If your team uses ChatGPT, Copilot, Claude or any other AI tool at work, Article 4 of the EU AI Act applies to you. It doesn’t matter how small you are, and it doesn’t matter whether you built the AI or just use it.
It’s also the part of the Act most SMEs have heard about and fewest have acted on. Part of the reason is that the rule changed this summer, and a lot of what’s written online is now out of date.
What Article 4 says
Article 4 has applied since 2 February 2025. It covers providers and deployers of AI systems. A “deployer” is any business that uses an AI system in its operations, so a ten-person accountancy using an AI notetaker is a deployer.
Those businesses have to take measures to support the AI literacy of their staff and anyone else using AI systems on their behalf, such as contractors. The Act defines AI literacy as the skills, knowledge and understanding that let people use AI in an informed way and be aware of the opportunities, the risks and the possible harm.
What changed on 27 July 2026
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It replaced Article 4 with a lighter version.
The old wording asked businesses to take measures “to ensure, to their best extent, a sufficient level of AI literacy.” The new wording drops “sufficient level” and asks them to “take measures to support the development of AI literacy.” The Article also says explicitly that you don’t have to guarantee any particular level of literacy for any individual.
The second change is who else carries the load. Under the new text, the European Commission and Member States must support and facilitate the efforts of providers and deployers, in particular SMEs, and the Commission must publish practical examples of compliance. The European AI Board is to recommend common objectives.
What did not change
The duty is still there. Providers and deployers still have to take measures. The softer wording lowers the bar from “reach a sufficient level” to “show you’re building it”, but it doesn’t remove the obligation, and it doesn’t mean “do nothing” is now acceptable.
It also doesn’t change how it’s enforced. National market surveillance authorities, not the EU’s AI Office, are responsible for Article 4. In Ireland, the government’s Regulation of Artificial Intelligence Bill 2026 proposes a distributed model, with existing sectoral regulators acting as market surveillance authorities and a new AI Office of Ireland coordinating them. That Bill was still a general scheme at the time of writing, so the details of who enforces what, and how, are still being settled.
What this means for an SME in practice
There’s no certificate to buy, and no exam. The European Commission’s own Q&A is clear that training isn’t strictly mandatory and no certification is required. What it expects is that your measures fit your context: who your staff are, what they already know, which AI tools they use, and what those tools are used for. A receptionist using an AI scheduling assistant needs different support from an analyst using AI on customer data.
The practical test is whether you could show a regulator, a client, or an insurer what you did and why it fits your business.
A workable Article 4 setup for a small business
- List the AI tools in use. Include the ones people use without telling anyone. Most businesses find more than they expected.
- Group staff by how they use AI. Casual users, heavy users, and people whose AI use affects customers or employees.
- Match support to each group. A short briefing for casual users. Proper training for heavy users. Role-specific guidance, plus human review rules, where AI touches customers, hiring or money.
- Write a short AI use policy. One or two pages: what’s allowed, what isn’t, what data must never go into a public tool.
- Keep records. Who was trained, when, on what, and which tools it covered. A simple spreadsheet is enough.
- Review it at least once a year, and whenever you add a significant new tool.
Where the “it’s now optional” reading goes wrong
Some commentary since July suggests Article 4 has effectively been dropped. It hasn’t. Three reasons to treat it as live:
The duty on providers and deployers is still in the text. What moved is the standard, not the existence of the obligation.
Clients and insurers don’t wait for regulators. Procurement questionnaires and supplier due diligence already ask how you manage staff use of AI.
AI literacy is also what makes the rest of the Act manageable. The high-risk deadlines have been pushed back (to 2 December 2027 for Annex III systems and 2 August 2028 for those embedded in regulated products), but if you can’t say which AI tools your business uses and who uses them, you can’t assess any of the later obligations either.
What we can’t tell you yet
The Commission is expected to publish practical compliance examples under the new Article 4(2), and the AI Board’s recommendations haven’t yet set common objectives. Until they do, “what is enough?” doesn’t have a precise answer, and anyone telling you otherwise is guessing. Document your reasoning and expect to adjust it.
Where Vekt AI fits in
We run AI literacy training and workshops for SME teams, built around the tools your staff already use and the Article 4 record-keeping you’ll want to have in place. If you’re not sure where your business stands, an AI Act review is a good starting point: a short scoping conversation to map your tools, your people and the gaps.
Sources: Regulation (EU) 2026/1744 on EUR-Lex · Article 4 text · European Commission, AI Literacy Q&A · KPMG Ireland on the Regulation of Artificial Intelligence Bill 2026
