Let’s talk about the paragraph in the EU AI Act that made ignorance of the machine a legal risk — and why almost nobody has read it.
Two weeks ago, the high-risk rules went live. The coverage was all about the machines. Which systems now need risk management. Which need documentation. Which need stamps and oversight. Fair enough. That’s where the press releases live.
But there’s a paragraph in that same law that went live eighteen months ago, and it isn’t about the machines at all. It’s about you. Article 4. The AI literacy duty.
Here’s what it actually says. Every company that provides or deploys AI has a legal obligation to make sure the people working with it understand it. Not vaguely. Sufficiently. Taking into account who the staff are, what the system is doing, and — here’s the clause nobody mentions — the people the system is being used on.
Think about that for a second. The law didn’t tell the machine to explain itself. It told the people running the machine to understand it. A year and a half before the high-risk rules the whole world is writing about.
So where are we, eighteen months later? Almost nobody knows the article exists. And almost nobody is complying.
Picture the human scene. A mid-sized company buys an AI tool — screening applications, routing customers, scoring something. The vendor sends a training deck. Thirty slides. A quiz at the end. Everyone clicks through, everyone passes, and the company files the certificate and never thinks about it again.
That’s not literacy. That’s theatre with a login. The people who just finished the course can’t tell you what data goes into the model. Can’t tell you when the machine is deciding about a person. Can’t tell you how to override it. Can’t tell you who answers for it when it’s wrong. They know the brand name of the tool and the colour of the logo.
And that’s exactly the gap the law was pointing at. Because an operator who understands the machine is dangerous — to the machine’s owners.
Think about what real literacy would look like. You know what the system is fed, so you can see the bias before it becomes a headline. You know when it’s deciding about a person, so you stop rubber-stamping its output. And you know who answers for it — so “the algorithm did it” stops being a sentence anyone in the building can get away with.
Every one of those is a shift in power. And power is the one thing the AI industry is not going to hand you in a training deck.
Now the honest part. Article 4 doesn’t carry one of those giant fines the headlines love. It’s not in the penalty schedule. It’s enforced the slow way — through supervision, through audits, through the growing stack of questions a person can now legally ask about the machine that runs their life.
That’s the detail people are missing. The provisions with the biggest fines get the compliance budgets. The provisions with the quietest enforcement get ignored. And Article 4 is the quietest one in the whole law. So the duty that actually hands you the tools to challenge the machine is the one everyone is skipping.
So here’s the operator lesson, for anyone running AI this year. Don’t wait for the regulator to define literacy. It means your people can answer four questions about every tool you deploy. What goes in? When does it decide about a person? How do we override it? Who answers for it? If your team can’t answer all four, your training budget bought a certificate, not understanding.
And if you’re the one on the other side of the machine — the applicant, the patient, the customer — you now have a legal text on your side that nobody is using. Ask the questions. What does the system use to decide about me? Can a person overrule it? Who is responsible? The law made those questions legitimate. Asking them is how the duty becomes real.
The principle underneath is old, and it survived every technology that tried to replace it. You cannot consent to what you do not understand. You cannot challenge what you cannot name.
The law gave the people running the machine a duty, eighteen months ago. It’s sitting there, unread, while the training decks pile up. The law handed you the lever. Most people are still waiting for someone else to pull it.