The EU AI Act's high-risk obligations are here: What they mean for AI literacy and accountability

The EU Artificial Intelligence Act, agreed in 2024, is the world's first comprehensive law regulating AI. Its requirements have rolled out in stages, and in August 2026 the most significant milestone arrived: the obligations for high-risk AI systems took full effect. For organizations developing or deploying such systems, this meant new duties around risk management, documentation, human oversight, and crucially, an explicit requirement to ensure AI literacy among staff. Here is what changed and why training is now a compliance obligation, not a nice-to-have.

How the AI Act classifies systems

The AI Act uses a risk-based approach. Most AI systems face minimal or transparency obligations. A smaller set, including those used in critical infrastructure, education, employment, essential services, and law enforcement, are classified as high-risk and face the strictest requirements. A narrow category of unacceptable-risk applications, such as social scoring and certain manipulative techniques, is outright banned. The high-risk tier is where most of the substantive obligations, and the penalties, concentrate.

What the August 2026 deadline changed

The rollout of the AI Act was deliberately staggered. General-purpose AI and certain other provisions came earlier, but the core obligations for high-risk systems took effect in August 2026. From that point, providers and deployers of high-risk systems had to comply with requirements covering risk management, data governance, technical documentation, transparency, and human oversight. For many organizations, this was the moment the AI Act stopped being an abstract future regulation and became an operational reality.

The AI literacy requirement

One of the most direct training obligations in the AI Act is Article 4, which requires providers and deployers to ensure a sufficient level of AI literacy among their staff, taking into account their technical knowledge, experience, and the context in which the AI is used. This is a broad but real requirement: employees who build, deploy, or interact with AI systems need to understand what the systems can and cannot do, their risks, and how to use them responsibly. For a security awareness platform, this is a familiar message, applied to a new subject.

Where security and AI literacy overlap

AI literacy and security awareness are increasingly the same conversation. Employees who use AI tools need to understand prompt injection, data leakage, and the risk of feeding sensitive information into a model. They need to know that AI output can be wrong, biased, or manipulated, and that verification is still required. The AI Act's literacy requirement dovetails with the security threats organizations already face. Training that covers both the compliance and the security dimensions of AI is the most efficient way to satisfy the obligation while actually reducing risk.

Human oversight is a named duty

The AI Act requires human oversight measures for high-risk systems, ensuring that people can intervene, override, or stop a system when necessary. This is a direct continuation of the verification-by-process lessons that security awareness has long taught. Employees need to understand when and how they can challenge an AI system's output, and organizations need to build clear channels for doing so. Oversight that exists only on paper does not satisfy the requirement; it has to be real, understood, and practiced.

Penalties that demand attention

The AI Act carries penalties on a scale similar to GDPR. Non-compliance with the high-risk obligations can result in fines of up to 15 million euros or 3 percent of global annual turnover, whichever is higher, with even larger fines for banned practices. These are not amounts organizations can ignore. The combination of clear obligations, staged enforcement, and significant penalties means that organizations operating in the EU, or serving EU customers, need to treat AI compliance as a serious program.

How to prepare now

Preparation begins with understanding whether your organization develops or deploys high-risk AI systems. From there, the priorities are: implement a documented AI risk management process; establish technical documentation and transparency measures; design and train for human oversight; and deliver AI literacy training to staff, tailored to their roles. For most organizations, the training piece is the fastest, most tangible step, and it is exactly the kind of evidence regulators will ask to see. A platform that can document AI literacy alongside security awareness turns two compliance burdens into one.