AI Literacy and the EU AI Act: What UK Employers Must Do (Article 4 Explained)

If your organisation uses AI at work, and most now do, even if only through everyday tools, there is a piece of European law that may already apply to you. Since 2 February 2025, Article 4 of the EU AI Act has required organisations that provide or deploy AI systems to ensure their staff have a "sufficient level of AI literacy". It is one of the first obligations in the Act to take effect, and it reaches well beyond the EU's borders.

For UK employers, that raises an obvious question: does this apply to us, and if so, what do we actually have to do? This guide gives a plain-English answer. It explains what AI literacy means in law, who is in scope, how the timeline works, and the practical steps you can take to meet the duty and evidence it.

A note on scope: this article is a general guide for UK employers and training providers, not legal advice. The EU AI Act is complex and its application depends on your specific circumstances. If you believe you may be in scope, take advice from a qualified legal adviser before relying on any single interpretation.

What Is AI Literacy?

AI literacy is the combination of skills, knowledge, and understanding that allows people to use AI systems thoughtfully: to deploy them in an informed way, to recognise their opportunities and risks, and to understand the harm they can cause when used carelessly.

The EU AI Act puts that idea into a formal definition. Under the Act, AI literacy means the "skills, knowledge and understanding that allow providers, deployers and affected persons … to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause."

In plain terms, an AI-literate employee is not necessarily a data scientist. They are someone who understands what the AI tools in their role can and cannot do, knows when a human should check the output, and can spot the situations, such as bias, hallucinated facts, data protection, and over-reliance, where AI needs careful handling. AI literacy sits alongside, and depends on, solid foundational digital skills: you cannot use AI tools safely if the underlying digital confidence is not there first.

Article 4: AI Literacy as a Legal Duty

Article 4 of the EU AI Act is short, but its effect is significant. It requires providers and deployers of AI systems to "take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf."

Two points are worth drawing out.

First, the duty falls on both providers (organisations that develop or supply AI systems) and deployers (organisations that use AI systems in the course of their work). Most ordinary employers are deployers: if your teams use an AI assistant, a CV-screening tool, a chatbot, or an AI feature inside everyday software, you are deploying AI.

Second, the standard is proportionate, not absolute. You must take measures "to your best extent" to reach a "sufficient" level of literacy, taking account of your people's technical knowledge, experience, and the context in which the AI is used. The Act does not demand that every employee passes a fixed assessment. It expects you to make a genuine, risk-appropriate effort and to be able to show it.

Helpfully, the obligation also leaves room for judgement. There is no requirement to appoint an AI officer, build a governance board, or measure each employee's literacy to a defined score. But regulators and legal commentators are consistent on one practical point: you should record the training and measures you have put in place, because the ability to evidence your effort is what protects you if you are ever asked.

Does the EU AI Act Apply to UK Businesses?

This is the question most UK leaders ask first, and the answer surprises many. Brexit does not place UK organisations outside the EU AI Act. The Act has deliberate extraterritorial reach.

A UK organisation can be caught if, broadly, any of the following apply:

• It places an AI system or general-purpose AI model on the EU market, or makes it available to users in the EU, regardless of where the company is registered.
• It is a deployer whose use of an AI system produces output that is used in the EU.
• It supplies AI-enabled products or services to EU customers.

In practice, a UK company that sells into the EU, serves EU clients, or operates AI systems whose results land in the EU should assume it may be in scope and check carefully. A purely domestic UK business with no EU touchpoints may fall outside the Act, but even then, AI literacy is fast becoming an expectation of good governance, insurers, and enterprise buyers, not just European regulators.

It is also worth remembering the wider picture. The UK has so far taken a lighter-touch, principles-based approach to AI regulation rather than passing its own equivalent of the EU AI Act. That means many UK employers face the EU's rules through the back door of trade and supply chains, while UK-specific obligations continue to evolve. Treating AI literacy as a baseline now is the safest way to stay ahead of both.

The Compliance Timeline

The EU AI Act applies in phases rather than all at once. The dates that matter most for the literacy duty are:

• 2 February 2025: Article 4's AI literacy obligation, and the ban on certain prohibited AI practices, took effect. The literacy duty is already live.
• 2 August 2025: Obligations for providers of general-purpose AI models began to apply, alongside the Act's governance and penalty architecture.
• 2 August 2026: Supervision and enforcement of the AI literacy rules by national authorities begin, and further obligations phase in.

