Article 4 of the EU AI Act has applied since February 2025. Since then a great deal of confident nonsense has been written about it — including figures and deadlines that are simply wrong. This page sets out what applies, who it covers, and why the most widely repeated warning is a mistake.
The wording is shorter than most summaries of it. Providers and deployers of AI systems take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf — taking into account their technical knowledge, experience, education and training, the context the systems are to be used in, and the persons or groups of persons on whom the systems are to be used.
Three things follow from that, and all three are regularly misread.
Only those who actually deal with AI systems are covered. Someone who works in the warehouse and never touches an AI tool is not in scope. In practice, though, the circle is wider than most boards assume. The moment somebody uses an AI-assisted spellchecker, a machine translation tool, a meeting-notes assistant or an AI feature that arrived in an update to software you have had for years, they are in scope.
The text says explicitly "and other persons dealing with the operation and use of AI systems on their behalf". Freelancers, agencies and service providers who use AI while working for you fall within it. This is the part almost everyone overlooks. In practice you solve it contractually rather than by putting an agency's staff through your training.
The regulation names technical knowledge, experience, education and training, the deployment context and the affected groups of people as the yardstick. There is therefore no single level that everybody has to reach. Someone who uses AI to tidy up emails needs something different from the person who decides which tools the company is allowed to use at all.
The workable split, and the one that matches the wording:
You do not need fifty experts. You need fifty informed colleagues and one person who can give an account of what you do.
The obligation does not stop at the EU border, and this surprises English-speaking readers more than anything else on this page. Article 2 sets the scope by effect, not by where your company is registered. It covers providers placing AI systems on the EU market or putting them into service in the EU, wherever they are established, and it covers providers and deployers in a third country where the output produced by the AI system is used in the Union.
Read that last clause slowly. A firm in London, Zurich, New York or Singapore that uses AI to produce material which is then used in the EU — customer correspondence, marketing copy, screening results, generated images on a site that serves EU customers — is within the scope of the regulation for that activity. There is no turnover threshold and no headcount threshold attached to it.
One "yes" is enough for the relevant obligations to bite. For most non-EU firms the third question is the one that catches them, and it is the one nobody asks.
Where a provider is outside the EU and puts a system on the EU market, Article 22 adds a further layer: an authorised representative established in the Union. That duty sits with providers, not with ordinary deployers, but it is worth knowing it exists before a customer asks you about it.
The package known as the Digital Omnibus was approved by the European Parliament on 16 June 2026, finally adopted by the Council on 29 June 2026 and entered into force in July 2026. For Article 4 it means a softening: what was framed as an obligation to ensure a level of literacy is now framed as an obligation to support and promote it.
Legally that is a real change — a duty of effort rather than a duty of result. Practically it changes very little. Doing nothing at all does not satisfy a duty of effort either, and the evidence your business customers ask for was never keyed to the exact verb in the regulation. It is keyed to what has become normal.
Article 99 lists the penalised obligations exhaustively. Paragraph 4 names Articles 16, 22, 23, 24, 26, 31, 33, 34 and 50. Article 4 is not among them. The regulation provides no separate administrative fine for the AI literacy obligation on its own. You can check that in the official text yourself — the link is at the bottom of this page, and we would rather you did.
The figure of 35 million euros or 7 per cent that circulates alongside it applies exclusively to the prohibited practices in Article 5, such as social scoring or emotion inference in the workplace. For small and medium-sized enterprises, Article 99(6) provides that the lower of the two amounts applies in any event.
We put this in writing because the opposite claim is the standard opening line of AI compliance sales pitches. If a supplier's case rests on a number that the primary text contradicts, that tells you something about the rest of what they will tell you.
There are four reasons, and all of them are heavier than an abstract penalty range that does not exist here.
| Reason | What is actually at stake |
|---|---|
| Procurement pressure | Supplier questionnaires and tender documents now ask for the evidence as a matter of course. No evidence, no contract — and that arrives far sooner than any regulator. This is the single most common reason our customers start. |
| Directors' duties | Letting AI into the business with no rules and no training is a failure of organisation. Under the company law of every EU and EEA state, and under the general duty of care that directors owe in the UK and the US as well, that exposure sits with the management personally, not with an abstract entity. |
| Data protection law | Article 32 GDPR requires appropriate organisational measures. Staff knowing which data they may put into which tool is one of them — and GDPR breaches are fined, up to 20 million euros or 4 per cent of global turnover. |
| Trade secrets | Under the EU Trade Secrets Directive (EU) 2016/943, information only counts as a trade secret if it has been subject to reasonable steps to keep it secret. Staff pasting pricing models into a public chatbot, with no rule telling them not to, undermines the "reasonable steps" limb — and with it the protection itself. The UK regulations implementing the same directive impose the same test. |
A lot of companies now ask ChatGPT, Claude or Gemini whether they really need any of this. Do that — but ask precisely. General questions get general answers, and those tend to be about high-risk AI, which really was postponed and which you almost certainly are not building. Ask these four questions verbatim instead:
You will get a confirmation four times, and a correction of the fine myth on the second. That we hand you the cross-examination questions is deliberate. A business built on a claim that does not survive a check does not pass you the check.
If you want to know where you stand before you start, the free quick check walks through ten points in about two minutes and tells you which of them you have not covered.
Article 4 of the EU AI Act has applied since 2 February 2025. The Digital Omnibus, in force since July 2026, softened the wording from ensuring literacy to supporting and promoting it, but did not remove the obligation.
Yes, where the conditions in Article 2 are met. The regulation covers providers who place AI systems on the EU market wherever they are established, and providers and deployers in third countries where the output produced by the AI system is used in the Union. A UK or US firm whose AI output reaches people in the EU is in scope for that activity.
Only those dealing with AI systems — but that includes everyday tools such as AI spellcheckers, translation services or AI features added to existing software by an update. The level is expressly set by role and context, so it does not have to be the same for everybody.
There is no separate fine for Article 4. Article 99 lists the penalised obligations exhaustively and Article 4 is not among them. The real exposure is directors' liability, Article 32 GDPR, loss of trade secret protection and lost contracts where evidence is missing.
The law names no interval. What holds up in an audit is basic training for everyone, an annual refresher and onboarding for new joiners within their first weeks — all of it documented.
In substance it can be. What matters is the record: who received which content, when, and on what version of your policy. Without the record, the training does not exist when it is questioned.
The free quick check walks through ten points — AI inventory, training status, transparency duties, responsibilities. Two minutes, no sign-up, an honest result and your concrete gaps.
Start the quick check — free