EU AI Act Article 4: What SMBs Must Do Before August 2, 2026

If your employees use AI tools at work and your company has any EU exposure, enforcement of a new compliance obligation begins on August 2, 2026. Article 4 of the EU AI Act requires every organization — regardless of size — to ensure sufficient AI literacy among staff who operate or use AI systems.

The obligation itself has been in force since February 2, 2025. What changes on August 2 is that national market surveillance authorities begin enforcing it, with penalties attached.

There is no size exemption. A 12-person SaaS company with one customer in Germany is in scope.

What Article 4 Actually Says

The regulation is concise. Article 4 states:

"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used."

In plain language: anyone who uses AI tools in their job needs training proportionate to their role and the systems they use. That training must cover:

• How the AI systems they use work at a functional level
• What limitations and risks those systems carry
• How to interpret and act on AI outputs responsibly
• When human oversight is required

A finance team using AI for risk modeling needs deeper training than a marketing team using it for copywriting. But both need documented evidence that the training happened.

Who Is in Scope

Any organization that deploys AI systems and has operations, customers, or employees within the EU. That includes:

• SaaS companies with EU customers
• E-commerce businesses shipping to EU addresses
• Companies with remote employees based in EU countries
• Any business using AI tools that affect EU individuals

"Deployer" under the AI Act is broad — it covers anyone using an AI system under their authority, including off-the-shelf tools like ChatGPT or Copilot. If your team uses these tools at work, you are a deployer.

What "Sufficient AI Literacy" Means in Practice

According to the European Commission's FAQ on AI literacy, sufficient AI literacy means "skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems" and understand their opportunities, risks, and potential harms.

The regulation does not prescribe a specific curriculum. It requires that training is proportionate to the role, the AI system, and the risk level. In practice, regulators will look for:

1. Evidence of training delivery: completion records tied to individuals
2. Role-appropriate content: not a one-size-fits-all video, but training matched to what each role actually does with AI
3. Ongoing updates: AI systems change; training that was sufficient six months ago may not be now
4. Internal records: the EC FAQ states that organizations need "an internal record of trainings and/or other guiding initiatives" — no formal certification required, but auditable documentation is essential

The Penalty Structure

Article 4 violations fall under the AI Act's general penalty framework (Article 99). Fines can reach up to €15 million or 3% of global annual turnover, whichever is higher. For SMEs, the regulation caps fines at the lower of the applicable thresholds — percentage or absolute amount — providing some proportionality.

But fines are not the only risk. Enterprise customers are already asking vendors about AI Act compliance in procurement questionnaires. Being unable to demonstrate employee AI literacy will cost deals before it costs fines.

US Regulations Are Moving the Same Direction

The EU is not alone. A parallel wave of US mandates is creating similar obligations:

• California Executive Order N-6-26 (May 2026) establishes AI workforce training requirements for state-funded organizations and sets employer obligations around AI literacy
• The Federal AI Training Act (S.2551) ties federal funding, tax incentives, and regulatory relief to demonstrable employee AI training investment
• NYC Local Law 144 and similar laws in Illinois, Maryland, and New Jersey require compliance training for AI used in employment decisions

If you operate in both the US and EU, training that satisfies Article 4 likely covers your US obligations as well.

What SMBs Should Do Before August 2

The enforcement date is weeks away. Here is what a minimum viable compliance posture looks like:

1. Inventory your AI tools: list every AI system employees use, from ChatGPT to your CRM's AI features
2. Map roles to AI usage: which teams use which tools, and at what risk level
3. Deploy role-based training: each role gets training proportionate to their AI exposure
4. Document everything: completion records, training content versioning, and assessment results need to be auditable
5. Set a review cadence: plan quarterly updates as your AI stack evolves

The EU also provides free support through 251 European Digital Innovation Hubs (EDIHs) across Europe, with 80% offering AI-focused services — a resource worth knowing about if you have EU-based teams.

Why Generic Training Fails Compliance

A single 45-minute webinar for all employees does not meet the proportionality requirement. Article 4 explicitly requires that AI literacy measures account for "the technical knowledge, experience, education and training and the context" of the persons concerned.

That means your engineering team needs different training than your sales team. Your finance analysts using AI for forecasting need different training than your HR team using AI for scheduling.

Role-based, trackable, updatable training is what compliance requires. That is what OpenSkills provides.

How OpenSkills Supports Article 4 Compliance

OpenSkills provides the training infrastructure and documentation that Article 4 requires — purpose-built for SMBs:

• Role-based training paths: content matched to job function and AI exposure level across 6 industry verticals
• Completion tracking: per-employee, per-module records with timestamps — the "internal record of trainings" the EC FAQ describes
• Assessment documentation: scored evaluations that evidence comprehension, not just attendance
• Interactive AI scenarios: 30 role-specific scenarios that build the judgment and risk-awareness Article 4 demands
• Audit-ready exports: CSV export and filterable dashboard for compliance documentation and regulatory inspections
• Certificate generation: verifiable per-employee certificates for completed learning paths

If you need to demonstrate Article 4 readiness before August 2, start a 14-day free trial and deploy role-based AI literacy training to your team this week. No credit card required.

Sources: EU AI Act Article 4 · European Commission AI Literacy FAQ · EU AI Act Article 99 — Fines

For background on building an AI training program from scratch, read AI Employee Training Platform Guide. For the role-based approach that maps directly to Article 4's proportionality requirement, see Role-Based AI Training for Small Business.

OpenSkills AI is not a law firm and this post does not constitute legal advice. For specific EU AI Act Article 4 compliance questions, consult qualified legal counsel or a compliance consultant familiar with your regulatory environment.