EU AI Act Article 4: AI Literacy Training Obligations for UK Employers

Last updated: 15 July 2026

What Is Article 4 of the EU AI Act?

The EU AI Act entered into force on 1 August 2024 with a phased implementation timeline. Article 4 — one of the general provisions that became applicable on 2 February 2025 — requires providers and deployers within the Act’s scope to take measures for sufficient AI literacy. It reads:

“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”

The obligation is notable for what it does and does not prescribe. Article 4 does not mandate a particular course, certificate, number of hours, knowledge test or governance structure. The European Commission’s AI literacy Q&A instead describes a flexible, context-specific approach that considers the organisation’s role, the AI system’s risks, the people’s existing knowledge and the context in which the system is used. Training may be appropriate, but other guidance initiatives can also form part of the measures.

A generic awareness module is therefore neither an automatic safe harbour nor automatically inadequate. Its relevance depends on the systems, roles and risks involved. The Commission also says that no specific certificate is required; an internal record of training or other guidance initiatives is one practical way to retain evidence, not a prescribed compliance process.

Article 4 has applied since 2 February 2025. The Commission says national market surveillance authorities will start supervising and enforcing the rules from 2 August 2026, with enforcement decisions taken by the relevant authorities in each Member State and any sanctions assessed proportionately.

Does It Apply to UK Businesses?

The territorial analysis starts with Article 2 of the AI Act. Relevant routes include providers that place an AI system on the Union market or put one into service in the Union; deployers established or located in the Union; and providers or deployers outside the Union where output produced by their AI system is used in the Union. The Act also identifies other operator roles, including importers, distributors, product manufacturers and authorised representatives.

For a UK organisation, headquarters are not decisive. A UK software company making an AI system available on the Union market may be in scope as a provider. An EU subsidiary using an AI system under its authority may be in scope as a deployer. A UK provider or deployer may also be in scope where its AI system’s output is used in the Union.

However, an EU customer, an EU-resident data subject or the processing of EU personal data does not by itself answer the AI Act territorial-scope question. Organisations should map the facts to the specific Article 2 route: their operator role, where the system is placed or put into service, where the deployer is established or located, and where the AI output is used. Seek legal advice for a fact-specific conclusion rather than treating all EU-facing activity as automatically in scope.

What Compliance Looks Like in Practice

Article 4 does not prescribe a four-step checklist. The following components are a practical way to organise proportionate measures, not fixed legal requirements.

AI system and role mapping. An inventory can help identify which AI systems the organisation provides or deploys and which staff or other people deal with their operation and use. Useful fields include the system, its purpose, its risk context and the roles that interact with it.

Existing knowledge and learning needs. Article 4 says to take account of technical knowledge, experience, education and training, but the Commission says it does not require a formal measurement of employees’ AI knowledge. Organisations can use proportionate methods — such as manager input, interviews, questionnaires or existing competence records — to understand what further support may be useful.

Appropriate literacy measures. Measures can combine training, guidance, system instructions, policies, briefings or supervised practice according to the audience and risk. A customer service team using a chatbot may need different support from a finance team handling AI-assisted decisions. The Commission cautions that merely asking staff to read instructions may be ineffective in many cases, but it does not prescribe one mandatory course format.

Proportionate internal evidence. The Commission says organisations can keep an internal record of training or other guiding initiatives and do not need a specific certificate. Records can help explain what measures were taken and why, but Article 4 does not mandate a particular template, platform, retention period or completion-record workflow.

Risk Categories and Literacy Depth

The AI system’s risk and context are relevant when calibrating literacy measures. The Commission says additional measures may be appropriate where an organisation provides or deploys a high-risk system. Separate provisions can also matter: for example, Article 26 requires deployers of high-risk systems to ensure that people assigned to human oversight have the necessary competence, training and authority.

Lower-risk workplace tools may justify lighter measures, while systems used in consequential contexts can justify deeper, role-specific support. This does not create a fixed training ladder under Article 4. The organisation should be able to explain how the chosen measures reflect its role, the system, the audience’s existing knowledge and the people on whom the system is used.

Building a Compliant Programme: Practical Steps

Our EU AI Act compliance training page covers the evidence pack in more detail, including the written reasonableness rationale that most organisations omit.

For UK employers confirmed to be within scope, a structured sequence can make implementation manageable. It is an operating model, not a legally mandated workflow.

Start by mapping the AI systems and relevant roles. Engage IT, procurement and department heads to surface tools and AI-enabled features that may not be visible to central L&D. This can also reveal unapproved use that needs governance attention.

Next, consider the existing knowledge, experience, education and training of the people who deal with those systems. Segmenting by role family and system type can be more useful than imposing the same assessment or course on the whole workforce.

Choose measures that fit the findings. An organisation might combine baseline awareness, role-specific guidance for active users and deeper support for people responsible for governance or human oversight. These are design options, not minimum layers required by Article 4.

Keep proportionate internal evidence of the reasoning and measures taken. This might include learning materials, guidance, attendance or completion data, policy communications and review notes. No particular certificate, LMS, template or retention schedule is prescribed specifically by Article 4; organisations should set retention in line with applicable law and their wider records policies.

The UK Regulatory Context

Within the UK, the government has adopted a sector-led approach to AI regulation that does not currently include a single cross-economy AI literacy provision equivalent to Article 4. Existing UK law and regulator guidance can still create competence, governance or training expectations in particular contexts. Organisations should assess the ICO’s AI and data-protection guidance and any rules or guidance issued by their sector regulator rather than assuming Article 4 is the only relevant framework.

Where Article 2 scope is confirmed for part of a group, an organisation may choose to apply a consistent literacy approach more widely for operational simplicity. That is an internal governance choice; it does not mean every UK employee or domestic activity is legally within Article 4 merely because the group also has EU operations.