Article 4 — AI literacy
People who operate or oversee AI need training for their role. A once-a-year slide with no assignment trail is not a system.
EU AI Act
The Act does not ask whether your staff “have ChatGPT.”
It asks whether the organisation knows what it deploys, at what risk, with which people trained, and with which evidence when something goes wrong.
Why the AI Act exists
A risk pyramid — and a deployer role most buyers already occupy.
Regulation (EU) 2024/1689 classifies uses on a risk pyramid: prohibited practices, high-risk systems, limited-risk transparency, and minimal-risk uses that still sit inside an organisation that must not drift into a banned pattern by accident.
Most buyers of this module are not placing a medical device on the Union market. They are employers and public bodies that buy SaaS, embed models, and let staff use tools. That is the deployer role — and it is already regulated.
Obligations that fall on companies
Literacy, screening, oversight, FRIA, transparency, incidents.
Article 5 — prohibited practices
You must screen uses, not hope you are not running a banned pattern.
Article 26 — deployer duties
Use high-risk systems as intended, assign human oversight, keep logging meaningful, inform workers where the law requires it.
Article 27 — FRIA
Fundamental-rights impact assessment for public bodies and certain private deployers of high-risk systems before use.
Article 50 — transparency
People must know they are talking to a chatbot or looking at labelled synthetic content.
Incidents and explanations
Serious incidents recorded and notified; where Article 86 applies, individuals can seek an explanation of a high-risk decision.
What Nexus Business does
A deployer inventory and duty workspace — not a notified body.
Overview KPIs, classification wizard, SaaS catalogue, systems inventory, high-risk register, FRIA, transparency notices, incidents, human oversight, explanations, literacy assignments, supplier and model catalogues, dossier export, reminders, evidence links to Drive and QMS.
The AI Act copilot can draft under Confirm. We do not certify compliance, perform conformity assessment, CE mark, or file in the EU database of high-risk systems.
Open gaps
The question is never “do we use AI?”. It is “what is still missing, and who owns it?”
Every AI system in use — the internal copilot, the vendor assistants staff turned on, an OCR step nobody registered — carries its own open duty: an oversight procedure not linked, a transparency statement missing, literacy evidence incomplete, a conformity assessment never recorded. Severity is stated, an owner is named, and the evidence links to the Drive and QMS documents you already keep. That is a control system, not a policy PDF.
If you have no control system
Indicative ceilings — not legal advice.
Prohibited practices: up to €35 million or 7% of worldwide annual turnover. Other operator obligations: up to €15 million or 3%. Incorrect information to authorities: up to €7.5 million or 1%. SMEs typically take the lower of the euro amount and the percentage.
Money is not the only lever. Authorities can order you to stop a use. Without an inventory, literacy register, FRIA trail and incident log, diligence is hard to demonstrate. Nexus Business does not pay your fine. It makes diligence visible.
This page is commercial information, not a legal opinion, not a prospectus, and not certification. Take specialist counsel before you rely on any figure. Availability and scope depend on contract and product maturity.