AI literacy under the EU AI Act, made practical.

What does Article 4 of the EU AI Act say?

Article 4 of the EU AI Act (Regulation (EU) 2024/1689) is the regulation’s AI literacy provision. Since 27 July 2026, its first paragraph reads:

“Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”Regulation (EU) 2024/1689, Article 4(1), as replaced by Regulation (EU) 2026/1744, Article 1(5)

Paragraph 2 asks the European Commission and the Member States to support providers and deployers, in particular SMEs, and the Commission to publish practical examples of how to comply. Paragraph 3 asks the European Artificial Intelligence Board to adopt recommendations with common objectives. Three features of paragraph 1 shape everything else:

• It is an obligation. Providers and deployers “shall take measures”; it is not optional guidance.
• It is proportionate. The measures depend on people’s knowledge and experience, the context of use, and the people the AI is used on.
• It is not a guarantee. No individual has to reach a set level, and the text names no course, format or duration.

Article 4 sits in Chapter I of the AI Act, which has applied since 2 February 2025 (Article 113), and it concerns every AI system a company provides or deploys, not only high-risk ones.

What changed in Article 4 in 2026?

Article 4 was replaced in 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The 2024 wording asked providers and deployers to “take measures to ensure, to their best extent, a sufficient level of AI literacy”; today they must “take measures to support the development of AI literacy”, with no specific level guaranteed for any individual.

Scroll the table →

Recital 8 of the Omnibus explains why: a stringent obligation to ensure a sufficient level did not suit every provider and deployer and added a compliance burden, particularly for smaller enterprises. It still calls AI literacy a strategic priority regardless of regulatory obligations.

What did not change

The duty still applies to every provider and deployer, as it has since 2 February 2025. For deployers of high-risk AI systems, Article 26(2) adds that human oversight must go to people “who have the necessary competence, training and authority, as well as the necessary support”. The Omnibus kept that wording, and the Commission’s Q&A confirms the obligation remains. What the Omnibus did change is when it applies: from 2 December 2027 for high-risk systems listed in Annex III and 2 August 2028 for those covered by Annex I (Article 113, as amended by Regulation (EU) 2026/1744, Article 1(40)).

Who does Article 4 apply to?

Article 4 applies to providers and deployers of AI systems, two roles defined in Article 3 of the AI Act. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is anyone “using an AI system under its authority”, except in a personal, non-professional activity.

As general information: a company whose people use AI systems in their work generally fits the definition of a deployer of those systems, whether the system is a general-purpose assistant or an AI feature inside business software. A company that builds AI into a product it sells may also be a provider. Neither definition depends on company size.

“Other persons” reaches beyond the payroll. The European Commission’s AI literacy Q&A names contractors, service providers and clients as examples of people broadly under the organisation’s remit.

What does AI literacy mean under the AI Act?

AI literacy is defined in Article 3(56) of the AI Act:

“‘AI literacy’ means skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.”Regulation (EU) 2024/1689, Article 3(56)

Recital 20 adds that this can include the measures to apply during use and suitable ways to interpret an AI system’s output. In daily work, it comes down to three habits:

• Know the tool. What the AI system is for, what it can and cannot do, and which information it may see.
• Check the output. AI can produce fluent answers that are wrong; the Commission’s Q&A names hallucination as a risk staff should know about.
• Know where a person decides. Which decisions stay with people, and when to hand a case over.

How do you build an AI literacy programme by role?

An AI literacy programme works best when it starts from the AI a company actually uses and the roles that use it. The European Commission’s Q&A lists four starting considerations:

1. A general understanding of AI: what it is, how it works, which AI the organisation uses, and its opportunities and dangers.
2. The organisation’s role: does it develop AI systems, or use systems developed by others?
3. The risk of those AI systems: what people need to know, and which risks they must be aware of.
4. Measures built on that analysis, fitted to people’s knowledge and experience and to the context of use.

The Q&A also encourages covering legal and ethical aspects and accepts different levels of training for different groups, so a role-based programme follows naturally.

1. 01

   Leadership and owners

   Where AI creates value and risk, the company’s role as provider or deployer, who owns each AI system, and which decisions stay with people.

2. 02

   Managers and process owners

   Which AI tools their teams use and for what, how to review AI output in the workflow, where approval points sit, and when to escalate.

3. 03

   Everyday users

   What their tools can and cannot do, which information must never be entered, how to check output, and the company’s rules for AI at work.

4. 04

   Sensitive functions

   HR, finance, legal and customer-facing roles, where AI output can affect individuals; for high-risk systems, the human-oversight training of Article 26(2), which applies from 2 December 2027 at the earliest.

5. 05

   Technical teams and partners

   People who build or configure AI, and contractors using AI on your behalf: evaluation, monitoring, documentation, and the legal and ethical side.

Aurelith’s advice: one shared foundation for everyone, then depth by role, taught with the company’s own tools, examples and rules.

How should you keep a record of AI literacy measures?

A record of AI literacy measures is how a company shows what it did. The European Commission’s Q&A is direct: “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” It adds that Article 4 does not oblige companies to measure employees’ AI knowledge, and mandates no specific governance structure, such as an AI officer.

A simple record, as general practice

• The AI systems in use, who uses each one and for what, and your role for each: provider or deployer.
• Each measure taken (training, written guidance, a briefing), its date, and who took part, contractors included.
• The material and the company rules people were given, with a version or date.
• The next review date, and what will trigger a refresh.

The Q&A prescribes no format; what matters is that the record stays current.

When does Article 4 apply, and what comes next?

Article 4 has applied since 2 February 2025, and its current wording since 27 July 2026. The dates that matter:

For companies that deploy AI systems, supervision and enforcement of Article 4 sit with national market surveillance authorities, not with the EU AI Office; the AI Office supervises only certain providers, such as those of AI systems built on their own general-purpose AI models (Article 75(1), as amended by Regulation (EU) 2026/1744). The Commission states that they start supervising and enforcing the rules as of 2 August 2026, the AI Act’s general date of application.

Still to come: the Commission’s practical examples under Article 4(2), built on its living repository of AI literacy practices, and the AI Board’s recommendations under Article 4(3).