The EU AI Act is often discussed as a compliance framework, but for executives its first visible impact may be commercial rather than legal. As European customers tighten supplier expectations around AI use, companies will increasingly be asked to prove that their people understand how AI is being used, where the risks sit, and how those risks are controlled. This article examines why Article 4 is likely to surface inside the sales cycle, how procurement turns regulatory obligations into revenue friction, and what leadership teams should have ready before the next customer asks.
Most executives will not first experience the EU AI Act through a regulator.
They will experience it through a customer.
A procurement questionnaire arrives late in the sales cycle. Legal forwards it to security. Security sends part of it to HR. HR asks L&D whether anyone has completed “the AI course.” Three days disappear. Then six.
The deal was supposed to be in commit.
Now it is waiting on an answer nobody owns.
That is the commercial shape of Article 4.
Article 4 has applied since 2 February 2025. It requires providers and deployers of AI systems to take measures that support AI literacy among staff and other people who operate or use AI systems on their behalf.
The wording matters.
This is not limited to employees. Contractors, delivery partners, outsourced operators and other third parties may matter when they use AI for the organisation. Nor is Article 4 reserved for high-risk systems. It reaches ordinary enterprise AI use as well.
The 2026 amendments changed an important detail: Article 4 no longer prescribes a specific “sufficient level” of literacy. That removed one source of ambiguity, but it did not erase the obligation to act.
Your customer still has to decide whether its AI-literacy measures are credible.
When your people operate AI as part of the service being sold, your customer may need evidence from you to make that judgment.
Executives often ask whether the EU AI Act applies directly to a company headquartered outside Europe. That is a legal scoping question, and it deserves a legal answer.
Commercially, however, the border question is incomplete.
European customers write their obligations into supplier standards, data-processing terms, AI addenda, control questionnaires and contract schedules. A supplier may feel the law indirectly before counsel concludes that a regulator has direct jurisdiction.
That is how operational requirements travel: not as theory, but as a clause.
The customer asks:
A company with a coherent answer keeps the deal moving.
A company with an LMS completion report starts a debate.
Training records are useful. They show that an activity happened.
They do not show that the activity was relevant to the work, that the person understood the risks, or that the organisation has defined how AI should be used in practice.
Procurement reviewers know the difference.
So do customers who have watched an AI-generated answer move through a workflow unchecked.
The weak response sounds like this:
We provide annual AI-awareness training to all employees.
The stronger response is operational:
We identify the roles that use AI, define the decisions and risks associated with each role, prepare people for those situations, and retain evidence of participation and demonstrated performance.
That answer is harder to produce because it requires more than content. It requires operating clarity.
It is also far more defensible.
The Digital Omnibus delayed major requirements for high-risk AI systems. Stand-alone Annex III obligations now apply from 2 December 2027, while requirements for high-risk systems embedded in regulated products move to 2 August 2028.
Those are meaningful changes.
They do not mean the entire AI Act was postponed.
Article 4 was already applicable. Key transparency requirements under Article 50 remained on the 2026 timetable. Treating the Omnibus as a universal pause is not a conservative interpretation. It is a category error.
This matters because old guidance is still circulating inside companies.
A slide says “AI Act delayed.”
A leader hears “no action required.”
A customer asks for evidence.
The sales team discovers the difference.
That is avoidable.
Fines attract attention because they are visible and dramatic. They are not always the most immediate economic exposure.
For many companies, the nearer-term cost is slower revenue:
The exact cost will not appear in a regulatory budget. It will show up as sales-cycle variance.
That makes Article 4 a revenue-operating issue, not merely a learning or compliance issue.
Do not begin with geography. Begin with the work.
Look at managed services, implementation, support, analytics, content production, advisory work and any delivery process where an employee or contractor uses AI to create an output for a customer.
That is the practical exposure map.
Not what could be created in six weeks.
What exists now?
If the answer is a policy, a course certificate and several verbal explanations, the organisation does not yet have an evidence pack. It has source material for one.
Article 4 sits between functions.
Legal interprets the obligation. L&D may build learning. Operations understands the work. Risk defines controls. Sales experiences the consequence.
Without a named owner, every customer request becomes a temporary project.
That is expensive by design.
The best response is not a heroic procurement scramble.
It is a reusable operating system:
This does more than support compliance.
It improves customer confidence. It reduces internal confusion. It gives sales a credible response before the questionnaire arrives.
And in a market full of vague claims about responsible AI, operational evidence differentiates.
That is the real executive opportunity.
Article 4 may begin as a legal requirement. In the sales cycle, it becomes a test of whether your company can explain how its people use AI—and prove that the explanation is real.
See what a defensible response can contain. The Cognistry EU AI Act overivew walks through exposure mapping, role-based capability development, practice and evidence.