Trustworthy AI in Europe - Time to act (Belgium)

Trustworthy AI in Europe – Time to act

I. Artificial Intelligence: Legal Context, Opportunities and Risks

The AI Act does not provide a definition for “AI”, but defines the term “artificial intelligence system”:

The key functional characteristics that set an AI system apart from other machine-based systems are (i) autonomy, (ii) adaptiveness, and (iii) inference, with the latter serving as the core feature, enabled through machine learning or knowledge-based methods.

Examples of AI applications which your company might already be using : personalized recommendations programs based on previous searches, purchases or (online) behaviour; energy-efficient smart systems; optimized products via text mining, speech or image recognition; machine learning for data analysis; logistics improvements via AI based software robotic process automation, etc.

By enhancing predictive accuracy, optimizing operations, and enabling personalized digital services, AI provides substantial competitive advantages across industries. At the same time, AI poses potential risks to fundamental rights and public interests, particularly due to its complexity and lack of transparency. Decisions made by AI systems can be difficult to challenge, raising accountability concerns.

II. AI by the Numbers: Adoption Trends Across Europe

In Belgium, AI adoption by companies grew rapidly from 13.81% in 2023 to 24.71% in 2024, with usage expected to rise further in 2025. In the EU, AI was used in 2024 by 11.21% of small enterprises, 20.97% of medium-sized enterprises, and 41.17% of large enterprises—differences largely driven by implementation complexity, cost, and economies of scale. Sector-specific, the manufacturing and retail sector uses AI mainly for its marketing & sales, while the information and communication sector is using AI for R&D purposes.

III. Who’s in Scope? Navigating the AI Act’s Reach

Obligations can be imposed on six categories of economic actors: providers, importers, distributors, product manufacturers, authorised representatives and deployers. Most responsibilities lie with the provider, and next with the deployer. The AI Act establishes various obligations and responsibilities for the different actors in the AI value chain. Most companies will qualify as deployer - those using AI systems in a professional capacity under their authority, or as provider - when developing AI systems from scratch or based on an existing AI model.

Generally speaking, and subject to some exceptions, the AI Act applies to all AI systems that are put on the EU market or put into service on the EU market. Given its extra-territorial scope, also companies based outside the EU are affected if they place on the market or putt into service AI systems or place on the market general-purpose AI (“GPAI”)models in the EU.

AI systems that are exclusively designed for military, defense or national security purposes are exempt for the AI Act, regardless of the type of entity carrying out those activities. Research, development and prototyping activities that take place before an AI system is released on the market are also not subject to the AI Act.

IV. Risk-Based Rules: What Category Fits Your AI?

The AI Act is a product-centric regulation which adopts a risk-based approach, categorizing AI systems into four main risk levels, with obligations increasing based on the level of risk. The higher the risk, the stricter the requirements.
1. Unacceptable Risk : These AI systems are banned due to significant threats to health, safety, or fundamental rights. Prohibited practices include: (i) harmful AI-based manipulation and deception, (ii) harmful AI-based exploitation of vulnerabilities, (iii) social scoring, (iv) Individual criminal offence risk assessment or prediction, (v) untargeted scraping of the internet or CCTV material to create or expand facial recognition databases; (vi) emotion recognition in workplaces and education institutions; (vii) biometric categorisation to deduce certain protected characteristics and (viii) real-time remote biometric identification for law enforcement purposes in publicly accessible spaces.
2. High Risk: These AI systems pose serious risks and are therefore heavily regulated. Examples include: AI systems used in critical infrastructure, education, employment, justice, law enforcement, migration, and access to essential services.
a. Providers must meet strict requirements: risk management, data quality, documentation, human oversight, robustness, cybersecurity, accuracy and transparency.
b. Systems must be registered in an EU database and monitored throughout their lifecycle.
c. Red teaming (simulated attacks) and ongoing logging and oversight are encouraged to identify and mitigate vulnerabilities.
3. Transparency Risk: To avoid the risk of deception, the AI systems in this category (e.g., chatbots, deepfakes) must comply with transparency obligations: Users must be informed they are interacting with AI.
4. Minimal or No Risk: Most current AI applications (e.g., spam filters, AI in games) fall into this category. These systems are not regulated, but transparency is encouraged.

GPAI Models: Separate rules apply to versatile models like ChatGPT, Gemini, CoPilot . Developers must document development and testing, publish summaries of copyrighted data used for training, share relevant information with users, comply with transparency and copyright rules and must design the AI system preventing it of the generation of illegal content. By 2 August 2025, the obligations and penalties related to GPAI models become applicable.

V. Regulation Meets Innovation: A Safe Space for AI Development

Despite the AI Act’s regulatory nature, Chapter VI emphasizes fostering innovation, particularly for start-ups, SMEs, and research institutions. The chapter introduces mechanisms to promote responsible AI development without stifling technological progress.
 Via AI regulatory sandboxes, Belgium will have to establish controlled environments where organizations can develop, test, and validate AI systems in real-world conditions under regulatory supervision. This is meant to encourage innovation in a safe and legally compliant setting, allow temporary exemptions from certain obligations to facilitate experimentation and help authorities and developers understand how rules apply in practice. In Belgium, there is currently no national AI regulatory sandbox operational.
 Support to SMEs and start-ups: The AI Act calls for simplified procedures and technical guidance to help smaller companies comply with the rules, ensuring they are not left behind due to limited resources.
 Open Innovation and Collaboration: Chapter VI encourages cooperation between businesses, academia, and public institutions to share knowledge and improve the development and deployment of trustworthy AI.

