Article 4 AI Literacy: The AI Act Rule Already in Force That Most SMEs Ignore

While the headlines have focused on high-risk deadlines being pushed to 2027, one EU AI Act obligation has quietly been in force since February 2025 — and it applies to almost every business that uses AI, whatever your size or sector. It is Article 4, the AI literacy duty. It is not glamorous, it is rarely enforced with fanfare, and it is exactly the kind of obligation that turns into an awkward conversation when a big client or auditor asks how you comply. Here is what it requires and how an SME meets it without hiring anyone.

What is Article 4 AI literacy under the EU AI Act?

Article 4 requires any business that uses AI systems to take measures supporting a sufficient level of AI literacy among its staff and others operating those systems on its behalf. It has applied since 2 February 2025 and covers ordinary AI users, not just AI developers.

In plain terms, the people in your business who use AI tools need to understand enough about them to use them responsibly — what the tool can and cannot do, where it can go wrong, and what the risks are for the people affected by its output. The obligation scales with context: a marketing assistant using a writing tool needs a different level of literacy from an HR manager using an AI shortlisting system. The Act does not prescribe a curriculum; it expects a proportionate effort suited to your uses and your people.

Did the Digital Omnibus change the Article 4 training requirement?

Yes, subtly. The Digital Omnibus reworded Article 4 from a duty to "ensure" a sufficient level of AI literacy to a duty to "take measures supporting" its development. The obligation is softer and more clearly about effort, but it remains fully in force and was not delayed.

This is an important nuance for SMEs. The original wording implied you had to guarantee an outcome — that every staff member actually reached a literacy threshold. The revised wording is about the measures you put in place: training, guidance, documentation. That is a more realistic standard for a small business, but do not mistake softer language for a licence to do nothing. "Took no measures" is still a clear failure, and it is the easiest kind of gap for a client's due-diligence questionnaire to expose.

Who does the AI literacy training requirement apply to?

It applies to any provider or deployer of AI systems — which means virtually every business using AI tools, from ChatGPT to an AI CRM. It covers your own staff and any contractors or agents operating AI systems on your behalf. There is no small-business exemption.

If your team uses AI in its work, you are almost certainly a "deployer" and Article 4 applies. That includes the obvious cases — an AI recruitment screener, an AI customer-service agent — and the less obvious ones, like staff pasting client information into a general chatbot. The duty follows the use of AI, not the building of it, which is why so many SMEs are caught by it without realising.

What counts as AI literacy for employees in practice?

AI literacy means your people understand, at a level proportionate to their role, how the AI tools they use work, what their limitations and risks are, and how to interpret their output. For most SMEs this is achievable with short role-based training and clear written guidance — not a formal course.

A proportionate AI literacy programme for an SME

You do not need an e-learning platform or a certified curriculum. A defensible, proportionate approach for a small business usually contains:

• A short baseline session for all staff: what AI is, where the business uses it, the ground rules (especially around client data), and who to ask when unsure.
• Role-specific guidance for the teams whose AI use carries more risk — HR, finance, anyone handling personal data or customer-facing automation.
• A written AI usage policy that staff acknowledge, so literacy is reinforced by clear do's and don'ts rather than a one-off talk.
• A light-touch refresh when you adopt a new AI tool or when a role's AI use changes materially.

How do I document AI literacy to prove compliance?

Keep simple records: what training you delivered, to whom, when, and the materials used. Log policy acknowledgements and note the AI tools each team uses. This evidence is what satisfies an auditor or an enterprise client's vendor questionnaire — the training itself is only half the job.

Compliance under Article 4 is as much about evidence as activity. A business that trained its staff but kept no record is in almost the same position as one that did nothing, the moment someone asks for proof. Practical records include a dated training log, the slides or guidance you used, signed or timestamped policy acknowledgements, and a short note of which AI tools each function uses. None of this is heavy — but it needs to exist before you need it, not after.

How much does Article 4 compliance cost an SME?

For most SMEs, meeting Article 4 costs very little in cash — mainly staff time to run a short training session and write a policy. The real cost is remembering to do it and keeping records current, which is why many businesses fold it into a low-cost monthly compliance service rather than a one-off project.

The barrier is rarely budget; it is attention. Article 4 is the kind of obligation that is easy to set up and easy to let lapse — new staff join untrained, a new AI tool appears with no guidance, the training log goes stale. That ongoing maintenance is precisely the gap between expensive advisory retainers and self-serve software that our Compliance Guard service is designed to fill: human-led, documented, and kept current month to month.

Frequently asked questions

Is the AI literacy training requirement mandatory for small businesses?

Yes. Article 4 applies to any provider or deployer of AI systems, with no exemption for SMEs. If your business uses AI tools, you must take measures to support AI literacy among the staff who operate them.

What are the AI Act training requirements exactly?

The Act requires proportionate measures to support a sufficient level of AI literacy, judged against how your business uses AI and the roles involved. It does not mandate a specific course; short role-based training plus clear written guidance is generally sufficient for an SME, provided you keep records.

When did the Article 4 AI literacy obligation start?

It has been in force since 2 February 2025. Unlike the high-risk obligations delayed to 2027 and 2028 by the Digital Omnibus, the AI literacy duty was not postponed and applies today.

What is AI literacy for employees supposed to cover?

Employees should understand, proportionately to their role, how the AI tools they use work, their limitations and risks, and how to interpret their output responsibly — with particular attention to handling client and personal data.