EU AI Act Article 4: What SMBs Need in Place — Enforcement Now Active

If your employees use AI tools at work and your company has any EU exposure, Article 4 of the EU AI Act is already part of your compliance picture. The European Commission's public FAQ says the AI literacy obligation has applied since February 2, 2025.

What changes next is the enforcement posture around the broader AI Act: the Act becomes applicable on August 2, 2026, and the Commission says the national market surveillance authorities responsible for Article 4 "start supervising and enforcing the rules as of 2 August 2026". After Regulation (EU) 2026/1744 entered into force on July 27, 2026, Article 4 still applies, but the standard is now framed as documented measures that support AI literacy development, not a guarantee that every individual has reached a specific "sufficient" level.

There is no size exemption. A 12-person SaaS company with one customer in Germany is in scope.

What Article 4 Actually Says

The regulation is concise. As amended by Regulation (EU) 2026/1744, Article 4 now states:

"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf..."

The Commission's FAQ adds an important clarification: this obligation does not require providers or deployers to guarantee any specific level of AI literacy for any individual.

In plain language: anyone who uses AI tools in their job needs employer-managed measures proportionate to their role and the systems they use. Those measures usually include training, guidance, and records that cover:

• How the AI systems they use work at a functional level
• What limitations and risks those systems carry
• How to interpret and act on AI outputs responsibly
• When human oversight is required

A finance team using AI for risk modeling needs deeper training than a marketing team using it for copywriting. But both need documented evidence that the employer put the right measures in place.

What the Digital Omnibus Changed (July 2026)

The Digital Omnibus did not remove Article 4. It changed the wording that employers need to cite and build against.

• The duty still applies to providers and deployers of AI systems.
• The operative phrasing is now about supporting the development of AI literacy.
• The amended article also says employers do not have to guarantee any specific level of AI literacy for any individual.

Who Is in Scope

Any organization that deploys AI systems and has operations, customers, or employees within the EU. That includes:

• SaaS companies with EU customers
• E-commerce businesses shipping to EU addresses
• Companies with remote employees based in EU countries
• Any business using AI tools that affect EU individuals

"Deployer" under the AI Act is broad — it covers anyone using an AI system under their authority, including off-the-shelf tools like ChatGPT or Copilot. If your team uses these tools at work, you are a deployer.

What the Obligation Means in Practice

According to the European Commission's FAQ on AI literacy, AI literacy covers the skills, knowledge, and understanding that allow providers, deployers, and affected persons to make an informed deployment of AI systems and understand their opportunities, risks, and potential harms.

The regulation does not prescribe a specific curriculum. It requires that your measures are proportionate to the role, the AI system, and the risk level. In practice, regulators will look for:

1. Evidence of training delivery or guidance: completion records or other internal records tied to individuals
2. Role-appropriate content: not a one-size-fits-all video, but training matched to what each role actually does with AI
3. Ongoing updates: AI systems change; training that matched your deployment six months ago may not match it now
4. Internal records: the EC FAQ states that organizations need "an internal record of trainings and/or other guiding initiatives" — no formal certification required, but auditable documentation is essential

Why This Matters Operationally

The AI Act includes a penalty framework, but for most SMBs the more immediate problem is not quoting a fine table. It is being unable to show an employer-managed AI literacy process when a customer, investor, regulator, or diligence team asks for evidence.

Enterprise customers are already asking vendors about AI governance and employee AI use in procurement questionnaires. Being unable to demonstrate role-appropriate training and a dated internal record can cost deals before it ever turns into a formal regulatory issue.

US Regulations Are Moving the Same Direction

The EU is not alone. A parallel wave of US mandates is creating similar obligations:

• California Executive Order N-6-26 (May 2026) establishes AI workforce training requirements for state-funded organizations and sets employer obligations around AI literacy
• The Federal AI Training Act (S.2551) ties federal funding, tax incentives, and regulatory relief to demonstrable employee AI training investment
• NYC Local Law 144 and similar laws in Illinois, Maryland, and New Jersey require compliance training for AI used in employment decisions

If you operate in both the US and EU, training that satisfies Article 4 likely covers your US obligations as well.

What SMBs Should Do Now: Article 4 Is in Effect

The remaining window before supervision becomes active is short. Here is what a minimum viable compliance posture looks like:

1. Inventory your AI tools: list every AI system employees use, from ChatGPT to your CRM's AI features
2. Map roles to AI usage: which teams use which tools, and at what risk level
3. Deploy role-based training: each role gets training proportionate to their AI exposure
4. Document everything: completion records, training content versioning, and assessment results need to be auditable
5. Set a review cadence: plan quarterly updates as your AI stack evolves

The EU also provides free support through 251 European Digital Innovation Hubs (EDIHs) across Europe, with 80% offering AI-focused services — a resource worth knowing about if you have EU-based teams.

Why Generic Training Fails Compliance

A single 45-minute webinar for all employees does not meet the proportionality requirement. Article 4 explicitly requires that AI literacy measures account for "the technical knowledge, experience, education and training and the context" of the persons concerned.

That means your engineering team needs different training than your sales team. Your finance analysts using AI for forecasting need different training than your HR team using AI for scheduling.

Role-based, trackable, updatable measures are what a defensible record requires. That is what OpenSkills supports.

How OpenSkills Supports Article 4 Compliance

OpenSkills provides the training infrastructure and documentation that Article 4 requires — purpose-built for SMBs:

• Role-based training paths: content matched to job function and AI exposure level across 6 industry verticals
• Completion tracking: per-employee, per-module records with timestamps — the "internal record of trainings" the EC FAQ describes
• Assessment documentation: scored evaluations that evidence comprehension, not just attendance
• Interactive AI scenarios: 30 role-specific scenarios that build the judgment and risk-awareness Article 4 demands
• Audit-ready exports: CSV export and filterable dashboard for compliance documentation and regulatory inspections
• Certificate generation: verifiable per-employee certificates for completed learning paths

If you need to stand up the core training record now that enforcement is active, start a free trial and begin with the roles that already use AI in day-to-day work.

Sources: Regulation (EU) 2026/1744 on EUR-Lex · European Commission AI Literacy FAQ

Related reading: - EU AI Act Article 4 AI Literacy: What Employers Must Have in Place (Enforcement Now Active) — the full explainer on what the obligation requires and when it applies - How OpenSkills Delivers Defensible EU AI Act Article 4 Compliance — what the training record looks like in practice - AI Employee Training Platform Guide — background on building an AI training program from scratch - Role-Based AI Training for Small Business — the role-based approach that maps directly to Article 4's proportionality requirement

OpenSkills AI is not a law firm and this post does not constitute legal advice. For specific EU AI Act Article 4 compliance questions, consult qualified legal counsel or a compliance consultant familiar with your regulatory environment.