The EU AI Act in practice for operations: what to put in place now, and what comes later

Risk determines the rules

The EU AI Act (Regulation (EU) 2024/1689) regulates AI on the basis of risk. The higher the risk of an application, the stricter the requirements. A handful of practices are prohibited. For most operational applications, such as demand forecasting, route optimisation or predictive maintenance, it is mainly a matter of transparency, human oversight and being able to demonstrate compliance. Importantly, it is not all or nothing. You do not have to stop using AI; you have to use it in a controlled way.

What already applied, what has applied since August 2026, and what does not come until 2027

Article 4 has applied since 2 February 2025. Since the amendment by Regulation (EU) 2026/1744, in force from 27 July 2026, it has asked organisations that use AI to take measures that support the AI literacy of their employees, appropriate to their organisation and AI use; they do not have to guarantee a specific level. What you want to be able to show is simple: who was trained, in what and when. A team that 'does something with ChatGPT' without agreements and without records does not comply. What exactly is and is not required under Article 4 is explained in our article on the AI literacy obligation.

Since 2 August 2026, the Regulation has been largely applicable. For operations, that mainly means one specific new obligation: if an AI system communicates with people, that must be disclosed (Article 50). The omnibus package has moved the strict requirements for high-risk systems to 2 December 2027 (Annex III) and 2 August 2028 (AI in regulated products), so you have more time for those than previously thought. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority) and the RDI (Dutch Authority for Digital Infrastructure) are the intended Dutch supervisory authorities, although the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) is not yet in force. The omnibus package softens the wording of the literacy obligation, but the core remains; what exactly has changed is set out in our article on the simplification of the AI Act. Organisations that put this in place now will have nothing to fix later.

The practical checklist for operations

You do not need to set up a legal department for this. Four steps will take you a long way:

• Take stock of where AI is already used. That is often more than you think: ChatGPT in emails, a planning tool with AI under the hood, a supplier that has built AI into a service. Without this overview, you do not know what you are controlling.
• Classify the risk of each application. Most operational applications are low risk. Some, such as AI relating to staff or safety, need more attention. Know which falls into which category.
• Organise AI literacy to suit the role. A planner who works with AI routes needs different knowledge from HR. Target the training and record who has been trained in what.
• Maintain human oversight and an audit trail. At critical steps, the human decides and signs. A trail of what AI proposed and who confirmed it makes the difference during an inspection or audit.

Not locked down, but under control

The biggest misconception is that the EU AI Act is a brake. In practice, the Act mainly requires what good operations want anyway: knowing where AI is, knowing who uses it and being able to show that it is used in a controlled way. That is not a report to be filed away in a drawer, but working agreements that make your operation more reliable.

How to start sensibly

Start with a short inventory and one specific process. Organise AI literacy for the team that works with it and record it. Then take one application where AI pays off, with human oversight and an audit trail from day one. That way you take the measures Article 4 asks for and at the same time end up with something that works, instead of a compliance exercise that nobody uses.