Does the EU AI Act apply to UK companies after Brexit?

It can. The Act is EU law, but Article 2 extends it to providers that place AI systems on the EU market wherever they are based, to deployers established in the EU, and to providers and deployers outside the EU whose AI output is used in the EU. A UK firm with EU customers, an EU office or AI-assisted services delivered into the EU should check its position.

Did the Digital Omnibus remove the AI literacy obligation?

No. Regulation (EU) 2026/1744 replaced the text of Article 4 but kept a duty on providers and deployers. They must now take measures to support the AI literacy of their staff and others operating AI on their behalf, rather than ensure a sufficient level of literacy. The Commission and Member States must also support businesses, especially SMEs.

Who enforces the AI literacy duty and what are the penalties?

Supervision and enforcement sit with national market surveillance authorities in each EU Member State, not with the EU AI Office. The Commission says supervision and enforcement apply from August 2026, and that penalties are set under national law and must be proportionate. Check the rules of the Member State where your AI output is used.

Is using Microsoft 365 Copilot or ChatGPT at work enough to make us a deployer?

Generally, yes. The AI Act defines a deployer as anyone using an AI system under its authority, except for personal non-professional activity, so a business giving staff access to an AI assistant is a deployer of it. Whether Article 4 applies to a UK deployer then depends on whether the output is used in the EU or the business is established there.

AI Literacy and the EU AI Act: What UK Firms Serving the EU Must Do

Q: Do staff need an AI literacy certificate?

No. The European Commission's questions and answers page on AI literacy states there is no need for a certificate. It suggests organisations keep an internal record of training and other initiatives instead. Certificates from courses can still be useful evidence of what was covered, but they are not a legal requirement under Article 4.

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and of others who operate AI on their behalf. It has applied since 2 February 2025. A UK business is caught when it places AI systems on the EU market, operates through an EU establishment, or uses AI whose output is used in the EU.

This article is general information, not legal advice. If your exposure is unclear, speak to a lawyer who knows EU technology regulation.

At a glance

Point	Detail
The rule	Article 4, Regulation (EU) 2024/1689
Applies since	2 February 2025
Amended by	Digital Omnibus on AI, Regulation (EU) 2026/1744
Amendment in force	27 July 2026
Who enforces	National market surveillance authorities
Certificate needed?	No, according to the European Commission

What Article 4 says now

The original text asked providers and deployers to ensure, "to their best extent, a sufficient level of AI literacy". The Digital Omnibus on AI, adopted on 8 July 2026, replaced Article 4 in full. The current version has three paragraphs:

Providers and deployers must "take measures to support the development of AI literacy" of their staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take into account people's technical knowledge, experience, education and training, the context the AI is used in, and the people it is used on. The new text adds that the duty does not require you to ensure any specific level of AI literacy in any individual.
The Commission and Member States must support providers and deployers, particularly SMEs, and the Commission must publish practical examples of how to comply.
The European AI Board will adopt recommendations, drawing on European competence frameworks.

The duty was softened, not removed. It moved from an outcome you had to reach to measures you have to take. For a business, that means the question a regulator or customer asks becomes "what did you do, and was it sensible for your context?" rather than "is everyone literate?"

The AI Act defines AI literacy in Article 3(56) as the skills, knowledge and understanding that let providers, deployers and affected persons make an informed deployment of AI systems and be aware of the opportunities, risks and possible harm.

Dates that matter

2 February 2025: Article 4 started to apply.
27 July 2026: the amended Article 4 took effect when the Digital Omnibus entered into force.
August 2026: the Commission's AI literacy questions and answers says national market surveillance authorities supervise and enforce Article 4 from August 2026 (one answer gives 2 August, another 3 August). Penalties are set under national law and must be proportionate.
2 December 2027: the Omnibus sets this as the new application date for high-risk obligations covering Annex III systems, including the deployer duty in Article 26(2) to assign human oversight to people with "the necessary competence, training and authority".

One caution: parts of the Commission's questions and answers page were written before the final Omnibus text and describe it as a proposal. Read the amended Article 4 on the Commission's AI Act Service Desk, which shows the consolidated text with amendments marked.

