EU AI Act Article 4: What the AI Literacy Duty Requires

Article 4 of the EU AI Act asks organisations that use AI systems to take measures supporting their staff’s AI literacy. The duty has applied since 2 February 2025, national authorities gained the power to supervise most of the Act’s other obligations from 2 August 2026, and a Digital Omnibus that took effect on 27 July 2026 softened the wording of Article 4 itself. This is general information, not legal advice, and the position is stated as at September 2026.

What Article 4 actually says

Article 4 of Regulation (EU) 2024/1689, the EU AI Act, requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy among their staff and other people who operate AI systems on their behalf, taking account of their technical knowledge, experience and the context in which the systems are used. It has applied since 2 February 2025, alongside the ban on prohibited AI practices (Regulation (EU) 2024/1689, Article 4 and Article 113).

“Deployer” is a wide term. If your organisation uses an AI system in the course of its business, whether that is a bespoke model or a general purpose tool such as a chatbot, you are very likely a deployer of it.

What changed on 27 July 2026

A package known as the Digital Omnibus entered into force across the EU on 27 July 2026, published in the Official Journal as Regulation (EU) 2026/1744. It postponed several high-risk AI system deadlines: the compliance date for high-risk systems listed in Annex III moved to 2 December 2027, and the date for high-risk AI used as a safety component in regulated products moved to 2 August 2028.

The same package rewrote Article 4 itself, from an obligation to “ensure” a sufficient level of AI literacy to one to take appropriate measures to “support the development of” it, a shift from guaranteeing a result to making a reasonable effort. The transparency obligations in Article 50, covering disclosures about AI generated content and AI chatbots, took effect on 2 August 2026 as planned, the same date as most other operator obligations and the general enforcement and penalty regime (Regulation (EU) 2024/1689, Article 113).

Who has to comply

The duty falls on any organisation that provides or deploys an AI system and operates in the EU, whether or not it is based there. A UK organisation with EU customers, an EU office, or EU staff using AI systems on its behalf is in scope for that activity, even if its head office is in London or Manchester. A UK only organisation with no EU footprint is outside Article 4’s reach, though many choose to train to the same standard regardless, since the underlying problem, staff who do not understand a tool they use daily, is the same on both sides of the Channel.

“Staff and other persons” is broader than payroll: it includes contractors and anyone else who operates an AI system on the organisation’s behalf.

What happens if you do not comply

Article 4 does not carry its own fine, and it is not named in the Act’s harmonised penalty tiers under Article 99. Enforcement of a literacy failure on its own would fall to whichever general penalty rules your member state has adopted. Where it matters most is as evidence: if something goes wrong with an AI system, an inability to show that staff had been given appropriate training makes every other part of the case harder to defend, and a completed, dated training record makes it easier.

What “sufficient” looks like in practice

Neither the original Article 4 nor the amended version sets a pass mark. The Act asks for measures proportionate to the role: someone who occasionally uses a general purpose chatbot needs less than someone who configures or relies on an AI system to make decisions about other people. In practice, workable evidence looks like this:

• A foundation course for everyone who touches an AI system, covering what it is, where it is used, and how to use it responsibly.
• A deeper course for anyone who sets policy, procures AI tools, or manages people who use them, such as our AI governance training.
• Role specific training where the risk is highest, for example in HR, finance or legal teams.
• A completion record for each person, dated, and refreshed when the tools or the rules change.

Does using a general purpose tool like Copilot or ChatGPT count?

Yes. Using a general purpose AI tool at work makes your organisation a deployer of an AI system for that use, in the same way as using a purpose built one. Article 4 does not exempt off the shelf tools, and the duty is proportionate to how the tool is used: someone who drafts emails with it needs less than someone who relies on it to summarise contracts or screen job applicants. That is exactly why Microsoft 365 Copilot adoption is its own training question, not a subset of a generic AI session.

Is training the only way to meet the duty?

No, and neither version of Article 4 names training as the required method. A written policy, a set of usage guidelines, and a manager who checks the policy is followed could all count as measures. In practice, most organisations still choose structured training, for one plain reason: it is the only one of those options that produces a dated, per person record of what was covered and whether it was understood. A policy document proves you wrote something down. A completed, assessed course proves someone read it, was tested on it, and passed.

How to show you have met the duty

Keep three things: what training each person was given, when, and evidence they completed it rather than simply received it. An assessed course that gates on a pass mark, such as AI for Business 101, gives you the third of these automatically; a video that nobody has to finish does not. If your organisation later has to explain what it did to support AI literacy, a dated completion record naming the course and the pass mark is a straightforward answer to give.