The fine is €35 million. Or 7% of worldwide annual turnover, whichever is higher.

From 2 August 2026, Article 4 of the EU AI Act is enforced. It requires every company that builds or deploys AI in the EU — which means almost every company of any size — to ensure that all staff have adequate AI literacy. Not just the technical team. Not just managers. All of them.

The pressure is real. The deadline is fixed. And a market has appeared, exactly on cue, to sell you compliance.

That market is the problem.

What Article 4 actually says

Article 4 is eleven lines long. It requires providers and deployers of AI systems to ensure their staff possess “sufficient AI literacy.” It specifies that training should account for technical knowledge, experience, and the context in which AI is used.

What it does not specify: what “sufficient” means. What counts as evidence of literacy. How you demonstrate compliance to a regulator. How often training must be refreshed when new tools are introduced.

The regulation creates the obligation. It does not define the standard.

This matters, because the vendor market will define it instead.

What is about to happen

Eleven weeks before an enforcement deadline with eight-figure fines attached, procurement decisions accelerate. That’s not a prediction — it’s how deadline-driven compliance works. The same pattern appeared before GDPR, before NIS2, before every major regulatory inflection point.

Training vendors are already positioning. Webinars are being scheduled. Packages are being priced. Proposals are being sent to legal and compliance teams under subject lines that include the words “Article 4 ready.”

Most of those programmes will be sold to companies that never asked a single question about whether they actually satisfy the regulation.

That is not cynicism. That is the default behaviour of organisations under deadline pressure.

The assumption nobody will test

Here is the assumption running unchallenged through most compliance decisions made in the next eleven weeks: if we buy a training programme, we are compliant.

It feels reasonable. The vendor says so. The deadline creates urgency. The alternative — doing nothing — carries the fine.

But Article 4 does not say “provide training.” It says ensure staff possess sufficient AI literacy. The distinction is not legal pedantry. It is the entire question.

A training programme is an input. Literacy is an outcome. Regulators, when they investigate, will ask about outcomes. Can you demonstrate that your staff understand how AI generates answers, where it fails, and what the risks of unsupervised use are in their specific role? Can you show that your blue-collar logistics team has received training calibrated to their actual AI touchpoints, not a generic e-learning module designed for white-collar knowledge workers?

The vendor’s certificate of completion is not an answer to those questions.

The parallel that should worry you

This is structurally identical to every AI platform investment made after an impressive vendor demo.

The demo shows the capability. The business case shows the ROI. The organisation signs. And nobody tests whether the underlying assumptions hold against the actual situation — their data, their workflows, their users.

The compliance version runs the same way. The proposal shows the curriculum. The testimonials reference satisfied clients. The legal team sees the Article 4 logo. The contract is signed. And nobody tests whether this programme, delivered to this workforce, in this context, produces the outcome the regulation requires.

The difference is the failure mode. A failed AI platform costs you implementation budget and a painful write-off. A failed compliance programme costs you the fine it was supposed to prevent, plus a regulator who now knows you treated the obligation as a box to tick.

The questions worth asking before signing

Article 4 does not define the standard. That means you need to.

Before committing to any AI literacy programme, four questions deserve answers.

First: what specific evidence does this programme generate that staff have achieved adequate literacy — not that they completed it? Completion rates are not literacy evidence.

Second: how is the training differentiated by role? A finance controller processing AI-assisted reports has different risk exposure than a warehouse operative using AI route optimisation. A programme that does not distinguish between them does not satisfy the regulation’s requirement for context-appropriate training.

Third: what happens when your AI toolset changes? Article 4 is not a one-time obligation. It applies on an ongoing basis. A static training programme delivered once does not address continuous compliance.

Fourth: how has this programme performed in regulatory scrutiny? Not with satisfied customers. With regulators. If the vendor cannot answer that question, you are assuming compliance that has not been tested.

What the deadline is actually telling you

The August 2 deadline creates urgency. Urgency is exactly when assumptions go untested.

The fine is designed to make companies act. The gap in the regulation is what makes the vendor market possible. Those two facts together produce the conditions for a wave of compliance purchases that satisfy the letter of the obligation while leaving the substance unexamined.

The most expensive compliance mistake is not failing to train your workforce. It is buying a programme that does not actually satisfy Article 4 and discovering that in a regulatory investigation — having already paid for compliance and received none.

Eleven weeks is enough time to do this carefully. It is not long enough to do it carelessly twice.

If you are evaluating AI literacy programmes before August 2 and want a second opinion on whether your approach actually satisfies Article 4, that is exactly what the Second Opinion is built for.