Enforcement started this week. There are four things you have to be able to show, and three of them usually get skipped.
Since 2 August 2026 the Dutch supervisory authorities can act on Article 4 of the AI Act. The obligation itself has existed since February 2025, so what changes isn't the rule but the consequence. In the conversations we're having these weeks, it's almost always the same misunderstanding: that you comply by buying a training.
Four things, not one
- Knowing which AI systems are used in your organisation, including whatever didn't arrive through procurement.
- Determining per role which level fits, because the risk differs per job.
- Training on that.
- Recording what happened and whether the level actually changed.
Buying a course starts at step three. That isn't wrong, it's incomplete, and it's exactly why an attendance list is worth so little afterwards. A list proves attendance. The obligation is about literacy.
The shadow list
Step one produces a surprise at nearly every organisation. The official list has Copilot and perhaps a translation service. The real list also has the free ChatGPT accounts, the AI feature in the HR suite quietly switched on last year, and the plug-in someone in marketing found handy. That shadow list isn't an incident, it's the norm.
The good news is you want that inventory anyway, law aside. You can't have a sensible conversation about what AI delivers if you don't know what's being used. In that case compliance is a by-product, not a separate cost line.
What a regulator is likely to do
The maximum fine of 15 million euros or 3% of annual turnover is being quoted a lot right now, and it gives a distorted picture. The first years of a new regulation typically address high-risk applications: recruitment screening, credit scoring, facial recognition. A municipality that rolled out Copilot without a role analysis isn't top of that list.
That's no reason to wait, but it is a reason to do it calmly. The obligation surfaces sooner in a tender, an audit or a works council question than in an inspection letter. At those moments a measurement with a date on it is a stronger answer than good intentions.