Article 4 has applied since 2 February 2025, but until 2 August 2026 there was no enforcement machinery behind it. That machinery now exists. The obligation has not changed — what changed is that national market surveillance authorities can act on it. This page covers who is in scope, what “sufficient AI literacy” means in practice, and what evidence stands up when someone asks.
Confusion about Article 4 dates is widespread, and it matters because it changes how exposed an organisation currently is.
The practical consequence is that an organisation which has done nothing since February 2025 has been non-compliant for eighteen months, not newly non-compliant. Remediation now is still worth doing — demonstrating that measures were put in place is materially better than demonstrating nothing — but it should not be presented internally as getting ahead of a deadline that has already passed.
The AI Act applies extraterritorially, so incorporation outside the EU does not remove the obligation. A UK organisation is likely in scope where any of the following is true:
Two points are routinely missed. First, the obligation attaches to deployers as well as providers — you do not need to build AI to be in scope, only to use it. Off-the-shelf tools used for recruitment, customer service, drafting or analysis bring an organisation within Article 4. Second, it covers all staff who deal with AI systems, not only technical teams.
Assess scope against your actual EU footprint. Our Article 4 readiness checker walks through territorial scope, role mapping and evidence gaps in a few minutes.
Article 4 requires reasonable measures to ensure a sufficient level of AI literacy, taking account of staff technical knowledge, experience, education and training, and the context the systems are used in. It deliberately does not specify a curriculum, which is why generic compliance content struggles here: there is no fixed syllabus to certify against, only a reasonableness test.
In practice that means training differentiated by role. The literacy a customer service agent needs to use an AI assistant safely is not the literacy a manager procuring an AI system needs, and neither is what a developer integrating a model needs. A single organisation-wide module fails the test precisely because it ignores the contextual factors the Article requires you to take account of.
Article 4 does not carry a dedicated standalone fine, and claims of a specific multi-million penalty for failing to train staff on AI literacy should be treated with caution. The realistic exposure is indirect and, for that reason, frequently underestimated.
Regulators have signalled that AI literacy failures will be treated as an aggravating factor when enforcing other AI Act obligations, within a regime reaching up to €15 million or 3% of global annual turnover for most obligations. The practical risk is therefore not a fine for Article 4 in isolation. It is that when something goes wrong with an AI system — a discriminatory outcome, a data breach, a wrong automated decision — an organisation that cannot show it trained the people operating that system is in a substantially worse position than one that can.
Add to that the commercial dimension: EU customers increasingly ask about AI Act compliance in procurement, and an inability to evidence Article 4 measures becomes a sales obstacle well before it becomes a regulatory one.
Because Article 4 is a reasonableness test, the evidence file matters as much as the training itself. A defensible position contains:
The written rationale is the item most often omitted and the one that carries the most weight. A regulator assessing reasonableness is assessing a judgement; an organisation that recorded its judgement at the time is in a far stronger position than one reconstructing it afterwards. The system inventory is the second most-missed — and unapproved tools are exactly where the untrained usage sits.
For training providers, Article 4 is also a commercial opportunity in its own right: employers in scope need literacy training that demonstrably satisfies the reasonable measures test, and most still have nothing in place.
No. The AI Act applies extraterritorially based on EU market activity, EU establishment or EU use of AI output, not on where a company is incorporated.
Unlikely on its own. Article 4 requires measures appropriate to the roles and context. Identical generic content for every role ignores the factors the Article directs you to take into account.
Deployers of AI systems are in scope, and general-purpose assistants used in the course of work count. Using off-the-shelf tools rather than building your own does not remove the obligation.
With the system inventory, not the training. You cannot map roles to systems, or evidence reasonableness, until you know what is actually in use — including the tools nobody formally approved.
Role-mapped AI literacy training, attestation records, and an audit-ready evidence pack in one platform.
Book a demo