![\"\"](\".\/media_1456050df3871c5e9b6593062bd85f64711f1e920.png?width=750&format=png&optimize=medium\")
<\/p>\nBusinesses can no longer rely on simply deploying AI responsibly, they must also prove their people understand how to use it<\/p>\n
<\/p>\n
Nobody reading Computing will need persuading of the growth of AI. Figures reveal 78% of global companies use AI, with 71% deploying GenAI<\/a> in at least one function. And the spread of AI combined with a lack of understanding of basic tech principles is at the heart of regulatory change, with a new concentration from legislators on AI literacy.<\/p>\n As usage rises, so do regulatory expectations. A new and little-discussed provision of the EU AI Act – Article 4 on AI literacy – places a clear obligation on organisations to ensure that all their people (including contractors and suppliers) understand the tools they\u2019re using.<\/p>\n This provision, which came into effect on 2nd February 2025, creates new compliance risks and operational challenges, especially for UK businesses trading in the EU. Whilst regulatory enforcement starts in August 2026, we\u2019re seeing private litigation threatened to enforce literacy obligations.<\/p>\n AI knowledge isn\u2019t just for IT teams<\/p>\n Article 4 states users and those impacted by AI systems must have \u201csufficient AI literacy to make informed decisions.\u201d That doesn\u2019t just mean IT teams, developers or data scientists; it extends to HR staff using AI in hiring, marketing teams using GenAI, and even third-party contractors.<\/p>\n It\u2019s easy for some organisations to assume the AI literacy provisions don\u2019t apply to them simply because they\u2019re not in the tech industry. However, deployers of AI systems are also included. This could catch many organisations that don\u2019t think they are dealing with AI at all.<\/p>\n The European Commission published additional guidance this spring, defining AI literacy as the \u201cskills, knowledge and understanding\u201d needed to use or interact with AI systems responsibly. This includes:<\/p>\n Understanding how AI systems work and data they use; The time has come for businesses to fully get to grips with AI and to train staff to prevent misuse.<\/p>\n Who do the rules apply to?<\/p>\n The scope of Article 4 is broad. It applies to any organisation using AI in the EU, even if they\u2019re based elsewhere. That includes UK businesses deploying AI tools within EU operations or offering AI-enabled services into EU markets.<\/p>\n Crucially, non-compliance doesn\u2019t just affect the tech team. If a customer service chatbot misleads users or a hiring algorithm perpetuates bias the business could be held liable.<\/p>\n As regulators sharpen their focus, the risks associated with Shadow AI are also rising. AI bans just don\u2019t work at best switching AI use to personal devices where the risk of harm may be greater. According to a McKinsey study, 90% of employees use AI and 21% are heavy users. That\u2019s why staff training and clear policies are essential.<\/p>\n There\u2019s a generational risk too. Digital natives are more likely to find the tools they need to do the job via social media or by search. Without proper guidance, this can open organisations up to risk. Including everyone in a well thought out AI literacy programme can reduce misuse and strengthen compliance.<\/p>\n Consequences of non-compliance<\/p>\n The AI literacy obligation came into effect on 2nd February 2025, but enforcement by national authorities across the EU begins from 3rd August 2026. EU Member States will determine their enforcement strategy and level of penalty. The European Commission highlighted that enforcement must be proportionate and based on the individual case. Factors such as gravity, intention, and negligence should be considered.<\/p>\n The European AI Office exists to provide expertise, foster innovation, and coordinate regulatory approaches – but it does not directly enforce Article 4.<\/p>\n Whilst the new EU regulatory regime takes shape currently, the primary risk for organisations not meeting AI literacy requirements is civil action, with various pressure groups actively monitoring AI use. Complaints could also be made to GDPR regulators if the use of personal data is not lawful, fair and reasonable. We\u2019ve seen complaints like this made already against several social media companies and a UK business involved in a popular online dating app<\/a> who used AI for \u2018icebreakers\u2019 in initial introductions1<\/a>.<\/p>\n Practical steps to prepare<\/p>\n All of this shows businesses cannot afford to wait until 2026 to act. National regulators are already developing plans for audits and enforcement. Practical preparation means tackling both governance and culture.<\/p>\n Here are five steps for legal and compliance teams to consider:<\/p>\n Map your AI estate The bigger picture<\/p>\n The introduction of Article 4 marks a clear regulatory shift. Businesses can no longer rely on simply deploying AI responsibly; they must also prove their people understand how to use it. Just as GDPR transformed how organisations handle data, the EU AI Act is reshaping how AI is implemented, monitored, and explained across the workforce. What was once good practice is now a legal obligation.<\/p>\n
\n Recognising risks such as hallucination, discrimination or bias;
\n Knowing when and how to apply human oversight;
\n Being aware of legal obligations under the EU AI Act and other relevant frameworks.<\/p>\n
Conduct a comprehensive audit of AI systems used across your business. Include tools used for decision-making, customer interaction, or generating content\u2014whether built in-house or provided by a third party.
\n Develop and deliver targeted AI literacy training
Training shouldn\u2019t be generic. It must be tailored to users\u2019 roles and risk exposure. For example, HR teams using AI in hiring must understand issues around bias, data protection, and explainability.
\n Review contracts and third-party relationships
If vendors or service providers are using AI systems on your behalf, they may need to meet AI literacy standards too. Ensure these obligations are reflected in contracts.
\n Create internal policies on AI use and governance
Establish clear policies on acceptable AI use, approval processes, and human review. Treat this with the same rigour as data protection or anti-bribery frameworks.
\n Engage the board and embed a culture of responsible AI use
AI is now a board-level issue. Leadership must set expectations around responsible innovation, transparency, and compliance.<\/p>\n