EU AI Act Article 4 AI Literacy: What Your Business Must Do
Article 4 of the EU AI Act requires businesses to ensure their staff have sufficient AI literacy. It has been in force since February 2025 — and yet most SMBs have done nothing. Here is what you actually need to do.
Already in force since February 2, 2025
Unlike the high-risk AI provisions (August 2026), Article 4 AI literacy obligations applied from February 2, 2025. Enforcement rules become fully active from August 3, 2026. If your business uses AI tools and has not yet addressed AI literacy, you are already behind schedule.
What Does Article 4 Actually Say?
Article 4 reads, in its key part:
“Providers and deployers of AI systems shall take measures to ensure, to their best extent possible, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”
— EU AI Act, Article 4
Three things matter here. First, it applies to both providers (companies that build AI systems) and deployers (companies that use AI systems built by others). Second, it uses the phrase “to their best extent possible” — acknowledging that a 10-person startup cannot match a 10,000-person corporation, but both must make genuine effort. Third, it is context-specific: the required literacy level depends on who is using the AI and what they are using it for.
Who Must Comply?
Article 4 applies to any company that is a provider or deployer of an AI system with EU-based operations or that affects EU residents. In practice, this means almost any business that uses AI tools — including off-the-shelf SaaS products with AI features.
Affected employees include:
- Staff who operate AI systems day to day
- Managers who rely on AI outputs for decisions
- IT teams responsible for AI tool deployment
- HR teams using AI-assisted recruitment tools
- Customer service staff using AI chatbots or drafting tools
- Anyone who reviews or approves AI-generated outputs
You are NOT required to train:
- End customers or members of the public
- Staff with no involvement in AI system operation
- Contractors or agencies not using AI on your behalf
What Counts as “Sufficient” AI Literacy?
The Act does not prescribe a specific training programme, a minimum number of hours, or a certification scheme. It requires contextually appropriate understanding. The EU’s guidance suggests that sufficient AI literacy means staff can understand:
What AI is and how it works
A basic conceptual understanding: that AI learns from data, that it can produce incorrect outputs, and that it is not sentient.
How the specific AI system being used works
What inputs it takes, what outputs it produces, what it was designed to do, and any known limitations or failure modes.
When to question or override an AI output
How to spot anomalies, low-confidence outputs, or cases where human judgement should take precedence.
Risks, biases, and potential harms
That AI systems can perpetuate or amplify biases, that outputs can be wrong, and what the consequences of errors might be.
How to use AI responsibly
Data handling, privacy implications, appropriate use cases, and what not to do (e.g. not feeding personal data into consumer-grade AI tools).
For a marketing assistant using an AI copywriting tool, a 30-minute awareness session and a one-page guidance note may be entirely sufficient. For a data scientist operating a high-risk AI model, the bar is considerably higher. The obligation is proportionate.
How to Document Compliance
The EU AI Act does not specify a documentation format, but if an authority asks whether you have met Article 4, you need to be able to show it. A simple documentation approach for SMBs:
Create an AI systems inventory
List every AI tool or system your staff uses: the tool name, what it does, and which teams use it. This does not need to be a complex register — a spreadsheet is fine.
Write a brief AI usage policy
A one- or two-page document describing how AI tools should and should not be used at your organisation, data handling rules, and who to contact with questions.
Deliver a short training session
A 30–60 minute session covering: what AI is, how the tools you use work, risks and limitations, data privacy rules, and when to escalate concerns. Online modules or live sessions both work.
Keep a training record
Record who completed training and when. An email confirmation, a sign-in sheet, or an LMS completion record all count. New starters should complete this before working with AI tools.
Review annually
AI tools and the risks they carry change fast. Schedule an annual review of your AI inventory, your policy, and your training content. Document each review.
Common Mistakes to Avoid
✗ Assuming you are not affected because you only use AI tools built by others
Using a tool makes you a deployer. Article 4 applies to deployers. The fact that you did not build the AI is irrelevant.
✗ Treating AI literacy as a one-off checkbox
New employees, new AI tools, and evolving risks all require ongoing attention. A one-time training session in 2025 does not cover a new AI tool adopted in 2026.
✗ Using a generic AI awareness course with no documentation
Attending a webinar is not the same as having a documented compliance programme. You need records that show who trained whom, when, and on what.
✗ Conflating Article 4 with high-risk AI obligations
Article 4 applies to all companies using any AI, not just those with high-risk systems. Even if your AI systems are minimal-risk, Article 4 still applies.
Not Sure Which Obligations Apply to You?
Our free classifier will tell you your AI system’s risk level and your specific obligations in 5 minutes.
Start Free Assessment