EU AI Act AI literacy: what UK businesses actually need to do

If you're asking whether the EU AI Act AI literacy duty applies to your UK business, the short answer is: only if you place AI systems on the EU market, use them in the EU, or use them in a way that affects people in the EU. If it does apply, Article 4 asks you to take sensible measures so the people using AI on your behalf understand it, and to be able to show what you did. Since July 2026 it no longer asks for a guaranteed "sufficient" level of literacy, and nobody needs a certificate.

That is a smaller obligation than some of the training marketing suggests, and a bigger one than "we're in the UK, it's not our problem". This is the practical version I give UK leadership teams: when it reaches you, what it asks for, what the UK requires instead, and a record you can keep that would stand up if anyone asked. It is not legal advice. If you have EU exposure, check your position with a lawyer who does this work.

A certificate proves someone clicked through a course. A working build proves they understood what the tool does and where it goes wrong.

Brexit didn't take UK companies out of the AI Act's reach. Like GDPR, it follows the market rather than the passport. The European Commission's AI literacy questions and answers put it plainly: the framework applies to actors inside and outside the EU "as long as the AI system is placed on the Union market, used in the Union or its use has an impact on people located in the EU."

The Act's obligations attach to two roles. A provider develops an AI system (or has one developed) and puts it on the market under its own name. A deployer uses an AI system in a professional capacity. Most UK mid-market businesses are deployers: they use Copilot, ChatGPT, Claude or AI features inside their CRM and ERP. Some are also providers without quite realising it, because they've built AI into a product they sell.

In practice, I see four situations where a UK business should assume Article 4 may apply and take advice:

If none of those apply, Article 4 probably doesn't reach you. A York manufacturer with UK customers, UK staff and a Copilot licence is outside it. You may still want a literacy plan for the UK reasons further down, but you aren't doing it for Brussels.

Article 4 has applied since 2 February 2025. As originally written, it required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others dealing with AI systems on their behalf.

That wording changed. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, and the Commission describes the effect on Article 4 as simplifying "the previous AI literacy requirement for companies", with the Commission and member states taking a stronger role in promoting AI literacy. The Commission's AI literacy Q&A now quotes the amended Article 4 as requiring providers and deployers "to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", and adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

So, as amended by the Digital Omnibus, the duty is to take measures, not to hit a standard. I'd be careful about reading that as "do nothing". It is still an obligation. What has gone is the argument about what "sufficient" means.

The Commission's guidance is also clear on three practical points:

Separately, deployers of high-risk systems still have to make sure the people providing human oversight are properly trained. If you use AI in recruitment, credit or similar areas listed in the Act, that's a stronger duty than Article 4 and you should get specific advice.

Enforcement sits with each member state's national market surveillance authorities, not the EU AI Office. The Commission's Q&A says those authorities will "start supervising and enforcing the rules as of 2 August 2026." Any penalties are set nationally, and the Commission says they must be proportionate and take account of factors such as the nature and gravity of the infringement and whether it was intentional or negligent.

My honest read: a regulator is unlikely to open a case against a UK mid-market business solely because its staff training was thin. Where Article 4 is more likely to bite is as part of something else going wrong. An AI system produces a harmful outcome for someone in the EU, a complaint is made, and the first question is what you did to make sure the people running it understood it. That's when a record matters. The other place it shows up is commercial: EU customers increasingly ask suppliers about AI governance in procurement questionnaires, and "we keep a literacy log" is a better answer than "we're UK-based".

The UK has no AI Act and no equivalent of Article 4. There is no UK legal duty to train staff in AI literacy as such.

What there is, for every UK business, is data protection. UK GDPR applies to any personal data your staff put into an AI tool, exactly as it does to an email or a spreadsheet. The ICO's guidance on AI and data protection covers accountability, lawfulness, fairness, security and data minimisation for AI. It is currently marked as under review following the Data (Use and Access) Act 2025, so expect changes, but the principles won't move.

The practical risk I see most is not exotic. It's someone pasting a customer complaint, a payroll export or a disciplinary note into a free consumer chatbot because it was quicker than asking. That's a data protection problem whether or not the AI Act applies to you. Sector regulators (the FCA, for instance) also expect firms to manage AI under their existing rules.

So for a UK-only business, the reason to run a literacy plan is risk and results, not compliance. The good news is that the same plan covers both. If you do it properly for UK GDPR and for productivity, the Article 4 record falls out of it at no extra cost.

This is the plan I'd put in place in a 100 to 500 person business. It takes a few weeks of part-time effort and fits the "take measures" wording comfortably.

The Commission's Q&A suggests the minimum content should cover a general understanding of AI in the organisation, whether the organisation is a provider or deployer, and the risks of the specific systems in use. If you're looking for an AI literacy framework to hang this on, those three headings plus your own rules will do. You don't need a proprietary maturity model.

The record doesn't need to be elaborate. It needs to be specific, kept up to date and believable. This is the format I suggest, one row per person per training activity:

The column most logs leave out is "evidence of understanding". A completion date shows someone sat through something. A line saying what they built, or what decision they can now make, shows the measure worked. If you ever have to explain your approach to an authority or a customer's due diligence team, that column does most of the work.

Keep the log with your data protection records, and make one named person (usually the COO or whoever owns data protection) responsible for it.

Most AI literacy training on sale in the UK is an online module: a few videos, a quiz, a certificate. They're cheap, quick to roll out and easy to log. For a business with genuinely light AI use, that may be enough.

My problem with them is that they produce weak evidence of the thing Article 4 is about. A certificate proves someone clicked through a course. A working build proves they understood what the tool does and where it goes wrong. If a credit controller has built something that drafts chase emails, tested it on real (or realistic) data, seen it invent a payment date that didn't exist, and added a check for it, she understands hallucination better than any quiz question could teach her. And your log can say so.

It also changes behaviour, which a click-through course rarely does. BCG's 2025 AI at Work survey found that regular usage "is sharply higher for employees that receive at least five hours of training and have access to in-person training and coaching." The same research found only around a third of employees say they've been properly trained. In the UK, the ONS reported in July 2026 that only 11% of businesses with ten or more employees said more than half their workforce had received AI-related training.

That's the logic behind the way I run hands-on AI training: groups of up to twelve, at your offices, each person bringing a task from their own job and leaving with a working tool, plus the rules agreed and the attendance, content and builds recorded in a format like the one above. If you'd rather start with free material, I've reviewed what's available in free AI training in the UK. The government courses make good pre-work.

If you've read this far and aren't sure if you're in scope, do two things this month. First, list your AI systems and mark any EU exposure. That takes an afternoon and tells you whether to call a lawyer. Second, write the one-page rules for what goes into which tool. You need that for UK GDPR regardless, and my AI policy template for UK businesses is a starting point you can adapt.

Then train people properly on the tools they actually use, and write down what they learned. If your board wants to understand the wider governance picture, the questions in what boards should ask about AI are a good companion to this. And if the honest answer is that you bought licences and people mostly use them for email, that's a different problem with a different fix.

A reminder that this article is a practical guide, not legal advice: if you sell into the EU, have EU staff or serve EU customers with AI-assisted work, check your position with a lawyer. When you're ready to train the team in a way that leaves you with real evidence and working tools, that's what the hands-on AI training build days are for.

Brannan Coady

Founder of Anyway Ventures. Exited founder, former CEO of YourParkingSpace, investor and board member; now building AI inside PE-backed and mid-market businesses. More →