staff and AI to contracts with your suppliers.