/
Blog
Back to Blog
Analysis

AI Literacy Training: What Article 4 of the EU AI Act Means for UK and North American Companies Selling Into the EU

Abo-Elmakarem ShohoudOctober 24, 20269 min read

This is a practical explainer, not legal advice. Check your own position with a lawyer who knows the AI Act. I read the sources listed at the end in October 2026; this area is moving, so re-check them before you act.

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and of others who use AI on their behalf. It applies from 2 February 2025 and reaches companies outside the EU when the output of their AI is used in the EU. National authorities began supervising and enforcing from 2 August 2026.

Does Article 4 apply to a UK, US, Canadian or Australian company?

It can. Article 2 of Regulation (EU) 2024/1689 covers providers placing AI systems on the EU market wherever they are based. It also covers providers and deployers established in a third country "where the output produced by the AI system is used in the Union". The Commission's AI literacy Q&A says this is also valid for Article 4.

In practice, three groups should pay attention:

  • A US or UK software company with EU customers that ships a product containing AI (a provider).
  • A Canadian or Australian firm that uses AI tools to produce work consumed by EU clients (a deployer whose output is used in the EU).
  • Any company with staff, contractors or subsidiaries located in the EU who use AI at work.

If none of these fits, Article 4 probably does not reach you directly. Your EU customers may still ask you about it in procurement questionnaires.

What is the difference between a provider and a deployer?

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, for payment or free. A deployer is any organisation using an AI system under its authority, except for personal non-professional use. These definitions are in Article 3 of the Regulation.

Most companies are deployers. If your marketing team uses ChatGPT or your analysts use Claude, you are using systems built by someone else. If you build a customer-facing chatbot on top of a model and sell it under your brand, you are probably a provider of that system. Many firms are both. Write down which role applies to each tool, because the Commission asks organisations to consider their role as the first step.

SituationLikely roleArticle 4 applies?
Staff use ChatGPT Business for draftingDeployerYes, if the EU link in Article 2 is met
SaaS product with built-in AI sold to EU customersProviderYes
Internal HR screening tool built in-houseProvider and deployerYes, with extra care on risk
Staff using AI only for personal non-work purposesNeitherNo

Roles can be subtle, especially with fine-tuned or rebranded models. That is a question for counsel.

What does "sufficient level of AI literacy" actually mean?

The original text of Article 4 said providers and deployers must take measures "to their best extent" to ensure "a sufficient level of AI literacy". The Digital Omnibus on AI changed that wording. According to the Commission, the amendments entered into force in mid-July 2026, and Article 4(1) now says the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".

So the duty is to take measures, scaled to the people and the context. The Commission's Q&A is explicit on several points:

  • There is no obligation to measure employees' AI knowledge.
  • No certificate is needed. An internal record of trainings or other guiding initiatives is enough.
  • No specific governance structure, such as an AI officer, is mandated.
  • No strict format is imposed, but asking staff to read the instructions for use "might be ineffective".

The Q&A also gives a direct example: a company whose employees use ChatGPT for advertising copy or translation should inform them about specific risks, for example hallucination. Note that for deployers of high-risk systems, the separate obligation to train staff for human oversight (Article 26) remains.

What should an AI literacy programme cover?

The Commission suggests organisations consider at least four steps: build a general understanding of AI, consider whether you are a provider or deployer, consider the risk of the systems you use, and then build actions around the differences in staff knowledge and the context of use. The Q&A says these should include legal and ethical aspects.

Here is how I would turn that into a programme with three tracks.

TrackAudienceContentFormat
1. FoundationsEveryone who uses AI at workWhat generative AI is, how it fails (hallucination, bias, stale knowledge), approved tools, data rules, when to disclose AI use90-minute live session plus a one-page guide
2. Role-specificMarketing, legal, HR, finance, support, salesReal tasks in the tools your company pays for, with review steps and examples of errors in that functionHalf-day workshop with hands-on exercises
3. Leadership and oversightExecutives, managers, AI system ownersAI Act basics, provider/deployer roles, risk classification, incident handling, vendor questions2-3 hour session

Add a fourth, lighter track for contractors and service providers acting on your behalf. The Commission says "other persons" can include contractors, service providers and even clients, and that people working for a contractor need the appropriate skills for the task, as employees do.

