EU AI Act Article 4 AI Literacy: What a 10-Person UK Business Must Do
Article 4 of the EU AI Act says businesses that use AI systems must take measures to support the AI literacy of their staff. For a small team using everyday tools like ChatGPT, that means: know which AI tools you use, tell staff about the risks, give them short training suited to their role, and keep a simple record. No certificate, no AI officer, no specific test.
Last checked: 24 October 2026. Based on the EU AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI, and the European Commission’s AI literacy Q&A. Not legal advice.
What does Article 4 actually say?
Article 4(1) requires “providers and deployers of AI systems” to “take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training and the context the AI is used in. Following the Digital Omnibus on AI, which entered into force in mid-July 2026, the text says this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. (Article 4, European Commission Q&A)
If your business uses AI tools at work, you are a “deployer”. If you build AI products, you are a “provider”.
Does it apply to a UK business?
It can. The Commission says the AI Act applies to organisations outside the EU when the AI system is used in the EU or its use affects people located in the EU, and that this is “also valid for Article 4”. A UK business with staff in the EU, or using AI in work for EU customers, should assume it applies. (European Commission Q&A)
When does it apply?
Article 4 has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026, and the Commission says sanctions must be proportionate.
Does using ChatGPT count?
Yes. The Commission’s Q&A answers this directly: a company whose employees use ChatGPT for writing advertisement text or translating should comply, and staff “should be informed about the specific risks, for example hallucination”.
What should a 10-person business do?
The Commission’s Q&A lists the steps to consider. For a small team:
- List your AI tools. What AI does the business use, and who uses it? Include note-takers and AI features inside tools you already pay for.
- Know your role. Are you only using AI tools (deployer), or building them (provider)?
- Look at the risks. What could go wrong with each tool: wrong answers, personal data going in, training on your content. Check each tool’s data terms on PolicyPeek.
- Train to the role. A 30-60 minute session covering what AI is, your approved tools, what not to paste in and how to check output. People who use AI more heavily may need more.
- Write down the rules. A short AI policy gives the training something to point to. See Do UK small businesses need an AI policy?
- Keep a record. Who was trained, when, and on what.
What don’t you need?
According to the Commission: no certificate (“an internal record of trainings and/or other guiding initiatives” is enough), no obligation to test staff knowledge, and no AI officer or governance board.
FAQ
Does Article 4 apply to small businesses?
Yes. It applies to providers and deployers of AI systems regardless of size, though the Commission and Member States are required to support SMEs in particular.
Is AI training mandatory under Article 4?
There’s no fixed mandatory course. The Commission says there’s no one-size-fits-all format, but relying only on the tool’s instructions is often ineffective, so short role-based training is the usual approach.
Do I need to certify my staff’s AI literacy?
No. The Commission says no certificate is needed; keep an internal record of training and guidance.
When is Article 4 enforced?
It has applied since 2 February 2025; national authorities supervise and enforce it from 2 August 2026.
Last updated . Plain-text version for AI tools: eu-ai-act-article-4-ai-literacy-small-uk-business.md.