Is your company also in contravention of Article 4 of the EU AI Act?

Is your company in contravention of Article 4 of the EU AI Act?

The high-risk AI deadline with a €35 million price tag has slipped towards 2027. However, the obligation that should worry many SMEs has already been live for over a year.

Article 4 of the EU AI Act requires providers and deployers to ensure that people using AI systems on their behalf have sufficient AI literacy.

Not just AI teams, not just developers, and not just people working with high-risk systems. It covers staff, contractors and others dealing with the operation or use of AI systems on your behalf. It came into force across the EU on 2 February 2025.

The uncomfortable part is that the AI Act does not give companies a neat checklist. There are no required training hours, nor an approved study programme. It says your people must be sufficiently AI-literate, then leaves you to work out what “sufficient” means in your context.

ISACA launched its Advanced in AI Audit certification in 2025, aimed at professionals working across AI governance, risk, operations and controls. It is one sign of a larger shift: AI governance is hardening into a discipline, much like information security did before it.

That shift changes the question. Not “have we run a training session?” but: could you show a client, board or auditor that the people using AI in your business actually understand its risks, limits and responsibilities? For SMEs, that is where the exposure sits. Not in the distant high-risk deadline, but in the everyday use of AI by employees, contractors and managers already drafting outputs, analysing data and handling client information with tools they may barely understand.

If someone asked tomorrow how your business ensures AI literacy, what would you point to, a YouTube video your team may or may not have watched? If it is time to change, our team can help.