When AI Use Goes Wrong
The fine is the company's. The consequences are yours too.
What Is When AI Use Goes Wrong?
When AI is misused at work, the costs land in two places. The organisation faces AI Act fines in three tiers, up to EUR 35 million or 7% of turnover, plus fines under other laws such as the GDPR. The employee faces consequences from their own employer. In this exercise a four-minute hiring shortcut becomes a case: you map each breach to its penalty tier, see what moves the amount, and file the report that improves the outcome.
What You'll Learn in When AI Use Goes Wrong
- Identify the three EU AI Act penalty tiers and the kinds of breach each one covers, including misleading an authority
- Explain that AI Act fines are imposed on organisations, while employees face disciplinary consequences under their employment contract
- Recognise that fines under other laws, such as the GDPR, apply alongside the AI Act rather than instead of it
- Describe how cooperation, self-reporting and limiting harm influence the fine an authority imposes
- Write an incident report that states what happened, which systems and data were involved, and what has been done since
When AI Use Goes Wrong — Training Steps
-
Before Noon
Tuesday at Tallowby Home. You run the central distribution centre, and you have needed a warehouse lead for two months. Leon Farr in recruiting has been busy.
-
The Shortlist
The shortlist opens in RankHire, a recruiting tool Leon is trying out on a free trial.
-
One Click
It is 11:40, and you have a delivery audit at twelve. The shortlist looks sensible: the top candidates have exactly the experience the role needs. So you do what most busy managers would do. You trust the ranking and clear the pile.
-
Three Weeks Later
The warehouse lead started on Monday and is doing well. Then an email arrives from legal: a rejected applicant has questions, and the market surveillance authority has opened an enquiry.
-
The Case File
Ingrid has laid out what legal knows so far. Start with how the case began.
-
What It Could Cost
The review found four problems, and each one falls under a different rule with its own maximum fine. The AI Act groups its breaches by how serious they are. Map each finding to the rule it breaks.
-
How the Numbers Work
Four ceilings, all of them for Tallowby as the operator. None of them is the bill: what the authority actually imposes depends on facts that are still partly in Tallowby's hands.
-
Who Pays
Ingrid's first question on the call is a simple one.
-
And You
Before the call, your manager writes. It is the email you were half expecting.
-
What You Carry
Worth being clear about before you write anything.
Security Framework Coverage
CIS Controls
- CIS 14.4 Train Workforce on Data Handling Best Practices
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
GDPR
- Art. 83 General conditions for imposing administrative fines
- Art. 28 Processor
EU AI Act
- Art. 99 Penalties
- Art. 5 Prohibited AI practices
- Art. 26 Obligations of deployers of high-risk AI systems