Applying AI safely and responsibly

The European AI Act is the first law that regulates the use of artificial intelligence within the European Union. The law aims to apply AI safely and responsibly, without unnecessarily slowing down innovation. Yet many organizations have only recently noticed that the AI Act also affects them. That is striking, because part of the obligations has already been in force since 2025. According to Walter, Security Consultant at Nestor Security, this is the prime time for organizations to work on AI policy and awareness. “Many companies think they do little with AI, in practice employees often already use it daily.” 

The AI Act has roughly two main pillars. On the one hand, organizations must invest in AI literacy: employees must have sufficient knowledge to use AI responsibly. On the other hand, AI systems are classified into different risk categories. The greater the impact of an AI system, the more extensive the requirements organizations must meet. In this article, Walter explains which rules already apply, what changes are coming, and which steps organizations can take today. 

AI systems are categorized by risk 

An important starting point of the AI Act is that not every AI application carries the same risk. Therefore, the law distinguishes between different risk categories. Some applications are completely prohibited. This applies, for example, to AI systems that track or assess people in an unauthorized manner. According to the European legislator, such applications pose an unacceptable risk to society. 

In addition, there are high-risk systems. These involve, for example, AI used for decision-making about individuals or systems that process sensitive personal data. Extensive obligations apply to this category. Organizations must be able to explain how an AI system arrives at a decision, carefully map out risks, and implement appropriate control measures. Furthermore, a human always remains ultimately responsible for important decisions. “AI may support, but ultimately an employee must make the final assessment and be able to substantiate why a particular choice was made,” Walter explains. 

For limited-risk AI applications, such as customer service chatbots, the emphasis is primarily on transparency. Users must clearly know that they are communicating with an AI system.  

AI literacy starts with awareness 

A part of the AI Act that, according to Walter, is often underestimated is AI literacy. This obligation has been in effect since February 2025. Organizations must ensure that employees have sufficient knowledge of the technical, societal, social, and ethical aspects of AI. According to him, AI literacy is not just about knowing how a chatbot works. At least as important is that employees learn to look at AI critically. “You constantly have to ask yourself: should I use AI for this, is the output correct, and what risks are associated with it?” After all, AI remains a tool and not a replacement for human responsibility. 

Still, Walter sees that many organizations still pay little attention to this. “I expect that to change in the near future, because regulators can check for this. AI awareness and training therefore form a logical starting point for any organization.” 

Transparency is becoming increasingly important 

The AI Act is being introduced in phases. This gives organizations time to prepare for the various obligations. The transparency obligations will take effect from August 2026. This means that organizations must make it clear in certain situations that AI is being used. This applies, for example, to chatbots that customers communicate with. 

Transparency also plays a role in AI-generated content. When a published text is largely written by AI, this must be stated. If AI is only used for support, such as for inspiration, language checking, or advice, and an employee has reviewed the content and taken responsibility for it, a separate AI disclosure is not mandatory. Additional obligations for high-risk systems will follow at a later date. This gives organizations more time to get their processes, documentation, and risk management in order. 

Insight is the first step 

According to Walter, responsible AI use does not start with complicated procedures, but with insight. Many organizations think that AI is hardly used within their company. In reality, it often turns out that employees are already deploying various AI tools to write texts, generate code, summarize documents, or perform analyses. “You can only make policy once you know what is happening within your organization. That is why we always advise first making an inventory of all AI tools that are being used. Look at which licenses exist, which departments are using AI, and what risks are associated with it.” 

Based on that inventory, AI policies can then be drawn up. In them, organizations define which applications are permitted, which are not, and under what conditions employees may use AI. 

Prevent Shadow IT 

According to Walter, the greatest risk does not lie in AI itself, but in its uncontrolled use. When employees look for AI tools on their own without the organization being aware of it, so-called Shadow IT is created. That is why he advocates not only regulating AI, but also facilitating it. “If you ban certain AI tools, make sure you also provide a good alternative. Otherwise, employees will look for other solutions themselves and you will lose control precisely because of that.” 

An important point of attention in this regard is data handling. Employees must know that confidential company information and personal data should not simply be entered into public AI tools. By combining clear guidelines with training and accessible enterprise licenses, organizations can encourage responsible AI use without slowing down innovation. 

Responsible use actually yields benefits 

According to Walter, the AI Act is not a law intended to discourage organizations from using AI. On the contrary: responsible use of AI can actually make employees more productive and help organizations work more efficiently. “The most dangerous thing is when AI is a blind spot. Employees use it, but the organization has no insight into what is happening. By making AI open for discussion, bringing employees along, and establishing clear agreements, you maintain control and reap the benefits.” 

Precisely for this reason, Nestor Security views the AI Act not only as a compliance issue, but also as an opportunity to help organizations work with AI more securely and consciously. With insight, appropriate policy measures, and sufficient AI literacy, organizations can comply with the law while simultaneously making optimal use of the opportunities that artificial intelligence offers. 

Curious about what the AI Act means for you? Take Contact Oops!