EU AI Act Article 4: The AI Literacy Requirement Explained

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to promote AI literacy among staff and others who operate AI on their behalf. The duty has applied since 2 February 2025. The Digital Omnibus rewrote it in 2026: there is no mandated "sufficient" level, but organisations still need a proportionate, role-based programme.

Key takeaways

• Article 4 applies to every provider and deployer, whatever the risk level of the AI. A company that only uses Microsoft Copilot or ChatGPT is in scope.
• The original text (from 2 February 2025) required organisations to take measures to ensure a sufficient level of AI literacy.
• As amended by Regulation (EU) 2026/1744, Article 4 frames the duty as taking measures to promote AI literacy, and states that it does not require guaranteeing a specific level for any individual.
• There is no mandatory course, exam or certificate. The Commission's guidance points to training tailored to role, prior knowledge and the risk of the systems used.
• National market surveillance authorities supervise Article 4 from 2 August 2026. Keep internal records of what you did and why.

What the original Article 4 required

When the AI Act entered into force on 1 August 2024, Article 4 was one of the first provisions to bite. From 2 February 2025, alongside the prohibited practices in Article 5, providers and deployers had to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. Those measures had to take into account people's technical knowledge, experience, education and training, the context in which the systems are used, and the persons or groups the systems are used on.

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of the opportunities, risks and possible harms of AI. The definition matters: literacy is not only "how to write a prompt". It includes knowing what can go wrong.

For a wider view of where Article 4 sits in the regulation, see how the EU AI Act works.

How the Digital Omnibus changed Article 4

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and is adopted law. It rewrote Article 4. In summary, as of October 2026:

• The duty remains. The amended Article 4 frames the obligation as providers and deployers taking measures to promote the AI literacy of their staff and others operating AI systems on their behalf.
• No guaranteed level. It no longer requires organisations to ensure a "sufficient" level, and states that it does not require guaranteeing a specific level of AI literacy for any individual.
• A supporting role for public bodies. The Commission and Member States support AI literacy efforts, with particular attention to SMEs, including by publishing practical examples. The AI Board is to adopt recommendations on AI literacy.
• High-risk training duties are untouched. Deployers of high-risk systems must still assign human oversight to people with the necessary competence, training and authority under Article 26.

Read the amended wording in the consolidated text rather than a summary, because the precise phrasing is what authorities will apply. The broader set of changes is covered in what the Digital Omnibus changed.

The practical reading: the rewrite lowers the risk of being judged against an undefined "sufficient" standard, but it does not let you do nothing. An organisation that rolled out generative AI to 2,000 staff without any guidance, policy or training would struggle to show it took measures to promote literacy. A quick way to see where you stand is to assess your AI governance against the EU AI Act; the assessment covers literacy alongside policy, inventory and oversight.

What the Commission's AI literacy Q&A says

The Commission's AI Literacy – Questions & Answers, updated after the Omnibus, is the most useful official guidance. Its main points:

• There is no one-size-fits-all approach and no mandatory training format. Programmes should reflect the organisation's role (provider or deployer), the risks of the AI systems involved, and staff background.
• No certificate is required, and there is no obligation to measure employees' AI knowledge. Keeping internal records of training and other initiatives is advised.
• No specific governance structure, such as an AI officer, is mandated.
• "Other persons" covers people acting on your behalf who are not employees, such as contractors and service providers.
• A sensible minimum covers: a general understanding of AI, the organisation's role, the risks of the systems used and how they are mitigated, and the legal and ethical context.
• Supervision and enforcement sit with national market surveillance authorities from August 2026.

The Commission also maintains a living repository of AI literacy practices from organisations of different sizes. Copying a practice from it does not give a presumption of compliance, but it is a good source of formats.

What are the training requirements for AI literacy under the EU AI Act?

Strictly, there are none in the sense of a set syllabus or number of hours. What the law expects is a set of measures proportionate to who uses which AI, for what, and with what risk. In practice that means three layers:

1. A baseline for everyone who uses AI at work: what AI is and is not, the approved tools, what data must never go in, how to check output, and who to ask.
2. Role-specific depth for people whose decisions or work products rely on AI, or who choose, configure or build it.
3. Deep competence for people assigned human oversight of high-risk systems, which Article 26 requires separately.

Your AI acceptable use policy is the natural anchor for the baseline layer. Our AI acceptable use policy template shows what that policy should contain, and the assessment linked at the end of this article writes one for your organisation from your answers.

A role-based AI literacy programme

The table below is a starting point. Adjust it to the systems you actually use, which is why an inventory comes first (see how to build an AI inventory).

Two things to note. Contractors and agency staff who operate AI for you belong in the right rows. And role matters: whether you are a provider or a deployer of a given system changes what your technical teams must know, as explained in provider vs deployer obligations.

How to evidence AI literacy

No certificate is required, but if a market surveillance authority asks what you have done, you need more than "we sent an email". A light but credible evidence pack contains:

• A short literacy plan: target groups, content per group, frequency, owner. One or two pages is enough for most SMEs.
• The link to your AI inventory: which systems each group uses, so the training content visibly follows the risk.
• Training records: completion logs from your learning platform, attendance lists for workshops, dates and versions of materials.
• Policy acknowledgements: staff confirmation that they have read the AI acceptable use policy.
• Review notes: when you updated the programme and why, for example after adding a new tool or after an incident.

Authorities are told to weigh proportionality, the nature and gravity of an infringement and whether it was intentional or negligent. Harm caused by untrained staff using AI is the scenario most likely to draw attention. Article 99 does not set a specific euro cap for Article 4; penalties follow the rules each Member State lays down, so check national implementing law where you operate.

Frequently asked questions

What does Article 4 of the EU AI Act require?

It requires providers and deployers of AI systems to take measures to promote AI literacy among their staff and others operating AI on their behalf, taking account of their knowledge, experience and the context of use. As amended by the Digital Omnibus, it does not require guaranteeing a specific level of literacy for any individual. It has applied since 2 February 2025.

Is AI literacy training mandatory under the EU AI Act?

Taking measures is mandatory; a specific course is not. The Commission's Q&A says there are no strict requirements or mandatory trainings and no certificate is needed. Training is the usual way to show you have taken measures, but guides, policies, workshops and on-the-job support all count if they fit the roles and risks involved.

Does Article 4 apply if we only use ChatGPT or Copilot?

Yes. Article 4 applies to deployers of any AI system, not just high-risk ones. An organisation whose staff use general-purpose assistants at work is a deployer and should give those staff proportionate guidance on approved use, data protection, checking output and reporting problems.

Who enforces the AI literacy requirement and from when?

National market surveillance authorities supervise and enforce Article 4, not the EU AI Office. The Commission's guidance says supervision and enforcement start from August 2026. Penalties are set under national law and must be effective, proportionate and dissuasive, so the exposure depends partly on the Member State.

Did the Digital Omnibus remove the AI literacy obligation?

No. Regulation (EU) 2026/1744 rewrote Article 4 but kept a duty on providers and deployers. What changed is the standard: the amended text frames the duty as promoting AI literacy rather than ensuring a sufficient level, and the Commission and Member States take on a supporting role, especially for SMEs.

Start with your policy and inventory

An AI literacy programme is only as good as the policy and inventory behind it. Opsio's EU AI Act readiness assessment takes about 40 minutes of questions over 14 steps. When you submit, it writes four editable Word documents from your answers, including the AI acceptable use policy your baseline training should teach, and scores your maturity across ten governance areas. Free, no card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Date-sensitive statements are correct as of October 2026.