Article 4: Your Staff Are Already Required to Understand AI. Most Do Not.

Of all the obligations in the EU AI Act, the one most likely to apply to an ordinary business is also the one nobody talks about. It is not the high-risk regime, which was deferred to December 2027. It is Article 4, it has applied since February 2025, and supervision of it began on 2 August 2026.

Article 4 says that providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf.

Around 22 per cent of UK businesses have provided AI-specific governance training to staff involved in deploying AI. Which means most organisations that are in scope cannot currently demonstrate they have met it.

This article is part of our guide to AI training for UK businesses.

What the duty actually asks

There is no prescribed syllabus, no certificate, no minimum hours and no approved provider list. That is deliberate, and it cuts both ways. It means you cannot buy your way to compliance with a badge. It also means "we did nothing" is not defensible.

What the Act asks you to take account of:

• the technical knowledge, experience, education and training the people already have
• the context in which the AI systems are used
• the people or groups the systems are used on

So the standard is proportionate and relative. A three-person design studio using an image tool needs something very different from a recruitment firm sifting applicants. Both need something.

Who it covers

Wider than employees. "Staff and other persons dealing with the operation and use of AI systems on your behalf" reaches contractors, freelancers, agency staff and outsourced teams.

For businesses that run on contractors, and plenty of UK SMEs do, this is the part worth noticing. The duty follows the work, not the employment contract.

Does it apply to a UK business?

Only if you are in scope of the Act, which requires placing AI on the EU market, output used in the EU, or an EU establishment. The five-question test settles it in ten minutes.

But here is the thing worth saying plainly: of every item on the AI Act list, this is the one to do whether or not it applies to you.

Not out of caution. Because the most common AI incident in a UK business is not regulatory. It is a member of staff pasting confidential client information into a public tool, or sending out a document containing a confidently invented figure. Neither is fixed by a policy. Both are substantially reduced by people understanding what they are using.

What "sufficient" looks like in practice

Four things, scaled to the business.

Everyone who touches an AI tool understands what happens to what they type. Whether it is retained, whether it trains a model, who can see it. This single item prevents most real incidents.

Everyone understands that these systems produce confident wrong answers. Not as a caveat. As a working expectation, with examples from your own business.

Anyone making decisions about people with AI involved understands the additional duties. Human oversight, the right to contest, discrimination risk.

Someone senior can explain the organisation's position. Which tools are approved, why, what the rules are, who decided.

Note that none of these are about how models work. Technical explanation is the most common thing in AI training and the least useful. See why most AI training fails.

The evidence question

If someone asks you to demonstrate compliance, what do you show?

Not certificates. A short record: what you covered, who attended, when, what materials were provided, and how new starters are covered. One page, maintained.

Add to that your AI use policy and your risk register, and you have a defensible position that cost you a day rather than a budget line.

Key Takeaways

• Article 4 has applied since February 2025, with supervision from 2 August 2026. It was not deferred with the high-risk rules.
• There is no prescribed curriculum, which means no certificate buys compliance and no inaction is defensible.
• It covers contractors and freelancers, not just employees. The duty follows the work.
• Around 22 per cent of UK businesses have trained the staff deploying AI, so most in-scope organisations cannot currently evidence compliance.
• Do this whether or not you are in scope. The commonest real incident is confidential data pasted into a public tool, and understanding prevents it where policy does not.

Frequently Asked Questions

What are the penalties for failing the literacy duty?

It sits in the general infringement tier: up to EUR 7.5 million or 1.5 per cent of global annual turnover, whichever is higher. In practice the realistic risk to a small UK business is low. The reason to act is operational, not penal.

Does an online course satisfy it?

It can form part of a response, and on its own it usually does not, because the Act asks you to take account of your specific context and the people affected by your systems. Generic content plus a short session on your own tools and your own rules is a much stronger position than a course completion list.

How often does this need repeating?

Annually is a reasonable rhythm, with an addition to induction for new starters. The tools change faster than that, but the underlying principles do not, and retraining on tools is a different exercise from literacy.

---

Need to put something real in place for staff AI literacy? Talk to Halo Technology Lab. Our support and training service covers sessions built around your tools and your rules, not a generic curriculum.