AI literacy: the EU AI Act duty most small businesses do not know about
Article 4 of the EU AI Act is live law since 2025 — and most companies are not compliant. What to do this week to get it right.
What changed this week
On 12 October the European Commission published a draft implementing regulation — reference Ares(2026)9589403 — describing how the European AI Office will investigate infringements and impose fines under the AI Act. The public consultation is open until 9 November 2026, 11:59 p.m. Brussels time. The news is fresh, but the most important part is not in the draft: it is in what has already been live law for over a year. A week earlier, on 5 October, the Commission’s Executive Vice-President Henna Virkkunen answered questions in the European Parliament about the mandate of the European AI Office: she clarified that it acts within the competences defined in Article 64 of the AI Act and that day-to-day supervision belongs to the national market surveillance authorities — the ones that, since 2 August 2026, hold formal enforcement powers. It is within this framework that the obligation most small businesses ignore lives: Article 4’s AI literacy duty, applicable since 2 February 2025. According to a Delbion analysis cited by the AI Buzz guide of 12 October, most European companies do not even know it exists. It is not a recommendation or a best practice: it is a legal obligation already in force — and, since August, with active supervision behind it. This article explains what the law requires in practice, what the October draft adds, and what a small business should do this week.
What AI literacy (Article 4) is
Article 4 of Regulation (EU) 2024/1689 requires providers and professional users of AI systems to take measures to ensure, “to their best extent”, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. The legal definition, in Article 3(56), is simple: the skills, knowledge and understanding that allow informed decisions about the deployment of AI systems, while being aware of the opportunities, risks and potential harm AI can cause. Three details widen the scope more than it first appears. First: the duty covers all AI systems, not only the high-risk ones in Annex III. Anyone using a text generator to draft proposals, a customer-service tool or an invoice reader is in scope — even if they never deliberately bought an “AI system”. Second: “other persons dealing … on their behalf” includes service providers, freelancers and consultants who operate the systems for you. If your accountant uses AI to process your invoices or your agency generates your copy with AI, those people’s literacy is your responsibility to the extent they act on your behalf. Third: there is no fixed curriculum, no minimum number of hours and no mandatory certification. The regulation requires proportionality — measures calibrated to each person’s technical knowledge, experience and training, to the context of use and to the people affected. Flexibility, yes; but with the burden of proof on your side: before an authority, you will have to show that the measures were appropriate to your systems’ risks and to the roles of the people who use them.
What “sufficient level” means in practice
“Sufficient” is deliberately vague in the law — and that is where proportionality comes in. In practice, most small businesses have three profiles of people, and each needs a different level. The operator uses AI every day: the salesperson drafting proposals with an assistant, the technician summarising calls, the admin classifying invoices. This profile needs safe-use literacy: what the tool can and cannot do, how to verify results, what data must never go into a prompt (customer data, health data, credentials), and what to do when something looks wrong. Most incidents are born here: not from malice, from over-trust. The manager decides where AI goes: chooses tools, approves automations, defines processes. They need risk literacy: which uses are high-risk (CV screening, credit decisions, performance evaluation — Annex III territory, with rules arriving on 2 December 2027), what changes when AI talks to customers (transparency, Article 50), and how to document decisions. The final decision-maker — often the business owner — needs governance literacy: knowing that responsibility cannot be outsourced, that fines are proportionate but real, and that “we did not know” is not a defence. A practical 60- to 90-minute session per profile, with examples from your own business, covers the essentials. What the law requires is not a university course: it is that each person understands the risks of what they use — and can prove it with records: who attended, when, and on what topics.
Marking AI-generated content: the 2 December deadline
Article 50(2) requires providers of systems that generate audio, images, video or text to mark that content in a machine-readable way — and, in some cases, visibly to users — so it can be identified as AI-generated. Anyone who placed such systems on the market before 2 August 2026 has until 2 December 2026 to comply: the deadline is just over a month away. For a small business, the practical question is different: does this apply to me? If you only use third-party tools to generate text or images, you are a professional user, not a provider — and the marking duty falls on the tool’s provider. But there are two scenarios where the line blurs. The first: if you resell or integrate AI generation into your service — for example, an agency delivering “AI-made” videos or copy to clients without marking them. The second: if you substantially modify a third-party system, you may become a provider. The point worth keeping: when you buy or subscribe to a generation tool, ask the provider how it marks content and get it in writing. It is a cheap compliance question almost nobody asks today — and from December it becomes part of normal diligence. Note also that paragraph 1 of the same article — telling people they are interacting with AI — has applied since 2 August 2026. That is the transparency rule, and it is the one that touches most small businesses every day. It is the subject of the next section.
The customer must know they are talking to AI
Article 50(1) is straightforward: people must be told when they are interacting with an AI system. In small-business practice, that means one line of disclosure at the start of the website chatbot or WhatsApp assistant conversation — nothing more. It requires no new technology and no cost: it requires not pretending the bot is human. The most common example is WhatsApp customer service. If you run a bot that answers questions, books appointments or quotes prices, the customer must understand they are talking to AI. One sentence does it: “Hi, I’m [company]’s virtual assistant” at the start of the conversation satisfies the requirement. It is worth connecting this point to the demo we keep live: ZapDesk is an AI receptionist for small-business WhatsApp that answers 24/7, responds from the company’s knowledge base, quotes prices and hours, books appointments and saves interested contacts — and presents itself as a virtual assistant from the first message. You can try it live here: https://zapdesk-demo.vercel.app/ One trap to avoid: transparency is not just the opening line. If the conversation escalates to a human, say so too. And if the system generates content the customer will publish or share — quotes, descriptions, images — the marking rule from the previous section comes into play. The two rules of Article 50 work as a pair: one looks at the conversation, the other at the content.
