The AI Act has long since begun – not just in August
4 min read
Most compliance calendars mark August 2026 as the start date for the EU AI Act. For the vast majority of companies, that date is simply wrong. The first binding obligation has been in force since 2 February 2025-and it affects not only tech giants but every mid-sized business running Microsoft Copilot, ChatGPT or an AI module in its ERP. Waiting until August means you have already ignored an existing legal duty for more than a year.
Key takeaways
- The deadline was February 2025, not August. Article 4 of the EU AI Act has been in force since 2 February 2025. The obligation to possess AI competence has therefore existed for more than a year.
- “Sufficient” is not defined. Every company must determine and document what level of AI competence is appropriate for its specific use.
- Three questions satisfy the duty. Which AI tools are actively running, in which decisions their outputs feed, and what must an employee understand to use them.
Related:When AI collaborates instead of just assisting / AI in accounting: 78 % of mid-market postings go undetected
When this week’s WiWo conference “AI in the Mid-Market” debates AI readiness, the discussion keeps missing the point that has already been settled. The question is no longer whether regulation is coming; it is here.
The deadline nobody is talking about
The debates around the EU AI Act have focused on August 2026-the date when supervisory and penalty rules kick in, with fines reaching up to €35 million or seven percent of global annual revenue. That figure dominates headlines, compliance checklists, and legal letters. What’s often overlooked: for most companies, the AI Act didn’t begin in August-it started in February 2025.
Article 4 of the EU AI Act has been in force since 2 February 2025. It requires every company using artificial intelligence to ensure its employees possess adequate AI competence. This obligation isn’t limited to providers of high-risk AI or tech giants-it applies to everyone. The 180-employee manufacturing firm using Microsoft Copilot in sales. The consultancy running ChatGPT for research. The mid-sized business whose accounting now relies on an AI-driven invoice processing system. This duty has been in place for over a year.
What does the AI competence requirement entail? Article 4 mandates that any company deploying AI systems must ensure an appropriate level of AI understanding among all staff interacting with those systems. The benchmark isn’t a fixed curriculum but the actual operational use case.
Why “adequate” isn’t a loophole-it’s a requirement
Article 4 doesn’t spell out what “adequate AI competence” looks like. That might seem like an open flank, but it’s actually the core demand: companies must define-and document-what suffices for their specific AI use. Failing to answer that question means failing the obligation, and being unable to prove compliance when challenged.
This isn’t theoretical. If a sales rep uses Copilot to draft customer proposals, the relevant competence question is: does the rep understand how the model generates its suggestions? Do they know when to scrutinise the output and when to reject it outright? Can they spot when the system is wrong? Skipping these questions isn’t neutral-it’s tacit acceptance of unchecked AI use.
This isn’t an educational initiative
The good news for every CEO: Article 4 does not force companies to launch training programs or obtain certifications. It forces them to gain clarity. And clarity about their own AI use is long overdue.
Projects regularly reveal that companies don’t know which AI tools are actually in use. Not out of negligence, but because AI functionality has been embedded in existing software without anyone making a conscious decision to introduce it. Copilot is part of the Microsoft 365 subscription. The AI assistant in the ERP came with the last update. The analytics tool in the CRM now “also has AI.” Article 4 is the catalyst to create this overview for the first time-and that overview holds strategic value far beyond compliance.
Three questions that belong on the table now
Every company should answer three questions right now. First: which AI tools are actually in use-not just licensed, but actively deployed? Second: into which decision-making processes do their outputs flow, and how binding are those outputs treated? Third: what must an employee understand to ensure this use remains defensible?
Documenting answers to these three questions fulfills Article 4. And, in passing, it creates an inventory of your own AI landscape-one that will be needed for every subsequent decision, whether expansion, governance, or liability.
2026 will be the year of better decisions, not louder tools.
The year of consequences
The real year of AI decisions wasn’t 2024, when pledges were grand and pilot projects plentiful. It’s 2026, because that’s when the consequences begin. Companies that use Article 4 as an opportunity to structure their AI use will be in a measurably stronger position in two years than those still waiting for the next deadline. The effort is modest; the strategic gain is not.
Frequently Asked Questions
When does the AI competence requirement from the AI Act come into effect?
Article 4 of the EU AI Act has been in force since 2 February 2025. It obliges providers and operators of AI systems to ensure that their employees and anyone working with AI on their behalf possess adequate AI competence. Therefore, the requirement has already been in place for more than a year, independent of the August 2026 deadline.
Does Article 4 also apply to small companies that do not develop their own AI?
Yes. The obligation applies to every operator of an AI system-meaning every company that uses AI. This includes businesses leveraging Microsoft Copilot, ChatGPT, or an AI module in their ERP or CRM. No in-house AI development or high-risk system is required for this to apply.
Are fines already possible for violations of Article 4?
The AI Act’s enforcement and penalty mechanisms take effect on 3 August 2026, with Article 4 enforced by national market surveillance authorities. However, the substantive obligation itself has been in force since February 2025. Companies not meeting it are therefore already non-compliant today, even though the sanctions framework only activates later.
What does “adequate AI competence” actually mean?
The AI Act does not define a fixed standard. The appropriate level depends on the specific AI use, the tasks involved, and employees’ prior knowledge. Companies must determine and document what understanding is necessary for their deployment. Article 4 does not mandate formal assessment of employees’ knowledge.
Image source: AI-generated (May 2026)
Editor’s Reading Picks
- Microsoft’s AI bundle for $99: Is the leap worth it?
- Productivity over cost-cutting: How mid-sized firms will really decide in 2026
- Whistleblower loophole: First fines hit mid-sized firms
More from the MBF Media Network
- Digital Chiefs: Who in the corporation decides what the AI considers true
- cloudmagazin: Claude alongside GPT: Model choice and its trade-offs
- SecurityToday: Copilot Cowork acts alone, and the SOC doesn’t see it
Cover image: AI-generated (May 2026)
