AI literacy obligation — EU AI Act Article 4

What Article 4 actually says

Article 4 reads (in substance): “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”

AI literacy is defined in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of the Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.

Application date and scope

• In force since 2 February 2025 under Article 113(a) (along with Chapter I general provisions and Chapter II prohibited practices).
• Applies to every provider and deployer of an AI system, regardless of risk class. There is no de minimis carve-out.
• Covers staff and other persons dealing with operation and use of AI on the entity’s behalf — including contractors, agency workers, and external consultants acting on behalf of the deployer.
• Risk-proportionate. The level required scales with the technical knowledge of the staff, the context of use, and the persons affected.

Commission Q&A (May 2025) — what it clarified

The European Commission published a Living Repository of AI literacy practices in February 2025 and AI literacy Q&A subsequently, clarifying that:

• Article 4 does not entail an obligation to measure the knowledge of AI of employees, but deployers are expected to be able to demonstrate that they have taken reasonable measures.
• Article 4 does not mandate a specific certification, examination or accredited programme.
• Both initial onboarding and ongoing refresher activities are appropriate; one-off training at hire is not sufficient where the technology, the role or the regulatory context evolves.
• The Commission’s Living Repository collects voluntarily shared practices that providers and deployers can use as inspiration; it is not a mandatory curriculum.

How Article 4 connects to Article 26(2) and Article 14

For high-risk AI systems, Article 4 sits alongside two stricter duties:

• Article 26(2) — competent human oversight. Deployers must assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
• Article 14 — human-oversight design. Providers must design the system so that natural persons can effectively oversee it, including by understanding the system’s capacities and limitations and properly monitoring its operation.

Article 4 is the floor (everybody in scope); Article 26(2) is the ceiling for staff on the oversight seat (named competent persons). A deployer that only addresses Article 4 has not discharged Article 26(2), and vice versa.

Penalties

Non-compliance with operator obligations — the bucket that includes Article 4 — is sanctioned under Article 99(4) with administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. Article 99(6) sets a lower cap (the lesser of the two amounts or percentages) for SMEs including start-ups.

Evidence checklist a supervisor will look for

• Written AI-literacy policy referencing Article 4.
• Inventory of staff and contractor roles touching AI systems, with the literacy level required for each.
• Training content covering: what AI is, opportunities, risks, role-specific obligations under the Regulation, prohibited practices to look out for, and incident escalation.
• Completion records with name, role, date and material version.
• Refresher cadence proportionate to the system risk (annual at minimum for high-risk roles).
• Article 26(2) oversight-competence record for staff on the human-oversight seat — separate from the general Article 4 evidence.
• Coverage of contractors and agency staff acting on the deployer’s behalf.

Common misconceptions

• “A one-page intranet post is enough.” Possibly for a low-risk minimal-use context with senior technical staff; not for staff operating Annex III high-risk systems. Proportionality cuts both ways.
• “An external certificate satisfies Article 4.” A certificate may be useful evidence, but Article 4 is about the entity’s policy and coverage of its workforce — not the formal credential held by any single person.
• “Contractors are out of scope.” Article 4 explicitly covers other persons dealing with operation and use of AI on the deployer’s behalf.
• “It only applies if we use high-risk AI.” Article 4 applies to every provider and deployer of any AI system, regardless of risk class.

Related EU guides

• Prohibited AI practices — Article 5
• EU AI Act conformity assessment
• Annex IV technical documentation
• NIS2 incident reporting timeline
• GPAI vs deployer obligations

Sources

• Regulation (EU) 2024/1689, Articles 3(56), 4, 14, 26(2), 99(4), 99(6), 113(a) — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
• European Commission — AI literacy Q&A and Living Repository of AI literacy practices: digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
• AI Act Service Desk — Article 4: ai-act-service-desk.ec.europa.eu/en/ai-act/article-4