Article 4 and UK companies: does EU AI literacy apply to you?
Article 4 of the EU AI Act can apply to UK companies, but not to all of them. It reaches a UK company that places AI systems on the EU market, has an EU subsidiary or branch using AI, or uses AI whose output is used in the EU. A UK company that uses AI only for its UK operations is generally outside the EU rule, and UK law has no AI literacy duty of its own.
The hard question for most UK firms: does AI-drafted work for an EU client count as output used in the EU? Possibly. The decision table below sorts the common cases.
Status as of October 13, 2026. Not legal advice: for a decision about your own company, ask a lawyer qualified in EU law.
What Article 4 asks for
Article 4 has applied since February 2, 2025. Since the Digital Omnibus on AI (Regulation (EU) 2026/1744), it requires providers and deployers of AI systems to "take measures to support the development of AI literacy" of their staff and others operating AI systems on their behalf, without guaranteeing any specific level for any individual.
In practice, that means proportionate, role-based measures: people know what AI can and cannot do, what data they may enter, and how to check outputs. No certificate is needed; an internal record of training and guidance is enough. More in the Commission's AI literacy Q&A explained and Article 4 after the Digital Omnibus.
Does the EU AI Act apply to UK companies? What Article 2 says
Article 2(1) of Regulation (EU) 2024/1689 sets the AI Act's territorial scope. For UK companies, three points matter. The Act applies to:
- (a) "providers placing on the market or putting into service AI systems" in the EU, "irrespective of whether those providers are established or located within the Union or in a third country";
- (b) "deployers of AI systems that have their place of establishment or are located within the Union";
- (c) "providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union".
A provider develops an AI system and places it on the market under its own name. A deployer uses one under its own authority for professional purposes, as most companies using Copilot, ChatGPT or an AI feature in their CRM do.
Recital 22 limits point (c) to output "intended to be used in the Union". Article 4 follows the same scope: it applies to actors outside the EU when the AI system is placed on the EU market, used in the EU, or its use has an impact on people located in the EU (Commission AI literacy Q&A).
Decision table: is your UK company in scope of Article 4?
Use it to sort cases, not as a final answer.
| Your situation | Likely role | Article 4 in scope? | Why |
|---|---|---|---|
| You sell an AI product or AI feature to customers in the EU | Provider | Yes | Article 2(1)(a): placing on the EU market, wherever you are based |
| Your EU subsidiary or branch uses AI tools in its work | Deployer (the EU entity) | Yes, for the EU entity | Article 2(1)(b): deployer established in the EU |
| Your UK team uses AI to produce work delivered to EU clients, such as reports, translations or marketing copy | Deployer | Possibly | Article 2(1)(c): output used in the EU; how far this reaches is not yet settled |
| You run an AI chatbot on your website that serves customers in the EU | Deployer | Likely | Output used in the EU and affects people in the EU |
| You operate AI on behalf of an EU client, for example as an outsourced support desk | "Other person" for the client, and possibly a deployer yourself | Yes, through the client | The client's Article 4 duty covers people operating AI on its behalf |
| Your UK staff use AI only for UK customers and UK operations | Deployer | Generally no | No EU market, no EU establishment, no output used in the EU |
For outsourced work, the Commission's Q&A says that people working for a service provider or contractor need appropriate AI skills, so expect EU clients to raise it in contracts and tenders.
Where the line is unclear
- Is it an AI system at all? The Commission's non-binding guidelines on the AI system definition help: generative AI assistants clearly qualify, a spreadsheet macro does not.
- Is the output "intended to be used in the Union"? An AI-drafted market report sold to a client in Germany is a stronger case than an internal UK memo that later reaches a colleague in Ireland.
- Are you the provider or the deployer? Put your own name on an AI product, and you are likely a provider, with more obligations than Article 4 alone.
Article 4 is one of the lightest duties in the AI Act. For a UK company serving EU clients, a short, documented AI literacy program often costs less than a legal analysis of whether you could avoid it, and it answers the EU customer who asks how your people use AI safely.
Tip: The Aigen Campus course is available in English, with videos, captions and examples for 12 job roles. Module 5 covers what data you may give to AI tools, and module 6 covers the AI Act.
The UK's own rules: no AI Act, but UK GDPR applies
As of September 2026, the UK had no comprehensive AI law, and the expected AI bill had not materialized (Lewis Silkin), so UK law has no equivalent of Article 4. Data protection law does apply:
- UK GDPR and the Data Protection Act 2018 apply whenever AI processes personal data. Under the accountability principle (Article 5(2)), you must be able to show how you comply, which in practice includes staff guidance and training.
- The Data (Use and Access) Act 2025 changed parts of UK GDPR. Most of the remaining data protection changes took effect on February 5, 2026 (ICO commencement statement), including new rules on automated decision-making that replace the old UK GDPR Article 22 (Travers Smith).
- A statutory ICO code on AI is coming. SI 2026/425, in force since May 12, 2026, requires the Information Commissioner to prepare a code of practice on AI and automated decision-making. The code still has to be drafted and approved, so check its status on the ICO website.
- The ICO's existing guidance on AI and data protection, last updated on March 15, 2023, is under review because of the Data (Use and Access) Act. It remains the ICO's main reference on fairness, transparency, accuracy and accountability in AI.
If you offer goods or services to people in the EU, the EU GDPR can also apply to you directly under its Article 3(2), separately from the AI Act.
What a UK company serving the EU can do now
- Map your EU touchpoints: the AI tools in use, which teams use them, and where the output goes (EU clients, EU customers, an EU entity).
- Sort each case with the decision table and write down your reasoning; a short written assessment is evidence in itself.
- Write a short AI policy: approved tools, off-limits data, and when a person must check the output. One policy serves both UK GDPR accountability and Article 4. The AI policy builder produces a draft for you to review, or start from the AI policy template.
- Train by role and keep a record of who completed what and when; customer service, sales, HR and finance face different risks.
- Prepare a one-paragraph answer for EU clients describing your measures, ready for the next tender or questionnaire.
Frequently asked questions
Does the EU AI Act apply to UK companies after Brexit?
In some cases: when they place AI systems on the EU market, have an EU establishment using AI, or use AI whose output is used in the EU. It generally does not apply to purely UK operations.
Do UK companies need an EU authorized representative for Article 4?
Not for Article 4 alone. The AI Act requires an authorized representative in the EU from non-EU providers of high-risk AI systems (Article 22) and of general-purpose AI models (Article 54), not from ordinary deployers.
Is there a UK equivalent of AI literacy under Article 4?
No. UK law has no general AI literacy duty, but UK GDPR accountability means you should be able to show how staff handle personal data in AI tools, usually through training.
Who would enforce Article 4 against a UK company?
National market surveillance authorities in the EU Member States, not the EU AI Office. Each Member State designates its own authorities and sets any penalties in national law; Finland, for example, sets none for breaching Article 4.
Get started
Serving EU clients? The Aigen Campus course trains your whole staff in about 1 h 33 min, in English, with a final exam and an exportable competence register. Create a free account to build your AI policy and try module 1.