Enforcement

What happens if we ignore Article 4 of the EU AI Act?

Article 4 carries no fine of its own, under Article 99 or under Ireland's Regulation of Artificial Intelligence Act 2026. The exposure sits in the Irish law around it: directors' duties, data protection, Central Bank conduct standards and Article 50.

Danny McCabe

What happens if we ignore Article 4 of the EU AI Act?

What happens if we ignore Article 4 of the EU AI Act?

Article 4 carries no fine of its own. It is not in the Article 99 fine tiers, and Ireland's Regulation of Artificial Intelligence Act 2026 attaches no contravention notice or fine to it. It is still a legal duty, and the realistic exposure sits in the Irish law around it, and in being unable to show a documented measure when a regulator, a customer or a court asks for one. Nobody should tell you a fine is imminent. Nobody should tell you there is nothing to worry about either.

Does Article 99 fine Article 4 directly?

No. Article 99 of the AI Act sets three tiers of administrative fine. Up to 35 million euro or 7 percent of worldwide turnover for the prohibited practices in Article 5. Up to 15 million euro or 3 percent for a listed set of obligations, which names Articles 16, 22, 23, 24, 25, 26, 31, 33, 34 and 50. Up to 7.5 million euro or 1 percent for supplying incorrect or misleading information to authorities. Article 4 is not on the second list. What Article 99(1) does say is that Member States shall lay down the rules on penalties and other enforcement measures for any infringement of the Regulation by operators, and that those penalties must be effective, proportionate and dissuasive. So the penalty for Article 4 is a national question.

Who enforces it in Ireland, and with what?

The Commission's Q&A on AI literacy states that supervision and enforcement of Article 4 sit with national market surveillance authorities, not the EU AI Office, and that those authorities supervise and enforce from 2 August 2026. It adds that any sanction must be proportionate, based on the individual case, and take into account the nature and gravity of the infringement and whether it was intentional or negligent.

In Ireland, the Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026. It designates existing sectoral regulators as market surveillance authorities, coordinated by the AI Office of Ireland, Oifig IS na hÉireann. The Department of Enterprise, Tourism and Employment describes the enforcement toolkit as structured and proportionate, moving from cooperative compliance through notices to coercive measures such as prohibition and seizure, and then to formal sanctions including fines and prosecution. The Act also caps fines on public bodies at 1 million euro. Read the Act itself and Article 4 is not named. Contravention notices under section 71 cover Articles 16, 23, 24, 26, 27(3) and 50, and the fine and adjudication provisions cover the obligations listed in Article 99(3) to (5). None of that reaches Article 4 directly.

Where Irish law does bite

  1. Directors' duties. Section 228(1)(g) of the Companies Act 2014 requires directors to exercise the care, skill and diligence of a reasonable person with the knowledge and experience expected of someone in their position. If staff are using AI tools the board has never looked at and one of them goes wrong, a dated record is how the board shows it did look.
  2. Data protection. Staff who paste customer or member data into a chatbot are processing personal data, and under Article 29 of the GDPR they may only do so on the controller's instructions. The Data Protection Commission's July 2024 guidance flags personal data that employees input to AI tools as a risk. Security of processing under Article 32 sits in the Article 83(4) tier of up to 10 million euro or 2 percent of turnover.
  3. Central Bank conduct standards. The fitness and probity regime applies to regulated firms including credit unions, and the Conduct Standards in force since 29 December 2023 require people in controlled functions to act with due skill, care and diligence. The Central Bank's 2026 Regulatory and Supervisory Outlook says technical competence is required from those using AI tools.
  4. Article 50, which does carry fines. Since 2 August 2026, deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest. Article 50 is in the Article 99(4) tier of up to 15 million euro or 3 percent of turnover, and the Irish Act makes it subject to contravention notices. Staff who have never heard of the rule are how it gets broken.

Where the real exposure is

Three situations come up more often than a regulator's letter.

  1. A customer's procurement questionnaire. Larger customers, especially in regulated sectors, now ask suppliers how they meet Article 4. "We have not done anything" is a hard answer to give in a tender.
  2. An investigation into something else. If a regulator looks at a high-risk system or a transparency complaint, the state of your AI literacy measures is part of the picture.
  3. An employment or data dispute. When an AI-assisted decision is challenged, the question of whether the people involved understood the tool is a natural one for the other side to ask.

What a proportionate response looks like

The Commission's Q&A says organisations can keep an internal record of trainings and other guiding initiatives, and that no certificate is required. For most Irish organisations the right response to Article 4 is a short inventory of the AI in use, a session for the people who use it, and a written record of both. Whether you are in scope at all takes about a minute to work out. Doing the measure takes a morning.

Sources

This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.

Book a 20-minute call

More insights.