Why the AI Act affects you personally

Regulation (EU) 2024/1689, known as the AI Act, entered into force on 1 August 2024. It is not a directive that each country transposes in its own way. It is a regulation: it applies directly in all member states. No interpretations, no excuses, no "let's see how Spain transposes it".

For the executive, three realities change everything:

1. Liability is personal. Not just the company's. The AI Act establishes obligations that fall on the individuals who make decisions about AI systems. If your company deploys a high-risk system without meeting the requirements, the executive who approved that deployment can be held liable.
2. The fines are existential. Up to EUR 35 million or 7% of global turnover. For an SME with EUR 5 million in revenue, 7% is EUR 350,000. Enough to close the business.
3. The deadlines are imminent. August 2026 is when most obligations for high-risk systems come into force. It is not a distant horizon. It is weeks away.

The AI Act structure in 5 minutes

The AI Act classifies AI systems into four risk levels. Your first job as an executive is to know which level your company's systems fall into:

Unacceptable risk (prohibited)

Systems the EU considers incompatible with fundamental rights. Prohibited since February 2025.

• Social scoring (social credit scoring of citizens)
• Subliminal manipulation causing harm
• Exploitation of vulnerabilities of specific groups
• Real-time biometric identification in public spaces (with exceptions for security)

If your company uses any of these, stop immediately. There is no exception or transition period.

High risk

Systems that significantly affect people. They must meet strict requirements before deployment.

• HR: candidate selection, performance evaluation, AI-based promotion or dismissal decisions
• Credit: credit scoring, creditworthiness assessment
• Insurance: premium calculation based on individual profiles
• Education: student assessment, access to education
• Essential public services: access to benefits, emergency services
• Justice and migration: evidence assessment, border control

Requirements: risk management system, documented training data, transparency, human oversight, demonstrated accuracy and robustness, registration in the EU database.

Limited risk

Systems that interact with people. Main requirement: transparency.

• Chatbots: must inform the user they are talking to AI
• Deepfakes: must be labeled
• AI-generated content: must be identified as such

Minimal risk

Everything else. Spam filters, product recommendations, writing assistants. No specific obligations. Most AI productivity tools fall here.

Obligations of the board and executive management

The AI Act does not say "the company must". It says "the provider must" and "the deployer must". If your company uses high-risk AI systems, you are a "deployer". That creates concrete obligations for leadership:

What the board must approve

1. AI systems inventory. A complete list of all AI systems the company uses, classified by risk level. If you do not know what AI your company uses, you cannot comply with anything.
2. Risk assessment. For each high-risk system, a documented impact assessment including risks to fundamental rights.
3. AI policy. A governance framework that defines who can deploy AI, with what approvals, under what conditions and with what oversight.
4. Compliance budget. Complying with the AI Act has a cost: auditing, documentation, training, monitoring tools. The board must approve that budget.

What executive management must execute

• Designate an AI compliance officer. This can be the DPO, the CISO, a new role, or a shared function. But someone must have explicit responsibility.
• Implement human oversight. For high-risk systems, there must be a person (with adequate training) who can intervene, override or disable the system.
• Document everything. Decisions, assessments, incidents, corrective actions. Documentation is the primary defense in an inspection.
• Train the team. The AI Act requires that people who use high-risk systems have "sufficient AI competence" (AI literacy). This is not optional.

Personal liability of the executive

The AI Act combines with each member state's corporate law and director liability legislation. In Spain, the Companies Act (art. 225-236) establishes that directors are liable for damage caused by acts contrary to law.

Personal liability scenarios:

Scenario 1: Deployment without assessment

The company deploys an AI system for candidate screening without conducting the required impact assessment. A rejected candidate files a discrimination claim. The inspection discovers there is no documentation. The executive who approved the deployment is liable.

Scenario 2: Ignoring alerts

The technical team reports that a credit scoring system shows statistical bias against a demographic group. Leadership decides not to act because "it generates good commercial results". If there is a complaint, the documented inaction is evidence against the executive.

Scenario 3: Lack of training

An untrained employee makes automated decisions about social benefits. The system commits systematic errors. The company cannot demonstrate it trained the employee. The HR director is exposed.

