TL;DR for the DPO
Media attention is all on high-risk systems, whose obligations the Digital Omnibus moved to December 2027 and August 2028. But prohibited practices and the AI literacy obligation have been in force since 2 February 2025 and were not deferred. That is where the Dutch authority says it will begin.
The five stated priorities
- Overarching system supervision, that is, systems as a whole rather than individual cases.
- Transparency and explainability of the outputs systems produce.
- Frameworks and technical standards.
- Testing for bias and fairness, with explicit attention to discrimination.
- AI literacy of the staff operating the systems.
The obligation almost nobody has discharged
Art. 4 of the Regulation requires providers and deployers to ensure a sufficient level of AI literacy among staff dealing with the operation and use of the systems. It prescribes no certificate and no number of hours, and for exactly that reason it gets postponed indefinitely: there is no box to tick that makes it look done.
Why it is a good first target for an authority
Checking AI literacy is simple and cheap: ask which AI systems are in use, who uses them, and what training that person received. If the answer is silence, the infringement is established without technical expertise. It is the same mechanism by which a Finnish fine was upheld because a retention period had never been written down: documentary findings are the ones authorities win.
What to do now, with clients
Three questions and one document
1) Which AI tools are actually in use? Include the ones nobody calls AI: writing assistants, meeting transcription, fraud filters, CV screening. 2) Do any of them fall under the prohibited practices of Art. 5? Emotion recognition in the workplace and social scoring are the two most often found without anyone having noticed. 3) Have the people using them been trained, and is there a record? The AI training and literacy register in the generator exists exactly for this: it is the one document that turns 'we discussed it in a meeting' into evidence.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
