EU AI Act Article 4 Is Now Under Supervision. What the First 48 Hours Mean for SMB Operators.

The EU AI Act's general application date — August 2, 2026 — has passed, and today is the first business day under it. National market surveillance authorities in EU member states have begun their oversight role. For most SMB operators, nothing exploded. That is the right read. But it does not mean nothing changed.

This is not a pundit piece about what will happen. It is an operator readout: what changed operationally on August 2, what employers should verify first, and what "good enough this week" actually looks like.

What Changed on August 2 Versus July 31

Before August 2, Article 4 of the EU AI Act — the AI literacy obligation — had been in effect since February 2, 2025. But "in effect" and "actively supervised" are different things.

From August 2, 2026 — the general application date set by Article 113 of Regulation (EU) 2024/1689 — the broader AI Act framework became applicable, alongside the Article 50 transparency obligations for AI-generated content. That means national market surveillance authorities now have an active mandate to assess whether deployers and providers of AI systems are meeting their obligations under the Act, including the Article 4 literacy requirement.

What did not change: there is no day-one case file opening against every company that uses ChatGPT. Supervision is not a blitz. It is the start of a regulatory regime with durable teeth.

What did change: the question "can you show us your AI literacy process?" now has a formal institutional backstop behind it. If your organization faces a complaint, an audit, or a sector review, the absence of a documented process is no longer just a gap in good practice. It is a gap in a supervised obligation.

The practical shift is not in what you need to have done by August 2. It is in what you need to be able to show from August 2 forward. One thing worth knowing: the high-risk (Annex III) regime did not land on this date — it has been deferred to December 2027. The obligations live for you now are literacy and transparency, not the high-risk conformity regime.

What to Verify First

If your organization uses AI systems in EU operations — or has staff in the EU doing work that involves AI tools — these are the four things worth verifying this week.

System inventory. Can you list the AI tools your organization currently has in active use? This does not need to be exhaustive on day one, but you need a credible, dated record of which systems your teams are using. "ChatGPT Team, Microsoft Copilot for our finance team, and our CRM's AI suggestions" is a real answer. "We don't know" is not.

Role mapping. For each system in that inventory, which roles interact with it? The Article 4 obligation is role-specific — training needs to be appropriate to the employee's job and the AI system they use. A warehouse manager using AI for schedule optimization needs a different literacy baseline than a marketing coordinator using an AI writing assistant. If you cannot describe which roles use which tools, role mapping is your first task.

Internal training record. Can you show what guidance or training those roles received, and when? This does not need to be a formal LMS extract. It needs to be dated, role-specific, and tied to the actual tools. A Slack message thread announcing that ChatGPT was rolled out is not the same as a structured training record. An internal spreadsheet with completion dates and covered material is a start. A proper audit trail with assessment scores and training logs is better.

Audit export path. If someone asked you to produce a compliance summary today, what would you pull? Know the answer before you need it. Your training platform should let you export completion records by role, assignment, and date. If it does not, that is a systems problem worth solving before a formal inquiry prompts you to solve it under pressure.

What Not to Overreact To

The post-August 2 compliance noise will include a lot of advice designed to sell you something expensive and complicated. Before you buy any of it, here is what you can safely deprioritize.

Chasing certificates. No individual AI certification is required by Article 4, and no specific certificate is named in the Commission's FAQ. Role-appropriate literacy is the standard. An employee who completes a structured, role-matched internal training program satisfies the employer's obligation — whether or not they have a badge from an external platform.

One-size-fits-all awareness modules. A single "AI 101" module pushed to your entire organization is not the same as role-appropriate training. The regulation calls out the "level of autonomy" and "nature of the tasks" the AI system performs as factors. Generic awareness does not meet that bar. Role segmentation does.

Assuming vendor content equals employer documentation. When Microsoft ships a Copilot training video with your enterprise license, and an employee watches it, that is vendor marketing. It is not employer-managed evidence of a structured training record. The organization's obligation is not discharged by the vendor's content library. Employer documentation means the employer made a decision about what training was appropriate for which roles and tracked that it happened.

What SMBs Should Finish by Mid-August

The first two weeks of supervision are not about perfection. They are about demonstrating that you have a real process, not a loose collection of passive steps.

If you have not done it already, the priority order is: run a structured baseline assessment by role, assign training appropriate to each role's actual AI tool usage, and produce a report showing who completed it and when. That record — dated, role-specific, exportable — is what converts passive AI usage into defensible organizational evidence.

Most SMBs can stand this up within a week with the right tool. The goal is not a 200-page compliance binder. It is a durable internal record that shows you knew your gaps and addressed them systematically.

That is "good enough this week." Build from there.

Start the Baseline Now

OpenSkills is built for exactly this gap: role-based AI literacy assessment, structured training by job function, and an exportable audit trail — in one platform, at flat SMB pricing.

If your record is thin, or if you are still in the "we sent an email when ChatGPT launched" stage, the baseline assessment is the fastest first step.

Start your AI literacy baseline

Growth plan starts at $9.99/month. 14-day free trial. No compliance add-on required.