10 questions you must ask your legal team

You do not need to be an AI Act expert. You need to ask the right questions. These 10 are the minimum:

1. How many AI systems do we currently use? Include SaaS tools, APIs, proprietary models, automations with integrated AI. The answer usually surprises.
2. Which ones classify as high-risk under the AI Act? Especially HR, credit, insurance, education. If you use AI to screen CVs, it is high-risk.
3. Do we have a documented impact assessment for each one? "We thought about it" does not count. It must be written, dated and signed.
4. Who is our AI compliance officer? If the answer is "nobody" or "IT handles it", you have a problem.
5. Do we meet the transparency requirements? Do users know they are interacting with AI? Are AI outputs identified as such?
6. Do we have human oversight for high-risk systems? Who can intervene? Are they trained? Do they have real authority to disable the system?
7. Do our AI providers comply with the AI Act? The AI Act holds the deployer responsible if the provider does not comply. Review contracts.
8. Do we have an AI literacy training plan? The AI Act requires it. How many people need training? By when?
9. What insurance do we have that covers AI liability? General liability policies may not cover damages caused by AI systems.
10. Are we prepared for an inspection? If an inspector from the national supervisory authority arrives tomorrow, can we demonstrate compliance within 48 hours?

5-step compliance plan

This plan is designed so an executive can activate it at the next committee meeting. It does not require deep legal knowledge. It requires willingness to act.

Step 1: Inventory (weeks 1-2)

Catalog all AI systems in use. For each one: name, provider, function, data processed, responsible department, risk classification (unacceptable, high, limited, minimal). A spreadsheet is enough.

Owner: CTO or CISO, with input from each department.

Deliverable: complete inventory with risk classification.

Step 2: Risk assessment (weeks 3-6)

For each high-risk system: impact assessment including risks to fundamental rights, mitigation measures, human oversight plan. Use the European AI Office template as a baseline.

Owner: legal team + AI compliance officer.

Deliverable: documented impact assessment per system.

Step 3: Governance (weeks 4-8)

Create or update the company's AI policy. Define roles: who approves new AI systems, who oversees existing ones, who reports incidents. Approve at board level.

Owner: general management + legal.

Deliverable: AI policy approved by the board.

Step 4: Training (weeks 6-12)

AI literacy plan for all employees who interact with AI systems. Specific training for high-risk system operators. Training record (who, when, what).

Owner: HR + AI compliance officer.

Deliverable: completed training record.

Step 5: Ongoing monitoring (permanent)

Quarterly review of the inventory (new systems, changes to existing ones). Annual compliance audit. Update risk assessments when the system or the regulation changes.

Owner: AI compliance officer.

Deliverable: quarterly report to the board.

SME exemptions

The AI Act includes measures to avoid overburdening SMEs. If your company is small, this matters:

What benefits you

• Regulatory sandboxes: national authorities must create testing environments where SMEs can test AI systems with free regulatory guidance. Spain is required to create at least one.
• Reduced fees: conformity and registration fees are reduced proportionally to company size.
• Simplified guidelines: the European AI Office must publish SME-specific guidelines. If you cannot find them, your industry association should demand them.
• Extended deadlines: for some documentation requirements, SMEs have more generous timelines.

What does NOT exempt you

• High-risk systems: if you use high-risk AI, you must meet the same requirements as a multinational. No exceptions by size.
• Prohibited practices: apply to all companies, regardless of size.
• Transparency: the requirement to inform users applies to everyone.

Sanctions that matter to leadership

The AI Act establishes three levels of sanctions. The figures are maximums, but they convey the seriousness of regulatory intent:

For SMEs and startups, the lesser of the two amounts applies (percentage or fixed amount). But even the minimum can be devastating for a small company.

Beyond direct fines, the reputational damage is real. An AI Act sanction generates headlines, erodes client trust and makes it harder to attract talent. In regulated industries (banking, insurance, healthcare), it can mean the loss of operating licenses.

Critical deadlines: August 2026 is here

The AI Act has a phased rollout. These are the deadlines that matter to leadership:

• February 2025 (already past): prohibition of unacceptable-risk practices. If you have not reviewed this, do it today.
• August 2025 (already past): AI literacy obligations for all providers and deployers. Your team should already be trained.
• August 2026 (imminent): entry into force of requirements for high-risk systems. Impact assessments, human oversight, technical documentation, EU database registration. This is the critical deadline.
• August 2027: requirements for general-purpose AI models (mainly affects model providers, not users).

If your company uses high-risk systems and you have not started the compliance plan, the time to act is now. Not August. Now.

Insurance and liability coverage

Traditional liability insurance policies (general liability, D&O) may not cover specific damages caused by AI systems. Three concrete actions:

1. Review current policies

Ask your broker to confirm in writing whether your liability policy covers: damages caused by automated decisions, algorithmic discrimination, AI system failures in production. If the answer is "it depends", it does not cover them.

2. Evaluate AI-specific insurance

The insurance market is creating AI-specific products. They are expensive and have many exclusions, but they exist. Assess whether your risk level justifies it. For most SMEs with limited-risk AI, it is not necessary yet.

3. Provider contract clauses

Review your AI provider contracts. Who assumes liability if the system fails? Many SaaS contracts exclude liability for incorrect outputs. If you use a high-risk system, that clause is unacceptable. Negotiate or switch providers.

Practical exercise

Puntos clave