EU AI Act Article 4 AI literacy requirements

What Article 4 says now

Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced Article 4 of the AI Act. It was published in the Official Journal on 24 July 2026 and entered into force on the third day after publication, 27 July 2026.

The new Article 4(1) says providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and other persons dealing with the operation and use of AI systems on their behalf. It adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

The original 2024 text required measures to ensure, "to their best extent, a sufficient level of AI literacy". The duty itself remains: the Commission's Q&A says AI literacy "remains an obligation for providers and deployers", but no specific or "sufficient" level is mandated.

Article 4(2) and (3) are new. The Commission and Member States must support organisations, in particular SMEs, and the Commission will publish practical examples of how to comply. The European Artificial Intelligence Board will adopt recommendations, including common objectives.

Who it applies to

Article 4 applies to providers (organisations that develop AI systems) and deployers (organisations that use them). It is not limited to high-risk AI. The Commission's Q&A says a company whose employees use a generative AI chatbot to write advertising text or translate is in scope, and staff should be told about risks such as hallucination.

It covers staff and "other persons" operating or using AI systems on the organisation's behalf. The Commission gives contractors, service providers and clients as examples. Organisations outside the EU are covered too when their AI system is placed on the EU market, used in the EU or affects people in the EU.

What the programme should cover

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow people to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and the possible harm it can cause. Article 4 says measures should take into account people's technical knowledge, experience, education and training, the context of use, and the people on whom the AI systems are used.

The Commission's Q&A says organisations should consider at least:

1. A general understanding of AI: what it is, how it works, what AI the organisation uses, and its opportunities and dangers
2. The organisation's role: whether it develops AI systems (provider) or uses systems built by others (deployer)
3. The risk of the AI systems provided or used, and what staff need to know about those risks and how to reduce them
4. Actions built on that analysis, taking account of differences in people's knowledge and experience and the sector and purpose the AI is used for

The Q&A adds that these points include legal and ethical aspects, so covering the AI Act itself and principles of ethics and governance is encouraged.

How often and in what format

Article 4 sets no frequency and no fixed format. The Commission says there is "no one size fit all" and "no strict requirements or mandatory trainings are imposed". What is needed depends on the context and on any recommendations the AI Board adopts.

The Commission also says that simply relying on the instructions for use, or asking staff to read them, may be ineffective in many cases. Training can vary in depth for different groups. Its living repository of AI literacy practices shows formats from e-learning to in-person training, but copying a practice from it does not automatically mean you comply.

Refreshing training when AI tools or uses change is good practice, not a set legal interval.

Extra training for high-risk AI

Deployers of high-risk AI systems have a separate, stricter duty. Article 26(2) requires them to assign human oversight to people who have "the necessary competence, training and authority". The Commission's Q&A confirms this obligation remains after the Digital Omnibus. Under the amended Article 113, these high-risk obligations apply from 2 December 2027 for Annex III systems (for example some recruitment and worker-management uses) and 2 August 2028 for Annex I systems.

Who enforces it

National market surveillance authorities, not the EU AI Office, supervise and enforce Article 4. The Commission says they start supervising and enforcing the rules from 2 August 2026.

Article 99 sets specific maximum fines for prohibited practices (Article 5) and for listed obligations such as Articles 16, 26 and 50. Article 4 is not on those lists. Penalties for an Article 4 breach would come from national rules under Article 99(1), which must be effective, proportionate and dissuasive. The Commission says sanctions are more likely where an incident shows a lack of appropriate training and guidance.

What records to keep

The AI Act does not require a certificate. The Commission's Q&A says organisations "can keep an internal record of trainings and/or other guiding initiatives". Article 4 also does not require you to measure employees' AI knowledge, though an assessment can help show that your measures fit people's level.

Sources

• Regulation (EU) 2024/1689 (AI Act), Articles 3(56), 4, 26, 99 and 113
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1(5), (38) and (40)
• European Commission, AI Literacy: Questions & Answers