If your team uses ChatGPT, Copilot or Gemini, Article 4 of the EU AI Act has applied to you since February 2025. Supervision starts August 3, and combining AI Act, GDPR and civil claims, your real exposure can exceed 4% of annual turnover.
You don't need to develop AI. The literacy obligation applies to anyone who uses AI systems too. That is, essentially any company with a digital footprint today.
A single check makes you a "deployer" under the EU AI Act. And the obligation has been active for several months.
The legal definition is deliberately broad. No size threshold, no exempt sector. Since February 2025, you're already non-compliant if you don't have auditable literacy.
The AEPD is already sanctioning companies for misuse of AI under GDPR, without waiting for the AI Act.
Public cases in HR, healthcare, banking and digital advertising. Real fines between €30,000 and €1.2M. August 3 supervision adds an additional channel — it does not replace the current one.
The simplistic "€7.5M fine" narrative misses reality. Real exposure combines the already-active GDPR regime, the EU AI Act as an aggravating factor in other infractions, and a growing civil-labor-commercial front. The sum is what matters.
The AEPD already sanctions personal data processing with AI systems lacking legitimate basis, adequate information or security measures. Using ChatGPT with customer data is already punishable today.
Non-compliance with Art. 4 amplifies sanctions already applicable (GDPR, sectoral) as an aggravating factor. Spain will publish its own sanction regime under Art. 99(1) in the coming months.
Employee claims for automated evaluations, civil litigation for algorithmic decisions, and above all lost B2B RFPs: increasingly, procurement processes require compliance attestation as a vendor clause.
Indicative model based on GDPR caps, AI Act aggravating factor, and public estimates of litigation and RFPs. Not a substitute for legal advice. Gives a realistic magnitude of what's at stake.
Indicative calculation. GDPR caps per Art. 83 of Regulation (EU) 2016/679. The AI Act aggravating factor is an internal estimate; the specific Spanish sanction regime is pending publication. Civil and RFP figures are market estimates. This calculator does not constitute legal advice.
Designed to arrive at August 3 with auditable training evidence, documented internal policy, and legal co-signing by leading firms. We don't promise guaranteed compliance: we promise a serious program, no shortcuts, with real legal backing.
Companies of 20-80 employees or a specific department that needs to cover the regulatory flank without over-engineering.
Companies of 50-250 employees or SMBs with multiple areas using AI. The sweet spot: full coverage with legal co-signing.
250+ employees, regulated sectors, multi-entity or multi-country. Immediate availability, no waiting, with signed legal opinion.
We arrive at August 3 without diverting the team's time from current projects. Four clear milestones, auditable evidence at each step.
30-minute call to map your current AI use, regulatory exposure and team roles. We come out with a preliminary scope and clear next step.
We adapt content, role-based modules and legal depth to your case. We send a closed proposal with timeline, deliverables and legal partner co-signing.
LMS platform, synchronous sessions, role-based workshops. Every step is logged as auditable evidence: records, assessments and signed policies.
Documentation pack with legal partner co-signing and verifiable individual certificates. What you show an inspector. What a B2B client signs if required.
Fill in the form and we receive it directly at info@centeiaconsulting.com. We reply within 24 business hours with a concrete tier, dates and conditions proposal.
We're not an academy selling generic courses. We're a boutique consultancy with cases in production and partnerships with leading digital-law firms.
Less than 14 weeks remain until supervision starts. Arriving late is not an option: it's an aggravator counted if an inspector comes.