The clause almost
nobody read.

There's a moment that happens in nearly every session, and it never gets old.

I get to the risk part of the day, where we cover what the EU AI Act actually means for the people in the room. I don't put legislation on a screen, nobody in Wigan wants to sit through that, I just explain it straight: if your job involves using AI, your employer has to make sure you're trained for it properly, matched to what you actually do. Somewhere in that explanation, a practice manager near the back goes quiet.

She's just worked out what I'm actually telling her. Not a nice idea. Not something a trade body suggested. A legal duty, and it's been live since February 2025.

What Article 4 actually asks

In plain terms: if your organisation uses AI, you have to make sure the people using it actually understand it, and that understanding has to match their technical knowledge, their experience, their training, and the job they're using AI for.

Read that last bit again, because it's where most firms trip up. The law doesn't care if your staff sat through a webinar once. It cares whether the training matched the person and the job. A conveyancer running Copilot over lease documents and a marketing exec drafting posts in ChatGPT carry different risks, and under Article 4 they need different training. One generic session for everyone doesn't cover either of them, never mind both.

And the clock hasn't stopped. This August, the next wave of the Act's rules lands for high-risk systems. Every month that goes by, "we haven't got round to it" sounds a bit thinner, whether it's a regulator asking, an insurer asking, or a client asking.

One thing worth knowing, because I'd rather you heard it from me than found out later I'd left it out. The EU's Digital Omnibus reform has now passed both Parliament and Council. Once it's published, expected before 2 August 2026, the wording softens a bit. Instead of a duty to ensure staff are AI literate, it becomes a duty to support that happening. Real difference on paper. Still a duty either way.

That doesn't get anyone off the hook. Whichever wording is live on the day someone asks, a training session nobody remembers by Friday still won't answer for you. That practice manager's problem was never really about one phrase in one regulation. It was that nobody at her firm could point to anything at all.

The good news nobody expects

Here's what I told her once she'd stopped swearing. Meeting Article 4 properly isn't a big job. Role-specific training costs less, takes less time, and works better than the generic kind, because people learn on the work they actually do. The training your team needs anyway, to stop the daft mistakes and start using AI properly, is the same training the law is asking for. Do it once, get both.

What doesn't work is doing nothing and hoping it stays theoretical. Laws like this stay theoretical right up until the afternoon they're not, usually attached to an incident, a complaint, or a renewal form with a new question on it.

If you've never looked at Article 4, take the five minutes. And if your answer to "what training have your staff had?" is a bit of an awkward silence, let's talk before someone else asks you the question first.