When the duty reaches a UK business

The AI Act is EU law, so it does not apply in the UK as such. It reaches UK firms through its scope rules in Article 2(1). Four situations come up most often:

Your situation	Likely role	Article 2(1) route
You sell software with AI features into the EU	Provider	(a) placing on the EU market
Your AI chatbot or tool serves people in the EU	Deployer, maybe provider	(c) output used in the EU
Your EU subsidiary or office uses AI tools	Deployer	(b) established in the EU
UK staff use AI only for UK work	Less likely caught	Check edge cases with advice

Point (c) is the one UK firms underestimate. It covers providers and deployers established outside the EU "where the output produced by the AI system is used in the Union". A UK online retailer whose AI assistant answers shoppers in Ireland, or a UK consultancy that sends AI-assisted analysis to clients in France, should at least work through the question.

A deployer is anyone using an AI system under its authority, other than for personal non-professional use. A company that rolls out Microsoft 365 Copilot, ChatGPT Enterprise or Claude to staff is a deployer of those systems. Being small does not take you out of scope, although the amended text tells the Commission and Member States to give SMEs particular support.

What a sensible AI literacy programme looks like

The Commission's questions and answers page suggests that, at a minimum, organisations should cover four things: a general understanding of AI within the organisation, the organisation's own role as provider or deployer, the risks of the AI systems it uses, and measures tailored to people's existing knowledge and the context of use. There is no prescribed syllabus or number of hours.

A tiered approach keeps it proportionate:

Audience	What they need	Refresh
Everyone with AI access	What AI is, where it fails, your rules	Yearly, and on new tools
Regular users of a tool	Good prompting, checking outputs, data rules	When the tool changes
People who build or buy AI	Risk assessment, testing, vendor questions	Per project
Managers and reviewers	Oversight, escalation, accountability	Yearly

Topics worth covering for every group

How generative AI produces answers, and why it can state wrong things confidently. The Commission's guidance gives hallucination as an example of a risk staff should know about.
What data may go into which tool. Make the line between approved enterprise tools and personal accounts explicit.
Checking before using. Who must review an AI-drafted customer email, contract clause or report before it leaves the building.
People affected by the AI. Article 4 asks you to consider the persons on whom AI is used. For a customer-facing chatbot, that means staff understand how customers experience it and when to hand over to a human.
Your internal rules, including your AI use policy, and who to ask.

A common mistake is buying one generic e-learning module and stopping there. The amended Article 4 still asks you to take account of context, so a finance team using AI on invoices needs different examples from a marketing team using it for campaign copy.

Records to keep

The Commission says there is no need for a certificate and that organisations can keep an internal record of training and other initiatives. That internal record is your evidence. Keep it simple and current:

An AI system register: each tool, its owner, what it is used for, and whether its output reaches the EU.
Your role per system: provider, deployer or both.
Training content and version: what each audience was taught, and when it was last updated.
Completion log: who completed what, and on which date.
Policy acknowledgement: staff confirmation of your AI use policy.
Review notes: when you last reviewed the programme and what changed.

A spreadsheet is enough for most SMEs. What matters is that it would let you show, quickly and honestly, what you did and why it fits your use of AI.

A 90-day plan for a UK firm with EU customers

Days 1 to 30, scope. List every AI tool in use, including features switched on inside existing software. Mark which outputs reach EU customers or colleagues. Agree who owns the programme.
Days 31 to 60, baseline. Publish or refresh your AI use policy. Run a short session for everyone with AI access and record attendance.
Days 61 to 90, role-specific. Deliver deeper sessions for heavy users, builders and managers. Set up the register and log, and book the first review.

After that, review at least yearly and whenever you add a significant AI tool. If you also want the UK picture, our guide to how the UK regulates AI in 2026 covers the domestic side, and the AI Fluency Framework gives a structure for what good AI use looks like.

How CertTulen Academy can help

CertTulen Academy runs live, instructor-led AI training that can form part of an Article 4 programme. AI Fluency: Framework and Foundations gives staff a shared framework for using AI well, and Work Smarter with AI (AI-3025) is a practical introduction for everyday users of AI tools. For whole teams, we run private corporate cohorts. Contact us to plan a programme and a batch that suits your time zone.