The fines: what the 12 October draft says
The draft published on 12 October (Ares(2026)9589403) does not create the fines — the ceilings are already in the law — but it describes how the European AI Office will apply them: access to the case file after preliminary findings, protection of third-party trade secrets, and a five-year limitation period for imposing fines, restarted by investigative acts, with an absolute cap of ten years. The ceilings, already in force, have three tiers. For SMEs and small mid-caps, the lower value of each pair applies — a proportionality detail the draft confirms and the Digital Omnibus reinforced. There is also a separate instrument: daily periodic penalty payments of up to 5% of average daily income or worldwide annual turnover of the preceding financial year, for each day of non-compliance. That is the mechanism for those who ignore a decision, not for those who make a one-off mistake. Two notes of context. First: the Office’s fine regime applies to its direct supervision remit — systems built on general-purpose AI models by the same provider and systems integrated into large platforms. Ordinary use of a third-party chatbot does not put a small business under the Office’s direct supervision; day-to-day enforcement is national. Second: national fines are set by each Member State, with mandatory proportionality for SMEs. The table sums up the three tiers:
| Violation | Ceiling: large companies | Ceiling: SMEs |
|---|---|---|
| Prohibited practices (Article 5) | €35M or 7% of turnover | the lower of the two |
| Other violations or failure to comply with decisions | €15M or 3% of turnover | the lower of the two |
| Inaccurate, incomplete or misleading information | €7.5M or 1% of turnover | the lower of the two |
Checklist: what to do this week
No consultants, no new software. Six practical steps, from the most urgent to the most structural. 1. Build the AI tool register. One simple sheet: tool, purpose, owner, what data it touches, whether it talks to customers, and who reviews the output. It takes an afternoon and it is the document an inspection asks for first. 2. Run one training session per profile. 60 to 90 minutes with examples from your business: for operators, safe use and verification; for managers, risks and documentation; for decision-makers, responsibilities. Record who attended, when, and which topics were covered. 3. Cover external providers. If your accountant, agency or a freelancer use AI on your behalf, include them in the training or require in writing that they comply with Article 4. Responsibility follows the chain. 4. Add the transparency notice. On every chatbot or WhatsApp assistant that talks to customers, one line at the start of the conversation: “you are talking to an AI assistant”. Also check what happens when the conversation hands over to a human. 5. Ask your vendors about marking. For every tool that generates text, images, audio or video, ask in writing how it marks content as AI-generated. The 2 December deadline is approaching. 6. Review anything that decides about people or money. Any AI use in hiring, credit, performance evaluation or personalised pricing deserves human review and its own documentation — it is high-risk territory, with rules arriving on 2 December 2027. None of this requires a budget. It only requires AI literacy to stop being “something to deal with one day” and become a register, a session and a notice. The law is already here — and now someone is watching.
Frequently Asked Questions
My company is small. Does Article 4 really apply to us?
Yes. The duty applies to all providers and professional users of AI systems, regardless of size — and it covers all systems, not only high-risk ones. What changes with size is proportionality: a five-person company does not need a multinational’s programme, it needs measures suited to its risks — a training session, a tool register, a transparency notice. The Digital Omnibus further reinforced the simplifications for SMEs.
We only use ChatGPT and Copilot. Are we still covered?
Yes. Anyone using third-party tools is a professional user (deployer) and falls within Article 4’s scope. The law does not distinguish between a bespoke system and a monthly subscription: what counts is that people are operating AI on your behalf. Your team needs safe-use literacy — verifying results, knowing what data must never go into a prompt, and recognising when something goes wrong.
How many hours of training does the law require?
No fixed number. The regulation sets no curriculum, minimum hours or certification — it requires measures proportionate to each person’s technical knowledge, experience and training, the context of use and the people affected. In practice, a 60- to 90-minute session per profile, with examples from your business, covers the essentials for a small company. What an authority will ask for is not a diploma: it is the record — who attended, when, and on what topics.
Our accountant uses AI on our behalf. Whose responsibility is it?
Yours, to the extent they act on your behalf. Article 4 expressly extends to “other persons dealing with the operation and use of AI systems” on the company’s behalf — service providers, freelancers, consultants. Include them in your training or require in writing that they comply with Article 4. It is the supply-chain dimension that creates the most gaps when an authority asks for evidence.
What happens if we do nothing?
Since 2 August 2026, national market surveillance authorities hold formal supervisory powers — and AI literacy programmes, or their absence, are among the first things they will examine. The penalty framework provides, for this type of infringement, up to €15 million or 3% of worldwide turnover, with mandatory proportionality for SMEs. There is no need to imagine the worst case: it is enough to understand that a company that documented basic training and a tool register is in an incomparably better position than one that did nothing.