If you ignore it
What happens if you ignore it.
The page to send a director who asks what the penalty is. The straight answer, then the four duties under which an organisation with nothing to show is exposed.
A duty without a fine of its own.
Article 4 carries no fine of its own. It is not on the Article 99 list, and Ireland's Regulation of Artificial Intelligence Act 2026 attaches no notice or fine to it. If a provider has told you otherwise, they were wrong.
It is still a legal duty, and the exposure sits in the Irish law around it. When something goes wrong with AI in your organisation, the first question is what your people were told. The second is whether you can show it.
Companies Act 2014, s.228(1)(g)
Directors' duties
Directors must exercise the care, skill and diligence of a reasonable person in their position. If staff are using AI tools the board has never looked at and one of them goes wrong, a dated record is how the board shows it did look.
GDPR Articles 29, 32 and 83(4)
Data protection
Staff who paste customer or member data into a chatbot are processing personal data, and they may only do so on your instructions. The Data Protection Commission's own guidance flags personal data that employees input to AI tools as a risk. Security of processing sits in the GDPR tier of up to €10 million or 2% of turnover.
Central Bank Reform Act 2010, s.53E
Regulated firms and credit unions
Fitness and probity applies to credit unions, and the Conduct Standards require people in controlled functions to act with due skill, care and diligence. The Central Bank's 2026 outlook says technical competence is required from those using AI tools.
AI Act Articles 50 and 99(4)
Transparency, which does carry fines
Article 50 has applied since 2 August 2026. Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest. Breaches sit in the tier of up to €15 million or 3% of turnover. Staff who have never heard of the rule are how it gets broken.
A written record does not make any of these duties go away. It is what you show when one of them is tested.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
Related insights.
Enforcement
What happens if we ignore Article 4 of the EU AI Act?
Article 4 carries no fine of its own, under Article 99 or under Ireland's Regulation of Artificial Intelligence Act 2026. The exposure sits in the Irish law around it: directors' duties, data protection, Central Bank conduct standards and Article 50.
Records
What record should we keep to show we met Article 4?
Keep an internal record of the training and guidance you provided: what was covered, who attended, when, and why that depth suited those roles. The Commission says no certificate is required and that organisations can keep an internal record instead.
Scope
Does Article 4 cover contractors and agencies working for us?
Yes. Article 4 covers people who deal with AI on your behalf whether or not they are on your payroll, so your measures should reach contractors, service providers and agencies too, in proportion to the systems they touch.
Sources
Checked against the sources below on 1 October 2026.
- Regulation (EU) 2024/1689, the AI Act, Articles 4, 50 and 99
- Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026)
- Companies Act 2014, section 228
- Data Protection Commission, AI, large language models and data protection
- Central Bank of Ireland, Individual Accountability Framework
- Central Bank of Ireland, Regulatory & Supervisory Outlook 2026