Keep the content tied to your actual systems. A generic video library will not tell staff which tool is approved, what data they may paste in, or who to tell when output looks wrong.

What records should we keep?

Keep an internal, dated record that shows you assessed your situation and acted on it. The Commission says there is no need for a certificate and that organisations can keep an internal record of trainings or other guiding initiatives. Sanctions must be proportionate, and are more likely where an incident can be traced to lack of training.

A workable record set:

  1. AI inventory. Each AI tool or system, its owner, your role (provider or deployer), and a note on risk level.
  2. Needs assessment. Who uses what, and their rough experience level. A short survey is enough.
  3. Programme outline. Tracks, content, dates and who each track is for.
  4. Attendance and materials. Dated attendance lists, slide decks, guides and recordings.
  5. Policies. Your acceptable-use policy and data rules, with the date each person received them.
  6. Refresh log. When content was updated, for example after you adopt a new tool.
  7. Incident log. Problems with AI output and what you changed in training as a result.

Store these where your compliance or legal lead can retrieve them quickly. Because the Commission says copying examples from its living repository of AI literacy practices does not automatically grant presumption of compliance, your own reasoning, documented, matters more than copying someone else's format.

How does enforcement work, and what is the timeline?

Article 4 has applied since 2 February 2025. According to the Commission, supervision and enforcement are handled by national market surveillance authorities, not the AI Office, and they started enforcing on 2 August 2026. Penalties come from national law. The AI Act itself creates no criminal offences and no right to compensation.

DateWhat happened
2 February 2025Article 4 applies
2 August 2025Date by which Member States were due to adopt national penalty laws (per the Commission Q&A)
19 November 2025Commission presents the Digital Omnibus proposal
Mid-July 2026Amended Article 4 enters into force
2 August 2026National supervision and enforcement of Article 4 starts

Which authority would contact you depends on where in the EU your systems are placed or your output is used.

What is the UK's own position?

As far as I can find, the UK has no equivalent statutory AI literacy duty for employers. A Burges Salmon commentary republished by the Society for Computers & Law in September 2024 said the government's AI approach did not include AI literacy specifically. That article is dated, so check current UK government and regulator guidance. A UK company selling into the EU is still covered through Article 2, as described above.

Where Karem fits

I'm Karem, an independent AI consultant and corporate AI trainer based in Cairo. I run live, hands-on sessions on ChatGPT, Claude and workflow automation, and I can build the three tracks above around the tools your company already uses. I am not a lawyer, so I do not give legal advice. I can deliver the training and help you assemble the attendance and materials records your counsel will want to see. The format and rates for UK, US, Canadian and Australian teams are on the remote AI training page.

FAQ

Is a one-off webinar enough for Article 4? The Commission does not set a format or minimum hours. It asks you to take measures that fit your people and context. A single generic webinar may not show that you considered your own tools and risks. A short foundations session plus role-specific practice is easier to defend.

Do we have to test staff or issue certificates? No. The Commission's Q&A says there is no obligation to measure employees' AI knowledge and no need for a certificate. An internal record of training and guidance is enough.

Does the Digital Omnibus mean Article 4 no longer matters? No. Per the Commission, AI literacy remains an obligation for providers and deployers. What changed is that no specific or "sufficient" level is mandated, and the Commission and Member States take on more of the supporting role.

Do our contractors need training too? Article 4 covers "other persons dealing with the operation and use of AI systems" on your behalf. The Commission says contractor staff need the appropriate skills for the task, as employees do. Put this in your contracts and onboarding.

Who enforces this in our case? National market surveillance authorities in the relevant EU Member States, not the AI Office. Which one depends on where your system is placed or its output is used.

Sources

Share this post