AI literacy under Article 4 of the EU AI Act

The original text required providers and deployers to 'take measures to ensure, to their best extent, a sufficient level of AI literacy' of their staff and other persons dealing with AI systems on their behalf, taking into account their knowledge, experience, education and training, the context of use and the persons on whom the systems are used. Regulation (EU) 2026/1744, in force since 27 July 2026, replaced this with a duty to 'take measures to support the development of AI literacy' and added that the obligation 'does not require providers or deployers to guarantee any specific level of AI literacy'.

The obligation stays with companies. The Commission's Q&A summarises the change as keeping AI literacy an obligation for providers and deployers, while no specific or 'sufficient' level is mandated. The amendment also asks the Commission and Member States to support organisations, in particular SMEs, and the AI Board to adopt recommendations. Because Article 4 has applied since 2 February 2025, measures should already be in place.

Article 4 does not prescribe a course, a number of hours or an exam. The Commission's Q&A states that there is no one-size-fits-all approach, that no strict requirements or mandatory trainings are imposed, and that no certificate is needed. Measures can take several forms, such as a workshop, an e-learning module, written guidance or an internal usage policy. The Q&A also warns that simply relying on the instructions for use, or asking staff to read them, is in many cases ineffective.

Who needs measures depends on who works with AI. Staff are the organisation's own employees. According to the Q&A, 'other persons' are not employees but people broadly under the organisation's remit, for example a contractor, a service provider or a client. The Q&A adds that, depending on the specific risk, it can be useful to extend literacy measures to customers or clients as well.

The Q&A suggests a sequence: ensure a general understanding of AI in the organisation, consider whether you act as provider or deployer, consider the risk of the AI systems concerned, and build concrete measures on that analysis. For an SME this can mean a short baseline for everyone who uses AI tools: what the tools do, where they make mistakes, which data may be entered, and who to ask when something looks wrong.

Deeper measures belong where the risk is higher. Staff using a generative AI tool for marketing texts should understand risks such as hallucinations, the example the Q&A itself uses. HR staff using a screening tool need to understand its limits, possible bias and when to set its output aside. People assigned to oversee a high-risk system will also need the competence, training and authority required by Article 26(2) once that article applies. Developers at a provider need to know the obligations that apply to the systems they build.

No format of proof is prescribed. A simple log is practical evidence: who took part, when, in which format, which topics were covered and which AI systems the measure related to. Keep the materials used and note when content was updated, for example after a new tool was introduced. The Q&A mentions an internal record of trainings and other guiding initiatives. Such a record helps you answer questions from a market surveillance authority or a business customer.

Review the log whenever your AI landscape changes. A new tool, a new use case or a new group of users is a natural trigger to update your measures. Keeping the log next to an inventory of AI systems helps show that the measures match the systems people actually use.

Article 99(3) to (5) sets fine ceilings for prohibited practices, for obligations such as those in Articles 16, 26 and 50, and for supplying incorrect information to authorities. Article 4 is not listed in those tiers. Under Article 99(1), however, Member States lay down penalties and other enforcement measures for infringements of the Regulation. The Commission's Q&A states that national market surveillance authorities could impose penalties and other enforcement measures for infringements of Article 4, that they start supervising and enforcing the rules from 2 August 2026, and that any sanction must be proportionate to the individual case.