Article 4 and Your Charity: You're Already Non-Compliant (Here's What to Do About It)
The EU AI Act's AI literacy obligation took force on 2 Feb 2025. Enforcement is on 2 August 2026. Why most UK charities are already non-compliant — and a 90-day plan to fix it.
The EU AI Act's AI literacy obligation has been in force since 2 February 2025. Enforcement begins on 2 August 2026. Most UK charities still think this is a future problem. It isn't.
The conversation that gets uncomfortable fast
We start most charity engagements with a simple question. "What AI training has your team had?"
The answers usually fall into three categories.
"None formally, but the team has played with ChatGPT."
"We did a webinar last year. I think most people watched it."
"We're planning something for next year."
All three are the same answer. None of them are compliant with Article 4 of the EU AI Act, which has applied to UK charities with any EU exposure since 2 February 2025.
Article 4 has been in force for more than fifteen months. Its supervision and enforcement begins on 2 August 2026. That is roughly twelve weeks from publication of this article.
If your charity has any staff, beneficiaries, partners, or operations touching the EU, and you have no documented AI literacy programme in place, you are currently non-compliant with an active EU regulation.
That is not a hypothetical. That is the present state.
What Article 4 actually says
Article 4 is short. The text fits on a page. The summary fits in a sentence.
Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education, and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
Five things follow from that paragraph.
It applies to deployers. Almost every UK charity that uses ChatGPT, Microsoft Copilot, Claude, Gemini, or any other AI tool is a deployer under the Act. That includes free tiers.
The obligation is on the organisation. Not on individual staff. The charity is responsible.
It covers more than staff. "Other persons dealing with the operation and use of AI systems on their behalf" includes contractors, freelancers, volunteers, and in some cases service providers. The European Commission has confirmed this.
The standard is "sufficient level." Not perfect. Not exhaustive. But proportionate to the role, the context, and the people affected.
The standard is enforceable. From 2 August 2026, national market surveillance authorities can act on non-compliance.
The penalty under Article 4 falls under the general infringement tier of the Act: up to €7.5 million or 1.5% of global annual turnover, whichever is higher. These are theoretical maximums and unlikely to be applied to a small charity in their headline form. But that is not the real risk.
The real risk for UK charities
A regulator probably will not fine your charity €7.5 million for not training your fundraisers on AI literacy. That is not how Article 4 enforcement is likely to work in practice.
What will happen is more pedestrian and more damaging.
The next time something goes wrong with an AI tool, the absence of literacy training becomes the aggravating factor. A staff member pastes beneficiary data into a public tool. A fundraiser submits a grant application with fabricated statistics. A safeguarding officer asks ChatGPT to summarise a case note. Each of these is its own breach. None of them require a regulator to invoke Article 4 to make your charity uncomfortable.
But when the data protection regulator asks what literacy training was provided, or the Charity Commission asks how trustees oversaw AI risk, the answer "we didn't have a programme" turns a recoverable incident into a serious finding.
The next time a funder does due diligence, the absence of literacy training becomes a procurement question. Funders in the UK and EU are already starting to ask charities about their AI policies and staff training. Not all of them, not consistently, but the trend is one-way. A charity that cannot answer "we have a 4Ps-aligned literacy programme, here is our policy, here is our training register" is a charity at a procurement disadvantage compared to one that can.
The Cruz v. Fireflies.AI case is exhibit A. The plaintiff in a December 2025 US class action was a participant in a virtual meeting hosted by an Illinois nonprofit. The nonprofit's staff member enabled an AI meeting bot. The bot generated a voiceprint of the plaintiff. The plaintiff alleges she never consented.
The nonprofit's exposure here is not because Fireflies is a bad tool. It is because the staff member who enabled it did not understand what they were doing, was not trained on consent obligations, and the nonprofit had no documented AI tool approval process. That is an AI literacy failure. The lawsuit is the consequence.
What "sufficient level" looks like in a charity
The Act does not prescribe a syllabus. That is deliberate. AI literacy needs to be proportionate to the role and context.