VI. The AI Act in a Wider Legal Web

Save to say that focusing solely on the AI Act might be insufficient for full legal compliance in the use of AI technologies. When developing or using AI systems, you might need to take into account other legal frameworks, including GDPR, consumer protection laws, IP regulations, NIS-II (cybersecurity for critical infrastructure), Cyber Resilience Act, Digital Markets Act, and/or the Digital Services Act. For instance, AI systems might involve large-scale personal data processing, raising GDPR compliance challenges—particularly regarding human oversight and the rights of individuals not to be subject to solely automated decisions.

Moreover, the AI Act forms part of a broader EU strategy for trustworthy AI, which includes complementary initiatives such as the AI Innovation Package, AI Factories, and the Coordinated Plan on AI.

VII. The Cost of Non-Compliance: Penalties You Can’t Ignore

The AI Act introduces a tiered penalty system, similar to the GDPR, but with higher maximum (administrative) fines. Penalties vary based on the severity of the violation and the size of the entity, with lower fines for SMEs.

Key Penalty Tiers for undertakings:
 Non-compliance with prohibited AI practices: administrative fines up to €35 million or 7% of total worldwide annual turnover (whichever is higher).
 Non-compliance with specific provisions (e.g. relating to high-risk AI systems, providers of GPAI): Up to €15 million or 3% of worldwide annual turnover (whichever is higher).
 Providing incorrect, incomplete or misleading information to authorities: Up to €7.5 million or 1% of worldwide annual turnover (whichever is higher).

Note that fines could be accumulated if the violation also involves personal data (e.g. accumulation with GDPR non-compliance fines up to €20 million or 4% of worldwide annual turnover (whichever is higher)).

VIII. Who’s Liable When AI Fails?

AI systems can make or recommend decisions with ethical and legal implications. Identifying who is responsible for these decisions and ensuring transparency and accountability could present significant challenges. The AI Act itself sets safety and compliance standards for AI systems but does not directly govern civil liability for harm caused by any defective AI. This will still primarily be governed by existing local Belgian and/or EU laws such as:
 Product Liability: Under the Belgian Civil Code (Articles 6.41 to 6.53), manufacturers can be held liable for damages caused by defective AI system products. Under the new EU Product Liability Directive (coming into force on 9 December 2026), AI software qualifies as a “product”, even if not tied to physical goods. This means AI developers and producers can be held responsible for damages caused by defective software-only AI systems.
 Consumer Protection: Belgian law (inter alia Book III, Title VIbis of the Belgian Civil Code regarding conformity of digital content or services and the Belgian Code of Economic Law) provide warranty rights and remedies for defective AI systems.
 Data Breaches: If a defective AI system causes data protection violations, affected data subjects may seek compensation under the GDPR.
 Critical Infrastructure AI: AI systems used in critical infrastructure fall under Directive (EU) 2022/2557. Malfunctions in such systems may lead to large-scale risks to public safety and disruption of essential services. Belgium has not yet transposed this directive (although deadline: 17 October 2024).
 User’s extra-contractual liability (art. 6.16 Belgian Civil Code) or user’s contractual liability (Article 5.230 of the Belgian Civil Code) if AI system is incorporated in a tangible good.

IX. Your Compliance Roadmap: Some Practical Steps to Get AI-Ready

The AI Act will be applicable as from 2 August 2026, with some exceptions such as the prohibitions and AI literacy obligations which already entered into application from 2 February 2025. It goes without saying that it's best not to wait until August 2, 2026 .

1. Determine Your Role and Responsibilities
• Assess whether your company, suppliers, or customers fall within the material and territorial scope of the AI Act.
• Identify whether any AI systems or models used fall under the regulated categories
• Determine your role in the AI chain (provider, deployer, etc.) and the associated legal obligations.

2. Risk Assessment and Human Oversight
• Evaluate the risk level of your AI systems.
• Implement functioning human oversight mechanisms to avoid automation bias, monitor performance, ensure traceability, and document decisions.

3. AI Literacy
• Assess the current level of knowledge of your employees
• Develop a modular and tailored training program
• Use clear, accessible formats (e.g., e-learning, workshops) and avoid legal jargon.
• Update training regularly to reflect AI advancements.
• Document all training efforts to demonstrate compliance.
4. Post-Market Obligations (if applicable)
• Establish monitoring systems for AI systems after deployment.
• Report serious incidents and malfunctions to relevant authorities.
• Ensure ongoing compliance and accountability through internal oversight.

5. Further coordination
• Align with GDPR, consumer protection, product liability, cybersecurity laws, and other relevant EU regulations.
• Keep up to date, incl. on additional guidelines (especially regarding GPAI models) and the Code of Practice from the European Commission and EU AI Office (expected by August 2025).
• Consider AI insurance options to mitigate potential risks and liabilities.

Key contact in Belgium

News items made available on act legal’s social media or website are intended for general informational purposes only and do not constitute legal advice. Although every effort has been made to ensure accuracy, they may not reflect the most recent legal developments.

15 May 2025