The headline for employers is simple: the AI literacy duty is not a future problem. It has applied since early 2025, and the supervisory teeth arrive in August 2026. Some of the Act's later, high-risk deadlines have been subject to proposed adjustments as the framework is refined, so it is sensible to track the timeline, but the literacy obligation itself is settled and in force.

What UK Employers Should Do Now

Meeting the AI literacy duty is less daunting than it sounds. It is mostly good workforce practice, documented properly. A practical, proportionate programme looks like this.

1. Map where AI is actually used. Before you can build literacy, you need to know which teams use which AI tools, and for what. A short internal audit usually surfaces far more AI use than leaders expect, often inside tools people do not think of as "AI" at all.

2. Establish a baseline. Measure where your people stand today. A structured AI readiness assessment turns a vague sense of "we should probably do something" into a clear picture of strengths and gaps across roles, so training can be targeted rather than generic.

3. Train to the level of risk. A finance team using AI to triage invoices needs different literacy from a marketing team drafting copy. Tailor the depth of training to how the AI is used and the harm that could follow if it goes wrong. Remember that AI literacy rests on foundational digital skills: if those are shaky, address them first.

4. Cover the essentials for everyone. At minimum, every staff member dealing with AI should understand what the tools do, their limits, when to keep a human in the loop, and the basics of data protection, bias, and verifying outputs.

5. Record what you do. Keep a simple log of the assessments run, the training delivered, who completed it, and when. This evidence trail is what demonstrates you have met the duty "to your best extent", and it is cheap insurance.

6. Refresh it. AI tools and risks change quickly. Treat literacy as an annual cycle, not a one-off tick-box exercise.

How an AI Readiness Assessment Helps

You cannot train a workforce well without first knowing where it stands, and you cannot evidence compliance without a baseline to point to. This is where assessment does double duty.

Digital Skills Assessment offers an AI Readiness assessment (the "AI Practitioner") that measures an individual's AI readiness across five domains, maps the result to a recognised competency profile, and returns a clear breakdown with recommendations. It is adaptive, takes around 20 minutes, and produces a report you can keep on file, exactly the kind of structured, recordable evidence Article 4 rewards.

For an organisation building a literacy programme, that means three things at once: a baseline of where each person stands, a targeted view of where to focus training, and a documented record that the assessment took place. Used across a team, it turns the abstract duty of "sufficient AI literacy" into something you can see, plan around, and prove.

What It Costs

Digital Skills Assessment uses universal credits, where one credit equals one assessment and credits never expire. You can measure AI readiness at whatever scale suits you:

• Individuals: an AI Practitioner readiness check is £9.00 as a one-off, with no account required, a low-friction way to try it or assess a single person.
• Education organisations: the Small Assessor plan is £49.99 per 10 credits (one-off, effective £5.00 per credit); the Medium Assessor plan is £99.99 per month for 75 credits (effective £1.33 per credit); and the Large Assessor plan is £149.99 per month for 200 credits (effective £0.75 per credit).
• Business: Business Basic is £69.99 per month for 20 credits with an insights dashboard and cross-team analytics; Business Ultimate is £199.99 per month for 100 credits.

The same credits also cover Functional Skills (Digital, English, and Maths) assessments, so a single account can address both foundational digital skills and AI readiness. You can try the platform first with a free demo.

The Bigger Picture

It is tempting to read Article 4 as another piece of compliance to file away. That misses the opportunity. The organisations that take AI literacy seriously are not just protecting themselves from a future enforcement risk, they are building a workforce that can actually get value from AI, safely, while their competitors muddle through.

AI adoption is moving faster than most workforces' ability to use it well. A literacy programme grounded in honest assessment closes that gap on both fronts: it satisfies the regulator's expectation of a documented, proportionate effort, and it gives your people the confidence to use AI properly. The duty and the benefit point in the same direction.

If you are starting from scratch, the order is straightforward: confirm whether you are in scope, baseline your workforce, train to the level of risk, and keep the records. For a deeper look at measuring where your people stand, see our AI readiness assessment guide, and for why the foundations come first, our piece on why basic digital skills must come before AI.