How an SME complies with EU AI Act Article 4 (with a free checklist)

Short answer: to comply with EU AI Act Article 4, an SME needs three things — a short written AI-use policy, staff training that is proportional to each person's role, and an evidence record proving the training happened (who attended, what was covered, how it was assessed, and when). There is no mandatory number of training hours and no official curriculum: compliance is a process you document, not a certificate you buy. If your team uses tools like ChatGPT, Copilot or Gemini at work and your output reaches the EU, this applies to you.

What Article 4 is — and who it applies to

Article 4 of the EU AI Act is the "AI literacy" obligation. It requires providers and deployers of AI systems to take measures to ensure that their staff — and others operating AI on their behalf — have a sufficient level of AI literacy. In plain terms: the people in your business who use AI should understand what these tools can do, where they go wrong, and how to use them responsibly.

The obligation has applied since 2 February 2025. It is not limited to tech companies or to "high-risk" AI. A marketing agency drafting copy with ChatGPT, an accountancy firm summarising documents, a recruiter screening CVs with an AI tool — all are deployers and all are in scope.

Crucially, the scope is extraterritorial, much like the GDPR. Any provider or deployer whose AI system's output is used inside the EU falls under the rules — including companies based outside the EU. A UK, US or Swiss SME serving EU clients cannot assume it is exempt.

You can read the article text at artificialintelligenceact.eu/article/4 and the European Commission's official AI literacy FAQ at digital-strategy.ec.europa.eu.

The 2 August 2026 deadline and the penalties

Although the obligation has been live since February 2025, enforcement was initially soft. That changes on 2 August 2026, when national authorities across the EU gain formal supervision and penalty powers for the AI Act.

The relevant penalty tier reaches up to €7.5 million or 1% of global annual turnover, whichever is higher. For an SME, the more realistic risk is not a headline fine but the everyday friction: an EU client's procurement team asking for proof of AI-literacy compliance, a tender that requires it, or a due-diligence questionnaire you cannot answer. Being able to hand over a one-page policy and a training record turns a potential blocker into a tick-box.

The three concrete steps to comply

Strip away the noise and Article 4 compliance for a small business comes down to three deliverables.

1. A short AI-use policy. One to three pages is enough for most SMEs. It should state which AI tools are approved, what staff may and may not put into them (no client confidential data into public tools, for example), who is accountable, and the basic principle that AI output must be checked by a human before it is relied upon.

2. Training proportional to role. Run a short session — or assign structured material — so each person understands the AI they actually use. A customer-service agent using a chatbot needs different depth from a developer integrating an AI API. "Proportional" is the operative word: you are not sending everyone on a university course.

3. An evidence record. This is the part most businesses forget, and it is what an authority or a client will actually ask for. Keep a simple record: who attended, the date, what was taught, and some form of assessment or acknowledgement. A signed attendance sheet plus a short quiz is perfectly defensible.

What "sufficient" actually means — the proportionality note

This is the question everyone asks, and the honest answer is that the regulator deliberately did not set required training hours, mandate an approved curriculum, or create an official trainer certification. That was a choice, not an oversight.

The standard is proportionality. Your AI literacy measures should match the role, the experience of the staff, and the context in which the AI is used. A two-person design studio and a 200-person fintech do not need the same programme. What matters is that you can show you thought about it, acted on it, and recorded it. Documentation is the proof — which is exactly why a "we'll do a chat about it" approach fails: there is nothing to show.

If you want the authoritative read on this, the EU AI Act Service Desk is the official support channel for questions, alongside the Commission's FAQ.

Common mistakes SMEs make

• Assuming it doesn't apply because you are not an AI company or are based outside the EU. If staff use AI and output touches the EU, you are in scope.
• Treating it as a one-off. New hires and new tools mean training needs refreshing. Date your records.
• Doing the training but keeping no evidence. Unrecorded training is, for compliance purposes, training that did not happen.
• Over-engineering it. Buying a €5,000 consultancy programme for a ten-person firm is as much a mis-step as ignoring it. Match the effort to the risk.
• Chasing a "certificate." No official Article 4 certificate exists. Be wary of anyone selling one as a legal guarantee.

Get the free checklist — and the full kit

The fastest way to see where you stand is the free Article 4 Readiness Checklist — a short self-audit that tells you which of the three pillars you already have and which are missing. If you find gaps, the full EU AI Act Article 4 Compliance Kit gives you the ready-to-edit policy template, a role-based training outline, and the evidence-record templates that turn the checklist into done.

Grab the free checklist and see the kit at aiact.podlevskikh.com.

FAQ

Does Article 4 apply to my small business if we just use ChatGPT? Yes. Using ChatGPT, Copilot, Gemini or similar tools at work makes you a deployer of AI. If your output reaches the EU, the AI-literacy obligation applies regardless of company size.

How many hours of AI training does Article 4 require? None specifically. The regulator set no minimum hours and no official curriculum. Training must be proportional to each person's role, and you must keep evidence it took place.

What is the deadline for AI Act Article 4? The obligation has applied since 2 February 2025. National authorities gain supervision and penalty powers on 2 August 2026, so that is the practical date to be ready by.

Do non-EU companies have to comply? Often, yes. The AI Act has extraterritorial reach: if your AI system's output is used within the EU, you can be in scope even with no EU office — similar to how the GDPR works.

Disclaimer: This article and the accompanying kit are educational materials and templates designed to help you meet Article 4 requirements. They do not constitute legal advice, do not guarantee a specific legal outcome, and are not an official certification. For advice on your specific situation, consult a qualified professional and the official EU sources cited above.