Your team is almost certainly using AI already. Whether it is official policy or not, someone in your business is pasting customer data into ChatGPT, using Copilot to draft emails, or running reports through an AI tool they found online. That is not a criticism — it is reality.
The problem is that since August 2025, the EU AI Act has required every business using AI to ensure its staff have sufficient AI literacy. Not awareness. Not vague familiarity. Literacy. From August 2026, the full risk-based compliance framework kicks in.
Why UK Businesses Should Care About EU Legislation
The EU AI Act applies to any business that places AI systems on the EU market or uses AI systems that produce effects within the EU. If you have EU-based clients, partners, or any operational touchpoint with Europe, you are likely caught.
Even purely UK businesses face the same direction of travel. DSIT has been consulting on AI governance frameworks throughout 2025 and 2026. Waiting for UK rules before acting is like waiting for the fire alarm before checking the smoke detectors.
What "AI Literacy" Actually Means
Under Article 4 of the EU AI Act, providers and deployers of AI systems must ensure that staff have a sufficient level of AI literacy. The assessment of "sufficient" takes into account technical knowledge, experience, education, the context of use, and the people affected.
For a UK service business, this translates into three practical questions:
- Do your people know what the AI is doing? If a handler is using an AI tool to draft client correspondence, do they understand whether it is generating from training data or retrieving from verified sources?
- Do your people know when to override? Review without understanding is just rubber-stamping. The reviewer needs to know what to check and when to reject the output entirely.
- Can you prove it? A documented answer — policy, training records, approved tools — beats "we told people to be careful."
The Risk Is Not Abstract
In legal services, the SRA has flagged AI-generated content as a competence concern. Solicitors submitting AI-drafted arguments with fabricated case law have faced professional consequences.
In insurance, handlers using general-purpose AI to draft claim responses risk including information that is plausible but wrong. The EU AI Act classifies AI used in employment, insurance, and access to essential services as "high risk", with the strictest obligations.
Five Things to Do Now
- Audit what your team is actually using. Not what's in IT policy. What people actually do.
- Approve specific tools for specific tasks. Blanket "no AI" is unrealistic; blanket "use anything" is reckless.
- Train your team on the tools they actually use. Document it.
- Check your data flows. Where does data go? UK or overseas? Used for training? Retained?
- Review quarterly. Best practice today may be a minimum requirement in six months.
The Competitive Angle
Clients are starting to ask. "How do you use AI?" appears in tender documents. "What safeguards do you have?" is becoming standard procurement. Businesses that can answer clearly will stand out from those that cannot. Compliance is a differentiator.
Frequently Asked Questions
- Does the EU AI Act apply to UK companies?
- Yes, where they place AI systems on the EU market or where AI outputs produce effects within the EU. UK companies with EU clients, partners, or operations are typically caught.
- When did AI literacy requirements take effect?
- Article 4 (AI literacy) has applied from 2 August 2025. The full risk-based framework applies from August 2026.