The AI rule that’s already law, and most boards haven’t noticed
Most leadership teams think the EU AI Act is a 2026 problem. It isn’t, or not all of it. Part of it has been law since February last year, and in the conversations we have with clients, almost nobody knows it’s there.
That part is Article 4. It came into force on 2 February 2025 and it already applies, well over a year before the date everyone’s circling.
What Article 4 actually asks for
The requirement is simple enough. If your organisation provides or uses AI inside the EU, the people using it need to understand what they’re working with.
The word that trips people up is “deploys”. You don’t have to be building anything yourself. If your teams use ChatGPT or Copilot, that’s enough to count. And if you’ve got any kind of EU footprint, or AI you use produces outputs that get used in the EU, you’re in scope.
It reaches a little wider than most people assume, too. It covers your own staff and anyone acting on your behalf, contractors included, and it can pull in organisations based outside the EU when the output ends up being used inside it.
Why this sits with the board
The reflex is to hand it to IT, or to assume the software vendor has it covered. Neither holds.
Article 4 is aimed at decision-makers, the people running the business and depending on AI to do it. Which makes sense when you think about it. If the people in charge can’t see the risks in the AI they rely on, that’s the board’s problem to own.
The companies getting ahead of this have stopped treating it as a form to file. They’re asking a harder question, which is who actually needs to understand this, and how well.
If you’re only in the UK
Operate solely in the UK and Article 4 doesn’t bind you directly. The UK hasn’t passed an equivalent rule and is taking its own path on AI.
Worth looking at where this is heading, though. Brussels has just written AI understanding into law as a basic expectation of anyone using AI at work, well beyond the technical function. That tells you which way the bar is moving.
You can wait for a UK version to turn up, or get this right while you’ve still got room to do it properly. The case holds either way. A leadership team that can’t judge the AI it leans on has a gap at the top, regulation or not.
The penalties, and why “no fine” misleads
There’s no specific fine attached to Article 4 by itself. People hear that and ease off. That’s a mistake.
Enforcement begins on 2 August 2026, alongside most of the rest of the Act. From then, a literacy gap won’t be fined on its own, but it makes everything harder when something else goes wrong. Imagine an under-trained team causing real harm, and no record anywhere of the training you were meant to have in place. That’s a much weaker spot to defend from.
Which is the case for sorting it now, rather than treating August 2026 as the day to start thinking about it.
What a board should be able to answer
None of this needs European exposure to matter. Two questions any leadership team should be comfortable with.
First, do you know where AI is being used across the business, including the tools nobody officially approved? That second part is usually where the surprises live. And wherever it’s in use, is the depth of understanding matched to what’s at stake? Someone running AI-assisted lending decisions is carrying more risk than someone drafting marketing copy, and you’re expected to handle those differently.
Second, the uncomfortable one. If a regulator asked tomorrow, could you actually show what training your people have had?
Where it usually falls down
Here’s what we see most. The policy exists. What’s missing is any real confidence that the people using AI understand it, or have a sense of where it can go wrong.
Closing that takes more than another document. It means getting an honest picture of where AI sits in your business and whether the people using it are set up for what they’re doing with it. And being able to show your working if someone asks.
We’ve been following Article 4 closely for clients with European exposure, helping leadership teams work out where it belongs and what a sensible version of “handled” actually looks like. If it’s a question sitting on your desk, we’re glad to talk through what we’re seeing.