On August 2, your obligations under Article 4 of the EU AI Act quietly shifted from "nice to have" to "enforceable." If your business uses AI tools — yes, even just ChatGPT for drafting emails or an AI-powered CRM — you now need to prove your team understands what they're working with.
The good news: this isn't about becoming machine learning engineers. The bad news: a one-hour webinar from six months ago probably won't cut it.
What the AI Literacy Requirement Actually Says
Article 4 is short — just one paragraph. It requires "providers and deployers of AI systems" to take measures ensuring their staff and other persons dealing with AI on their behalf have a "sufficient level of AI literacy." That literacy needs to account for the technical knowledge, experience, education, and context of the people involved, plus the systems they're using.
In plain terms: everyone who touches AI in your business needs to understand what it does, what it can't do, and where the risks are. The level of understanding should match what they're actually doing with it.
A marketing assistant using AI to rewrite social posts needs different training than a hiring manager relying on an AI screening tool. The regulation recognises this — it's not one-size-fits-all.
Who Does This Apply To?
This is where many small business owners relax too early. "We don't build AI, so we're fine," goes the thinking. Wrong.
The AI Act distinguishes between providers (companies that build AI systems) and deployers (companies that use them). Most SMBs are deployers, and Article 4 applies to both.
If your team of five uses Microsoft Copilot, Jasper, HubSpot's AI features, or any SaaS tool with AI baked in, you're a deployer. The European Commission has been clear: the scope is broad by design.
There's a carve-out for purely personal use, but the moment your employees use AI for work tasks — even something as simple as summarising meeting notes — the obligation kicks in.
What "Sufficient AI Literacy" Looks Like in Practice
The regulation doesn't prescribe a specific curriculum or certification. That's both freeing and nerve-wracking, because there's no checkbox to tick.
Based on guidance from national authorities and the EU AI Office, "sufficient" means your staff can do the following.
Understand the basics. They know what AI is, roughly how it works (input, model, output), and that it can make mistakes. They don't confuse it with magic or with a search engine.
Recognise limitations. They know AI can hallucinate facts, carry biases, and produce confident-sounding nonsense. They understand that AI output needs human review, especially for anything customer-facing or consequential.
Know the rules. They're aware that AI use in the EU is regulated, that certain uses are banned outright (like social scoring or manipulative techniques), and that their company has obligations.
Apply it to their role. Staff in different positions understand the specific risks of their AI use. An HR manager knows that AI-assisted hiring is classified as high-risk. A customer service lead knows that chatbot interactions need transparency.
The Penalty Maths
Non-compliance with Article 4 sits in the lower penalty bracket of the AI Act: up to €7.5 million or 1.5% of global annual turnover, whichever is higher.
For a solopreneur doing €200,000 in revenue, that theoretical maximum is €3,000. Annoying, but survivable. For a 50-person SMB doing €10 million, it jumps to €150,000. That stings.
In practice, regulators are unlikely to lead with maximum fines. But they will start somewhere, and companies with zero evidence of AI literacy efforts will be the easiest targets.
Five Steps to Get Compliant This Quarter
You don't need a six-figure consultancy engagement. Here's a practical path.
1. Map your AI footprint. List every AI tool your team uses. Include the obvious ones (ChatGPT, Copilot) and the less obvious ones — AI features inside your CRM, email platform, or accounting software. Most businesses are surprised by how long this list gets.
2. Assess risk levels. For each tool, ask: what decisions does it influence? Customer-facing content? Hiring? Financial forecasts? The higher the stakes, the deeper the literacy needs to go.
3. Build role-specific training. Generic "Introduction to AI" sessions are explicitly not enough, according to guidance from the EU AI Office. Your training should match what each person actually does with AI. A 90-minute workshop per role, covering basics plus role-specific risks, is a reasonable starting point.
4. Document everything. The regulation requires you to "take measures." That means you need evidence. Keep records of what training was delivered, when, to whom, and what it covered. A shared document beats nothing, but a proper training log is better.
5. Make it ongoing. AI tools change fast. Training from January is already outdated if your team has adopted new tools since. Build in a quarterly review — even 30 minutes — to cover new tools and refresh key concepts.
Why This Actually Helps Your Business
Strip away the compliance angle, and AI literacy training is just good business hygiene.
Teams that understand AI's limitations waste less time on bad outputs. They catch errors before those errors reach customers. They use tools more effectively because they know what to ask for and what to double-check.
A recent survey found that 80% of European small businesses will use AI marketing tools by the end of this year. That's a lot of people producing AI-assisted content, running AI-powered campaigns, and making AI-informed decisions. The question isn't whether your team uses AI — it's whether they use it well.
This is where having a clear picture of your AI maturity pays off. Before you can train your team effectively, you need to know where your business stands: which processes already involve AI, which could benefit from it, and where the knowledge gaps are. Tools like Cresly's AI Readiness Scan can map this out in minutes, giving you a solid baseline for your training programme.
Start This Week
The AI Act's literacy requirement sounds daunting, but the bar for SMBs is practical, not academic. You don't need PhDs on staff. You need people who understand what they're using, know the limits, and can spot when something looks off.
Start with the AI footprint map this week. Schedule your first role-specific sessions next month. Document as you go. By the time regulators come knocking — and they will, eventually — you'll have a clear paper trail that shows you took this seriously.
The deadline passed on August 2, but the enforcement ramp-up is gradual. The worst time to start was last month. The second-worst time is next month. Right now is just fine.