In July the digital omnibus postponed part of the Artificial Intelligence Act (EU AI Act), and the headlines reported a delay. What was postponed affects a minority of companies. Two obligations that apply to practically everyone came under supervision in August 2026, as planned.
The first is staff AI literacy. It has applied since February 2025, and in August 2026 the rules on supervision and enforcement started to apply. The second is transparency, meaning the obligation for a chatbot to say that it is AI, which has applied since 2 August 2026. In Slovenia both are backed by a fine that starts at 25,000 EUR.
What the AI Act is
The Artificial Intelligence Act is Regulation (EU) 2024/1689, known as the EU AI Act; in Slovenian it is called Akt o umetni inteligenci. It was published on 12 July 2024 and entered into force on 1 August 2024, and its obligations apply in stages. As a regulation, it applies directly in all member states. Slovenia set out the supervisory authorities and fines in its Act Implementing the EU Regulation Laying Down Harmonised Rules on Artificial Intelligence (ZIUDHPUI) (in Slovenian).
Risk levels
The Act classifies uses of artificial intelligence by risk. The level determines what a company has to do:
- Prohibited practices, for example social scoring or recognising employees’ emotions. They have been prohibited since 2 February 2025.
- High-risk systems, for example AI in recruitment, credit scoring or critical infrastructure. The strictest requirements apply to them.
- Limited risk, which covers chatbots and AI-generated content. The transparency obligation under Article 50 applies here.
- Minimal risk, for example spam filters. There are no specific obligations.
AI literacy under Article 4 applies regardless of the risk level, to every company that uses AI.
AI literacy applies to everyone who uses AI
Article 4 of the AI Act requires a company to take measures to ensure a sufficient level of AI literacy among its staff and the external contractors who use AI systems on its behalf. The level is set according to their knowledge, experience, education and the context of use.
The obligation has applied since 2 February 2025. It is not new, it is just that hardly anyone has met it.
What matters is who it applies to. It applies to providers and deployers, and a deployer is any company that uses AI in its business. If your team uses ChatGPT, Copilot or an AI note-taker in meetings, or if you have a chatbot on your website, your company is a deployer.
Slovenia added the fine itself
This is the most surprising part. The Regulation itself sets no fine for Article 4, because Article 99(4) does not list it. That is why commentary from other countries says AI literacy carries no penalty. In Slovenia it does, because the Slovenian implementing act, ZIUDHPUI, added one itself.
Article 25 of that act sets these ranges of fines:
- Legal entity: from 25,000 to 250,000 EUR
- Large company: from 100,000 to 450,000 EUR
- Sole trader (samostojni podjetnik): from 15,000 to 100,000 EUR
- Responsible person, meaning the managing director personally: from 2,500 to 10,000 EUR
The lower limit is 25,000 EUR, not "up to 25,000". For an offence the fine is set within the range, and the managing director is personally liable. Article 4 is supervised by the Information Society Inspectorate (inšpekcija za informacijsko družbo), not by the Agency for Communication Networks and Services (AKOS).
What counts as meeting the obligation
The good news is that no certificate, exam or set number of hours is required. The Regulation does not prescribe a curriculum. As a minimum, the European Commission expects a general understanding of AI within the company, an understanding of the specific context in which the company uses AI, and measures that match the company’s role and the risks of its systems.
The content has to be tied to the role. A single lecture for everyone, with no link to what each person actually does with AI, is a weak defence.
Here the record matters more than the content. The law penalises a company for not taking measures, so in practice the burden of proof is on the company. Who, when, on what. Without a record, as far as an inspector is concerned, the measure does not exist.
A chatbot must say that it is AI
Since 2 August 2026, Article 50 on transparency also applies, with no transition period. A chatbot, voice assistant or AI agent must clearly inform a person at the first interaction that they are talking to artificial intelligence. There is an exception for cases where this is "obvious from the context", but the Commission interprets it narrowly. A label saying "Support" is not disclosure.
The same goes for content. Deepfakes and AI-generated or manipulated images, audio and video must be disclosed at the latest at the first exposure, in a way that a person notices. A machine-readable marking by the provider is not enough on its own.
