EU AI Act Article 4: what AI literacy requires of companies
Article 4 is the AI Act duty that reaches almost every company using AI. It asks for measures, not certificates, and it has been enforceable by national authorities since August 2026.
Contents
Most of the EU AI Act concerns providers of high-risk systems. Article 4 is different: it reaches every company that uses AI at work. It asks for measures, not certificates, and since August 2026 national authorities can enforce it.
The question companies are asking
Since February 2025, compliance teams have received a steady stream of offers for "AI Act certified" courses. The obligation behind them is shorter and less prescriptive than the marketing suggests, and it changed in 2026. The European Commission's AI literacy Q&A, last updated on 20 October 2026, reflects the Digital Omnibus amendments that entered into force in mid-July 20261. Many training offers and policy templates still quote the earlier wording.
What the law says
Article 4 originally required providers and deployers of AI systems to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff2. As amended, the Commission summarises the duty as taking measures to support the development of AI literacy of their staff, with no specific level mandated1.
| Question | Answer from the Commission |
|---|---|
| Who is covered | Providers and deployers of AI systems; "other persons" under the organisation's remit, such as contractors and service providers1 |
| Since when | 2 February 20253 |
| Enforced by | National market surveillance authorities, not the EU AI Office, from 2 August 20261 |
| Certificate required | No; "no strict requirements or mandatory trainings are imposed"1 |
| Records required | Not mandated; an internal record of trainings and initiatives is possible1 |
| Exception | Staff training for human oversight remains required for deployers of high-risk systems1 |
| Penalties | Possible, and must be proportionate to gravity and intent1 |
A company is a deployer if it uses an AI system under its authority; only personal, non-professional use is excluded2. A company whose staff use a chat assistant, an AI feature in its CRM or an AI agent is therefore within scope.
What a proportionate programme looks like
The Commission lists what an organisation should consider: a general understanding of AI within the organisation, whether it acts as provider or deployer, the risks of the AI systems it uses and what staff need to know to mitigate them, and the existing knowledge of staff together with the sector and purpose of use1. That translates into three layers.
- Everyone. What the approved tools are and how they work, typical errors (invented facts, outdated information, confident tone), the data rules and how to report an incident. One hour, repeated yearly.
- Tool owners and approvers. How each agent is configured, what its "Always", "Ask" and "Never" actions are, how to read its activity record and when to escalate. Specific to each system.
- Leaders. Where AI is used across the company, the main risks, the regulatory timetable and what the company would show a regulator. Short and annual.
The approach above maps to clause 13 of our template, which commits to initial training within 30 days, annual refreshers, role-specific training for tool owners and a training record.
Common mistakes
- Buying a certificate instead of building understanding of your own tools. A generic course does not explain the data terms of the tools staff actually use, which is where most errors happen.
- Training once. The tools change faster than an annual cycle; the Commission's own timetable for high-risk rules moved in 20263.
- Forgetting contractors. The Commission's reading of "other persons" includes contractors and service providers1.
- Training without controls. Literacy reduces errors but does not prevent them. IBM's 2025 study found that 97% of organisations with AI-related breaches lacked AI access controls4.
A 30-day plan
- List the AI systems in use and who uses each one. This doubles as the tool register in the policy.
- Decide the three layers above and who delivers each: internal staff can run most sessions with the vendor's documentation.
- Run the all-staff session within the month, using screenshots of your own approved tools and your own data rules.
- Brief tool owners individually on the agents they own and the approvals they give.
- Record attendance and content in a simple register kept with the policy.
- Set the refresh date and attach it to the policy's review cycle.
At the end of the month the company can show, if asked, which AI systems it uses, what each group of staff was taught about them and when. That is what "measures" look like in practice, and it is the same evidence that makes the rest of an AI policy credible.
Questions buyers ask
Does Article 4 of the AI Act apply to my company?
If your company uses AI systems in its work, it is a deployer, and Article 4 applies. The definition of deployer covers any person or organisation using an AI system under its authority, except for personal, non-professional use.
Is AI literacy training mandatory under the AI Act?
The European Commission says no specific training or certificate is mandatory. Companies must take measures to support their staff's AI literacy, suited to their context. Training remains required for staff overseeing high-risk AI systems.
When is Article 4 enforced?
The obligation has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026, and any penalty must be proportionate to the gravity of the infringement and whether it was intentional or negligent.
Do we need to keep records of AI literacy training?
Formal records are not mandated, according to the Commission, but organisations can keep an internal record of training and other initiatives. A record is the simplest way to show what measures were taken.
Sources
- AI Literacy: Questions & Answers. European Commission, 20 Oct 2026. Accessed 8 Nov 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act). EUR-Lex, Official Journal of the European Union, 12 Jul 2024. Accessed 8 Nov 2026.
- AI Act: regulatory framework for AI. European Commission, 19 Oct 2026. Accessed 8 Nov 2026.
- IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls. IBM Newsroom, 30 Jul 2025. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published, reflecting the Commission's Q&A as updated on 20 October 2026.