What is the impact of the AI Act for the use of artificial intelligence in business processes?

The AI Act came into force on 1 August 2024, and within a period of two years, the majority of the obligations for companies must be complied with. For companies that use artificial intelligence (AI) in their business processes, the countdown has begun.

Use of AI in business processes

According to data from Eurostat, Belgium is among the leading countries in the EU, with 14% of respondents indicating that they have employed AI within their company in 2023. This puts Belgium well above the European average of 8%. This finding was also corroborated by the Claeys & Engels HR Beacon, our yearly questionnaire on HR trends, where 14% of those surveyed also indicated they had already used AI.

Risk-based approach

The AI Act aims to create a uniform legal framework within Europe for the development, the placing on the market, the putting into service and use of AI systems. To achieve that objective, the AI Act adopts a risk-based approach, whereby the applicable rules are tailored to the severity and extent of the risks posed by AI systems.

First, the AI Act prohibits some practices that pose an unacceptable risk. For instance, it prohibits the use of AI systems that infer emotions from individuals in the workplace.

Furthermore, a number of AI systems are classified as ‘high-risk’. These AI systems must meet a number of mandatory requirements. Several AI systems used for HR purposes will fall under the high-risk category. For example, in a recruitment context, these include AI systems used for recruiting or selecting natural persons, especially for posting targeted vacancies, analysing and filtering applications and assessing candidates.

Finally, there are AI systems that pose a limited risk in the absence of transparency, such as AI systems that serve to improve the language of previously prepared documents or to answer questions (e.g., with ChatGPT). In this context, companies in principle have to make it known that the content is AI generated.

Infringement of the provisions on prohibited AI systems may result in fines of up to EUR 35 million or 7% of a company’s annual turnover. Other violations can lead to fines of up to EUR 15 million or 3% of a company’s annual turnover. Providing incorrect, incomplete or misleading information to authorities can lead to fines of up to EUR 7.5 million or 1% of a company’s annual turnover. These fines may be lower for SMEs and startups.

Obligations of providers and deployers

The AI Act contains different obligations depending on whether a company qualifies as a provider, importer, distributor, product manufacturer, authorised representative or so-called deployer. Many companies will qualify as ‘deployer’. However, a qualification as provider cannot be excluded. This will be the case, for example, when a company does not merely use an existing AI system, but further develops an existing AI system and makes it available under its own name. The threshold between deployers and providers may be low, but the consequences in terms of obligations are not.

Most of the obligations under the AI Act apply to providers of AI systems, especially when it comes to high-risk AI systems. For example, providers must in such cases provide risk management and quality management systems throughout the system lifecycle. Deployers of high-risk AI systems on the other hand have, for example, the obligation to take appropriate technical and organisational measures to ensure that they use the AI systems in accordance with the instructions for use.

In addition, companies must take measures to ensure a sufficient level of AI literacy among those who come into contact with AI systems. This obligation comes into effect in February 2025.

Gradual application over time

There are already some dates to note regarding the application of the AI Act for companies acting as providers or deployers. As of February 2025, AI systems with unacceptable risk will be prohibited. In addition, from then on, companies must also take measures to provide an adequate level of AI literacy. As of August 2026, most obligations for high-risk AI systems must be met, and the transparency obligations will enter into force.

Anticipate and begin preparations now

It is crucial to timely start preparing for the AI Act. Companies should map out which AI systems they and their partners use and check how they qualify under the AI Act, especially as a provider or deployer.

It is then necessary to identify which risk category the AI system falls into. This should be done before February 2025 as that is when the rules regarding prohibited AI systems come into force.

Based on this overview, the company can identify its obligations and draw up an action plan to proceed with timely implementation. Most obligations are effective from August 2026. However, transitional measures apply to certain AI systems.

Matthias Vandamme, Attorney – Associate Claeys & Engels