Skip to content
EU AI Act — Practical Guide

What does your organisation need to do now?

The EU AI Act is the world's first comprehensive AI legislation. Article 4 mandates AI literacy. DORA and NIS2 impose additional requirements for regulated sectors. We translate regulation into action.

Obligations

Three Regulations — One Approach

EU AI Act

Article 4 requires that everyone who develops, deploys, or uses AI systems has sufficient AI literacy. This applies now.

DORA

The Digital Operational Resilience Act sets requirements for ICT risk management at financial institutions, including AI systems that support operational processes.

NIS2

The Network and Information Security Directive extends cybersecurity obligations to more sectors, with direct implications for AI governance.

Compliance Timeline

Compliance Timeline

July 2024
EU AI Act published in the Official Journal of the EU
February 2025
Prohibited AI practices enforceable — immediate compliance required
August 2025
Article 4 AI literacy obligation in effect — governance and transparency obligations
August 2026
High-risk AI systems (Annex III) fully regulated — conformity assessments mandatory

Download the EU AI Act Compliance Checklist

Practical checklist for Dutch organisations. Article 4 obligations, DORA intersections, action points, and timeline.

Active in financial services, insurance, or pension funds? In addition to the EU AI Act, your sector faces additional obligations under DORA and NIS2. Get in touch for sector-specific guidance →

Frequently Asked Questions

FAQ — EU AI Act

When does Article 4 take effect?
Article 4 is already in effect. Organisations must now demonstrate that employees working with AI systems have sufficient AI literacy.
Does the EU AI Act apply to our organisation?
Yes, if your organisation develops, deploys, or uses AI systems within the EU. This includes the use of AI tools such as ChatGPT, Copilot, and similar systems.
What are the penalties for non-compliance?
Fines up to €35 million or 7% of global annual turnover, depending on the violation. Additionally, reputational damage and potential operational restrictions.