But it does prescribe an outcome. The people in your charity using AI need enough understanding to make informed decisions, to recognise risks, and to act safely.
In practice, "sufficient" for a UK charity means each relevant person can answer questions like these about the AI they use:
- What is this tool actually doing when I use it?
- Where does my input go?
- What can it get wrong, and how would I notice?
- What am I allowed to put into it, and what am I not?
- Who in our charity is accountable for this?
- What do I do if I am not sure?
A fundraiser drafting grant copy needs less depth than a service manager using AI to inform case decisions, but both need to be able to answer those six questions about the tools they use.
"Sufficient level" is also evidenced. The Act will be enforced on documentation, not intention. If your charity has trained your team but cannot demonstrate that training happened, you are in the same position as a charity that did nothing.
That means a training register. A list of who attended what, when. A policy that names approved tools. A documented review cycle.
None of this is sophisticated. All of it is the kind of evidence that needs to exist before 2 August 2026.
What to do this week
If your charity has no AI literacy programme, twelve weeks is enough time to put a defensible one in place. Not a perfect one. A defensible one.
Here is the sequence we use with clients.
Week 1: Map your exposure. Run the [EU AI Act Applicability Checker] to confirm whether and how the Act applies to your charity. If you have any EU touchpoints, Article 4 applies in full. Even if you have none, the literacy obligation is becoming the de facto sector standard regardless.
Week 2: Audit your AI use. Walk every team. List every AI tool actively in use. Include the unofficial ones (someone has a personal ChatGPT account; the comms officer uses Copilot Chat; the volunteer coordinator uses a tool nobody has approved). Without this list, you cannot define the scope of training.
Week 3: Brief your trustees. Article 4 is a governance obligation. Trustees need to know it applies, what the charity's exposure is, and what is being done. Ninety minutes is enough for a properly-structured briefing. A guide to what should be in that briefing is [here].
Weeks 4 to 6: Write or refresh your AI policy. One page is fine if it covers the essentials. Run it through the [4Ps Framework]. Get trustee approval. Add an approved tools list.
Weeks 6 to 10: Deliver foundational literacy training. Generic at this stage is acceptable if it covers what AI is, what it gets wrong, what your charity allows and does not, and where to go for help. Document attendance.
Weeks 10 to 12: Layer role-specific training. Start with the staff group whose AI use is highest stakes. For most charities that is fundraising or service delivery. Train them properly. Document it.
Beyond week 12: Maintenance. Set a quarterly review cycle. Refresh the policy annually. Add AI to standing trustee agendas.
This is achievable for a charity of any size with focused effort. It is not achievable as a side-of-desk project for someone who already has a full job.
The honest read
Most UK charities will not do this work in the next twelve weeks. Most of them do not know they need to. By the time the first enforcement action surfaces in late 2026 or 2027, the sector will scramble.
Your charity has a choice. Move now and be in the front quarter of the sector with a defensible programme. Move later and join the scramble.
The work is not technically hard. It is the kind of governance discipline charities apply routinely to safeguarding, data protection, and finance. AI literacy is the next item on that list.
The 4Ps Framework gives you the structure. The Applicability Checker tells you whether the obligation reaches your charity. The Tool Review Agent helps you operationalise approved tools. The pieces fit together. The question is whether your charity puts them in place before August 2026, or after.
If you would like help with the work, [book a call]. If you would rather do it yourself, we have written most of the materials you need across this site. Either is better than waiting.
This article is informational and does not constitute legal advice. The EU AI Act applies to UK charities with EU exposure under its extraterritorial reach. Where specific compliance questions arise, qualified legal advice is recommended in addition to operational support.
Similar Posts
Forget prompting tutorials. Every person on your charity payroll needs to understand four things about AI before they use it for anything. The plain-language briefing for staff who never had the training.
Twenty-eight per cent of charity boards admit poor digital skills. Most have had no briefing on AI. With Article 4 enforcement weeks away, this is the plain-English briefing your trustees should have had a year ago.
Two-hour ChatGPT masterclasses are the default in the charity sector — and the most common reason AI literacy fails to land. Why generic doesn't work and what role-specific training looks like.