What does this mean?

In our first article in this series we gave an overview of the key elements of the Act, summarising the headline points. Our second article looked at the fundamental question of who has to comply.

As we mentioned in our second article, one of the obligations requiring earliest compliance, found under Article 4 of the Act, is for in-scope organisations to implement ‘AI literacy’ measures by 2 February 2025.

‘AI literacy’ means the skills, knowledge and understanding that allow providers, deployers and others, taking into account their respective rights and obligations under the Act, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.

“Article 4  –  AI literacy

Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”

Who does it affect?

Providers are individuals or organisations that develop, or commission the development of, an AI system or general-purpose AI model and place it on the market or put the AI system into service under their own name or trademark.

Deployers are individuals or organisations using an AI system for professional purposes.

Crucially, non-EU based businesses will be caught if they put an AI system into service or place it or a general-purpose AI model on the EU market, or the output produced by the AI system is used there. This is likely to affect most UK businesses that work with the EU, across all industries, as use of AI tools becomes more and more commonplace.

Note that the AI literacy requirement applies regardless of the risk category of the AI system in question.

What do you need to do?

In practice, this means implementing appropriate training programmes and policies and procedures to ensure compliance – not only in respect of staff members but also any other parties dealing with the operation and use of AI systems on the provider’s or deployer’s behalf.

Compliance measures will include:

• Reviewing contractual arrangements with third parties and allocating responsibility accordingly
• Assessing current AI literacy levels, taking account of roles and exposure to AI systems
• Designing and implementing mandatory training
• Establishing internal policies and procedures
• Keeping updated on AI developments and refreshing training and policies and procedures accordingly
• Maintaining records of the decisions and steps taken.

When?

The AI literacy requirement applies from 2 February 2025.

Providers and deployers should make every effort to have measures in place before this date. If you haven’t already started, it’s not too late.

Penalties for non-compliance

The Act doesn’t specify penalties for non-compliance with Article 4, but there are provisions for administrative fines of up to €35,000,000 (or 7% of total worldwide annual turnover, if greater) for other infringements. A decision as to whether to impose such a fine will take into account ‘all relevant circumstances of the specific situation’.

It’s therefore possible that a failure to properly implement or evidence AI literacy measures could impact the severity of any enforcement action.

The wider picture and how we can support you

On 13 January the Prime Minister announced a hugely ambitious AI Opportunities Action Plan to ‘unleash’ AI across the UK as a key feature of the government’s growth agenda. While there are no plans to introduce specific legislation similar to the EU AI Act (with the UK preferring a flexible, pro-innovation approach to regulation), the focus on safe and trustworthy AI remains, and this is part of a global conversation.

While there’s no current UK equivalent to the EU’s AI literacy requirement, it’s therefore likely that a similar standard will begin to emerge. This means that, even if you don’t do business in the EU, it would be prudent to follow the spirit of the Act and start to think now about implementing similar measures.

Developments are happening at pace, and the EU AI Act is a long and complex piece of legislation. We’ll be running a webinar on the Act on 11 February to help you navigate the regulatory landscape and prepare your business. Please join us.

In the meantime, if you have any concerns or need support regarding the effect of AI on your business and your compliance with the Act, please get in touch with our experts Sally Mewies, Matthew Lingard or Paul Armstrong. Click here to access our guide on demystifying AI.