AI literacy is mandatory: what Article 4 requires

There's a good chance your company already uses AI: ChatGPT for drafting text, an AI feature in your accounting software, a chatbot on your website, or a recruitment tool that screens CVs. What many small and medium business owners don't realize is that since 2 February 2025, you are legally required to ensure "sufficient AI literacy" among everyone who works with those systems. This is set out in Article 4 of the EU AI Act, and it applies to nearly every organization that uses or provides AI, regardless of size.

The problem isn't that the rule is unreasonable. The problem is that almost nobody in the SME world knows this obligation exists, let alone what it concretely requires. There's no certificate to obtain and no inspector who shows up for an audit. Yet the obligation is there, and "I didn't know" is not a strong defense if something ever goes wrong with an AI application in your business.

This article covers what Article 4 literally says, what it means in practice for a small or medium business, how to approach compliance with a clear plan, what it roughly costs, and why you should treat this seriously without panicking.

What does Article 4 of the AI Act actually say?

The literal text of Article 4 reads:

Two things stand out. First, the obligation applies to both "providers" (companies that build or place AI systems on the market) and "deployers" (companies that use AI systems in their own operations, which is most SMEs). Second, the standard is relative: "to their best extent" and "sufficient" given the context. There's no fixed number of training hours or a mandatory exam prescribed.

This obligation has been in force since 2 February 2025, while many other parts of the AI Act take effect later. That makes Article 4 one of the first concrete obligations businesses face right now.

Who does this apply to?

In practice, the obligation applies to nearly any business with staff using AI tools: from a marketing agency having text drafted by a language model, to a manufacturing company with an AI-driven quality control system. The size of your business doesn't determine whether the obligation applies, but it does affect how substantial your compliance effort needs to be.

What does this concretely mean for your organization?

The desired level of AI literacy depends heavily on an employee's role and the context in which AI is used. Not everyone needs to know the same things. But everyone working with AI should at minimum understand what the system does, where the risks lie, and when a human check is needed.

A practical first step is an inventory: which AI systems does your business actually already use, and who works with them? Many companies discover AI is already in use through SaaS tools (CRM, HR software, marketing automation) without anyone having identified it as an "AI system."

Roles and the corresponding literacy level

This table is a starting point, not an exhaustive standard; the law itself doesn't prescribe exact content per role. If you're unsure about a specific situation, it's wise to consult an advisor.

How do you approach this practically?

You don't need to set up a compliance department. For most SMEs, a pragmatic step-by-step approach is enough:

1. Take inventory. List all AI tools used in your business, including tools "hidden" inside existing software (smart email filters, recommendation algorithms, AI writing assistants).
2. Assess the risk level per tool. A spell-checker is different from a tool that screens job applicants. The higher the risk to people, the higher the literacy requirements.
3. Map roles to knowledge level. Use a table like the one above to determine who needs to know what.
4. Organize basic training. This doesn't need to be an expensive course: a structured internal session of a few hours, supplemented with existing (often free) e-learning, can cover a lot of ground.
5. Document what you do. Record which training was given, to whom, and when. This is your evidence trail if questions ever arise.
6. Repeat periodically. AI tools and risks change; plan an annual update, for example.

Free and paid resources exist to get started, including national e-learning courses on AI and AI ethics originally developed for government staff but also usable by businesses. Data protection authorities in several EU member states have also published practical guidance on building AI literacy.

What does this roughly cost? For a small SME (5-30 employees) with a limited number of AI applications, a realistic investment for a basic approach ranges between roughly €1,500 and €5,000 per year. This typically covers:

• An external or internal workshop/training session of half a day to a full day for the team
• Time from a responsible person (often management or HR) to set up the inventory and documentation, estimated at 8-16 hours
• Optional use of existing online courses or e-learning, often a few hundred euros per license or free via government platforms

For companies that use AI more intensively or develop AI systems themselves, the investment can be higher, especially if technical documentation and risk assessments per system are also needed. These figures are indicative; actual costs depend heavily on how many AI systems you use and how mature your organization already is in this area.

When this doesn't have to be your top priority (yet)

Here's the honest nuance many legal sources skip: Article 4, as far as is currently known, doesn't carry its own specific fine provision within the AI Act, unlike, for example, the prohibited AI practices under Article 5. That doesn't mean the obligation is optional, but it does mean the direct enforcement pressure on this specific article is currently less sharp than for provisions with explicit sanctions.

In addition, codes of practice that would give organizations more concrete guidance are only expected toward the end of 2025 according to the European Commission, and a formal evaluation of their effectiveness only starts from 2028. For a small SME without high-risk AI applications, this means a thorough, expensive compliance exercise probably doesn't need to be the very first priority.

What is sensible: put a basic foundation in place (inventory, a training session, some documentation) so you can demonstrate you're taking the obligation seriously. That's both legally prudent and practically useful, since literate staff simply make fewer mistakes with AI.

How UnifyAI can help

Setting up AI literacy is easier once you know which AI applications are relevant to your business and where the risks sit. Our AI advisor helps you build the initial inventory and a practical step-by-step plan tailored to your sector and team. Want to first understand where your AI opportunities and risks lie? Try the free AI scan or see what our AI consultancy can do for you when responsibly rolling out AI agents within your organization.

Have specific questions about your situation, or just want to talk it through without obligation? Get in touch and we'll think it through with you.

Frequently asked questions

Do I need to comply with Article 4 as a sole trader?

Article 4 targets organizations that provide or use AI systems and have staff or "other persons" working with them. As a sole trader without employees, the direct obligation is lighter, but if you hire freelancers who work with AI tools on behalf of your business, it's wise to consider this too.

Is there a fine if I do nothing about AI literacy?

As far as is currently known, Article 4 doesn't have its own explicit fine provision in the AI Act, unlike the prohibited practices under Article 5. This doesn't mean the obligation is optional; if in doubt about your specific risk, seek legal advice.

Do I need to obtain an official certificate to comply?

No, the law doesn't prescribe a mandatory certificate or exam. It's about a "sufficient level" of knowledge appropriate to the role and context, demonstrated through documentation of what you've done.

Does this also apply if I only use off-the-shelf tools like ChatGPT or Copilot, and don't build my own AI?

Yes. As a "deployer," you also fall under Article 4, even if you only use existing third-party AI tools.

Where can I find reliable, free training materials?

Several national and EU-level free e-learning courses on AI and AI ethics, originally developed for government staff, are also usable by SME employees. National data protection authorities have also published practical guidance on getting started.