Does the EU AI Act AI Literacy Rule Apply to UK Employers?

The UK left the EU, but EU law has a habit of following UK businesses that sell into Europe. The AI literacy duty in the EU AI Act is short, sensible and widely misunderstood, so here is a plain-English version.

One caveat first: this is general guidance from a training company, not legal advice. If your exposure to the EU is significant, speak to a lawyer who specialises in it.

What does Article 4 of the EU AI Act say?

The whole article is one sentence. Paraphrased closely: providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. They must take into account those people's technical knowledge, experience, education and training, the context the AI is used in, and the people on whom the AI is used.

Three words do most of the work:

Deployers

A deployer is any organisation using an AI system under its own authority in a professional context. A business whose staff use ChatGPT, Copilot or an AI feature in its HR software is a deployer. You do not have to build AI to be covered.

In practice

If your staff use AI tools at work, assume you are a deployer of those tools.

Sufficient

Not expert, not certified. Enough for the role and the risk. A marketing assistant drafting social posts needs less than a team using AI to screen job applicants.

In practice

Match the depth of training to the risk of each person’s AI use, and write down why.

Measures

Training is the obvious measure, but guidance, policies, supervision and support count too. The article is about outcomes, not a specific course.

In practice

Combine a policy, hands-on training and someone people can ask. Together they are stronger evidence than any single course.

When does it apply, and how is it enforced?

The literacy duty has applied since 2 February 2025, alongside the Act's bans on prohibited AI practices. The European Commission has published a question-and-answer page on AI literacy which makes several helpful points: there is no mandatory certificate, organisations can keep internal records rather than formal qualifications, and supervision and enforcement sit with national market surveillance authorities, with those enforcement arrangements due from August 2026.

The Act itself does not set a specific fine for breaching Article 4. In practice, a lack of AI literacy is more likely to come up as an aggravating factor when something else goes wrong, for example a discriminatory outcome or a data breach involving an AI tool.

Does the AI literacy duty apply to UK businesses?

The EU AI Act has extraterritorial reach. A UK business can fall within scope even with no office in the EU. The common routes in are:

• You place AI products or services on the EU market, for example a SaaS product with AI features sold to EU customers.
• The output of your AI system is used in the EU, for example AI-assisted analysis or content delivered to EU clients.
• You have an EU subsidiary, branch or establishment whose staff use AI.

Many UK businesses decide the simplest answer is to meet the standard everywhere. It costs little more than doing it for the EU-facing team alone, and it protects you under UK rules too.

What is the UK position on AI literacy?

The UK has no equivalent statutory AI literacy duty. Instead, existing law and regulators do the work:

• UK GDPR and the ICO. If staff put personal data into AI tools, you need lawful basis, security and transparency. The ICO expects organisations to train staff in data protection, and AI tools are no exception. See how AI affects privacy.
• Equality Act 2010. AI used in recruitment, performance or customer decisions must not discriminate.
• Sector regulators. The FCA, SRA, ICAEW and others expect firms to understand and supervise the tools their people use.
• Government skills push. The government has backed free AI skills training for millions of workers. Our guide to free government AI training lists what is available.

What should a UK employer do to comply?

A proportionate response for a small or mid-sized business looks like this:

1. Map your AI use

   List the AI tools in use, approved or not, and which teams use them. Include AI features inside existing software.

2. Write or update your AI policy

   Approved tools, data rules, checking, disclosure and a named owner. Our AI policy guide and free template help.

3. Tier your people

   Everyone gets a foundation. Regular users, managers and high-risk roles get more. See how to build an AI literacy programme.

4. Train hands-on

   Practice on real tasks with your approved tools, not slides about AI in general.

5. Record it

   Who was trained, when, on what, at what level, plus how you checked understanding. How to measure AI literacy has a template.

6. Refresh

   Review when tools, policies or roles change, and at least once a year.

What evidence of AI literacy should we keep?

No regulator has published a mandatory format, so keep it simple and honest. A good training record answers: what AI systems does this person use, what training did they receive, when, who delivered it, how was understanding checked, and when is the next review. Attendance alone is weak evidence; a short scenario check or work sample is far stronger.

AI literacy training with the records to show for it

We write the policy, train your people on your own tools and give you a clear record of who learned what, and when. Practical, proportionate and in plain English.

See all programmesTalk to Harry

• AI Policy Workshop Rules that match how your team actually works.
• Basic AI Training The foundation level for every employee.
• AI Compliance, Auditing and Explainability For higher-risk AI use.

Harry Lang
Harry Lang founded The Oxford AI School in Witney, Oxfordshire. He trains UK businesses and teams to use AI well, writes the Marketing Unfiltered newsletter, and is the author of Learn To Fly With AI.