Many people rely on the wrong party here. The disclosure obligation lies with the provider, and under Article 3(3) of the Regulation a provider is also anyone who has had a system developed and puts it into service under their own name or trademark. A company with a chatbot under its own brand is a provider. An agency or OpenAI will not sort this out on its behalf. The ranges of fines are the same as for literacy, and supervision is carried out by AKOS.
AI Act timeline
- 1 August 2024: the Act enters into force.
- 2 February 2025: prohibited practices and the AI literacy obligation.
- 2 August 2025: obligations for general-purpose AI models (GPAI) and the governance rules.
- August 2026: transparency under Article 50 (from 2 August), and supervision and enforcement, including for AI literacy.
- 2 December 2027: stand-alone high-risk systems under Annex III, postponed by the digital omnibus.
- 2 August 2028: AI in regulated products under Annex I, postponed by the digital omnibus.
The digital omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026. It moved stand-alone high-risk systems under Annex III, which covers recruitment, education, credit scoring and critical infrastructure, from 2 August 2026 to 2 December 2027. AI built into regulated products under Annex I moved to 2 August 2028.
Neither Article 4 nor Article 50 was postponed. Nor were Article 5 on prohibited practices or the obligations for general-purpose models.
One of the prohibitions in Article 5 has applied since February 2025 and is worth mentioning, because many people are not aware of it. Recognising the emotions of employees in the workplace and of students in education is prohibited, not just regulated, except for medical and safety reasons. It also covers tools that assess mood from the voice, for example sales call analytics that measure the agent’s emotions.
Six things you can check in ten minutes
- Is there a record that staff received AI training? Who, when, on what?
- Do you have a list of the AI tools your team uses, and who is the provider or deployer for each?
- Open your chatbot. Does the first message say that it is AI?
- Call your voice AI. Does it say so in the first sentence?
- Ads with an AI avatar or a cloned voice: is the disclosure visible to the viewer?
- Does any tool assess employees’ emotions from their voice or face? If so, that is not something to fix but something to stop immediately.
What to take away
Anyone can file a complaint: a competitor, a dismissed employee or an angry customer. Because this is an obligation of effort and not of result, most of the work is administrative. Documented training, a list of tools and one sentence in your chatbot cover a large part of the exposure.
How we do this for a client, with an internal policy and training tied to the team’s tools, is described on the AI training for staff page.
The amounts and article numbers in this post were taken from the text of the act in the Official Gazette of the Republic of Slovenia (Uradni list RS) (in Slovenian), not from summaries. The situation was checked on 18 August 2026 and the deadlines were updated on 28 September 2026. This is not legal advice. Before you make a decision, check the text currently in force (in Slovenian), because deadlines and interpretations are still changing.
The European regulation sets no fine for AI literacy. Slovenia added one in its own act, and it starts at 25,000 EUR.
Common questions
Does the EU AI Act also apply to small companies?
Yes. The AI literacy obligation applies to every company that uses AI in its business, regardless of size. If your team uses ChatGPT or Copilot, or you have a chatbot on your website, the company is a deployer. Under the Slovenian ZIUDHPUI act, the fine for a sole trader starts at 15,000 EUR.
What does staff AI literacy mean, and how do we prove it?
Employees who use AI must understand how the tools work, where the risks are and how to use them in their own work. No certificate or exam is required. Because in practice the burden of proof is on the company, keep a record: who was trained, when and on what.
Since when has the obligation applied, and since when is it penalised?
Article 4 has applied since 2 February 2025. The rules on supervision and enforcement have applied since August 2026. In Slovenia, the fines for companies are set by Article 25 of the ZIUDHPUI act.
Who supervises compliance in Slovenia?
Under the ZIUDHPUI act, AI literacy is supervised by the Information Society Inspectorate, and the transparency of chatbots and AI content by the Agency for Communication Networks and Services (AKOS).
Does a chatbot on a website have to say that it is artificial intelligence?
Yes. Since 2 August 2026, a chatbot, voice assistant or AI agent must clearly inform a person at the first interaction that they are talking to artificial intelligence. The obligation lies with the provider, and that includes a company that uses the chatbot under its own brand.