EU AI Act – AI literacy requirements and prohibited practices now apply – are you compliant?

As of 2 February 2025 two aspects of the EU AI Act are now applicable, Article 4 – which sets out requirements regarding AI literacy, and Article 5 – which sets out prohibited AI practices.

Article 4: AI literacy

Under Article 4 of the AI Act providers and deployers of AI systems are required to take measures to ensure to their best extent a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf.

“AI literacy” is defined in the AI Act as meaning “skills, knowledge and understanding” that allow providers, deployers and affected persons to “make an informed deployment of AI systems” and to “gain awareness about the opportunities and risks of AI and possible harm it can cause” (Article 3(56)). 

Who does the obligation apply to? 

The obligation set out in Article 4 of the AI Act is broad, and it applies not just to providers but also to deployers. As discussed in our previous article here, the definition of “deployer” covers any entity that uses an AI system under its authority (except where the AI system is used in the course of a personal non-professional activity), and this will capture many businesses using AI.

The obligation applies in relation to all AI systems, and not just, for example, “high risk” systems. It applies not just to an entity’s staff but also to “other persons” dealing with the operation/use of AI systems on behalf of that entity, meaning that it may cover third parties such as contractors. 

What measures do you need to take? 

The appropriate measures to take will vary on a case by case basis. Article 4 of the AI Act states that providers and deployers are to take into account in each case the technical knowledge, experience, education and training of their staff and other persons, the context the AI systems are to be used in, and the persons or groups of persons on whom the AI systems are to be used. 

There is not a one size fits all approach. However, steps to take to promote AI literacy will include delivering guidance and training to key personnel on AI issues, and ensuring awareness of internal AI policies within the organisation.

The AI Office has published some of the ongoing practices among pledgers of the AI Pact to provide examples of AI literacy measures, and it is expected to communicate further details of its approach to Article 4 shortly in upcoming AI Office webinar.

Article 5: prohibited AI practices

Article 5 of the AI Act sets out a list of prohibited AI practices. These practices are deemed unacceptable as a result of their potential risks to EU values and fundamental rights.

What are the prohibited practices? 

As a high level overview, the practices set out in Article 5 include (subject to exceptions) the placing on the EU market, putting into service or use of AI systems that: 

• deploy subliminal or purposefully manipulative or deceptive techniques; 
• exploit vulnerabilities due to age, disability or a specific social or economic situation; 
• use social scoring to evaluate or classify natural persons or groups of persons based on social behaviour or personal or personality characteristics; 
• assess or predict the risk of a person committing a criminal offence based solely on profiling or personality traits and characteristics; 
• create or expand facial recognition databases through untargeted scraping of facial images from the internet or closed-circuit television ("CCTV") footage; 
• infer emotions at the workplace or in education institutions; and 
• categorise people based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex-life or sexual orientation.

The use of "real-time" remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement is also prohibited (subject to exceptions).

With effect from 2 August 2025, failure to comply with the prohibition on the AI practices set out in Article 5 is subject to administrative fines of up to the higher of EUR 35 million, or 7% of total worldwide annual turnover (Article 99(3)).

The European Commission published Guidelines on prohibited AI practices on 4 February 2025. The Guidelines are designed to give practical guidance, including to providers and deployers of AI systems, regarding the practices prohibited under Article 5 of the AI Act. For further details please see here. 

Next steps 

Organisations that interact with AI systems must continue to assess whether they are caught by the AI literacy requirements of the AI Act, and ensure that they do not breach the prohibited practices set out in the Act. For assistance with reviewing steps taken toward AI literacy, as well as reviewing AI tools in line with the requirements of the AI Act, please get in touch with your usual contact at the firm.