Article 4 of the AI Act: what your staff must know about AI

In brief

Article 4 of the EU AI Act requires every provider and deployer of an AI system to take measures to support the development of AI literacy among its staff and the other people operating and using AI systems on its behalf. The duty has applied since 2 February 2025, and Regulation (EU) 2026/1744 rewrote its wording from 27 July 2026: the requirement to ensure a sufficient level became a requirement to support development. It covers a municipality whose employees use Copilot as much as a company deploying an AI system of its own. The Act does not prescribe the form of training, but it requires measures proportionate to the role and the use, and in practice they are shown through documented training.

Who the obligation covers

Regulation (EU) 2024/1689 divides actors into two main classes. A provider develops an AI system or places it on the market under its own name. A deployer is an organisation that uses an AI system in its own activity, other than for personal, non-professional purposes.

The second class is wide. A municipality that uses a language model to draft documents is a deployer. A health and social care organisation whose system includes AI-based classification is a deployer. A company whose sales staff write proposals with Copilot is a deployer. The Act does not require the AI to have been procured separately, nor that it be a high-risk system. Article 4 applies to every deployer, whatever its size or sector.

The obligation extends beyond employees to other persons dealing with the operation and use of AI systems on the organisation's behalf. A subcontractor or agency worker who uses the organisation's AI system is therefore covered.

What changed on 27 July 2026

The original 2024 wording required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy of their staff. The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced the Article in full. The new paragraph 1 reads:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

Three things changed. The yardstick moved from outcome to action: the organisation need not show that everyone has reached a given level, but that it has taken measures that support the development of literacy. No individual's level has to be guaranteed. And the Commission and the member states got a duty of their own: to support SMEs in particular, to publish practical examples of compliance, and to issue recommendations on common objectives through the AI Board.

The recital justifies the change by the burden a strict duty to ensure a sufficient level placed on smaller enterprises, and states at the same time that AI literacy should be a strategic priority regardless of regulatory obligations and potential sanctions. The duty became lighter, but it did not disappear: the organisation still has to do something, and has to be able to show what.

What AI literacy means

The Act defines AI literacy as the skills, knowledge and understanding that allow informed deployment of AI systems and awareness of the opportunities and risks of AI and the possible harm it can cause. The definition is deliberately general: it does not require programming or statistics, but an understanding of what the system in use does, where it goes wrong and what remains the user's responsibility.

The measures are proportionate to four things the Article names: the person's technical knowledge, experience, education and training; the context in which the AI systems are used; and the persons or groups on whom they are used. The same course is therefore not enough for everyone. The Commission's questions-and-answers guidance says the same: there is no prescribed format, the organisation decides how literacy is supported, but it must be able to justify its choice.

In practice literacy settles into three levels:

• The whole workforce: what AI is and is not, how a language model goes wrong, what data may and may not be entered into a system, and when a result has to be checked by a person.
• People who use AI in their work: in addition, the limits of their own tool, the principles of a good prompt, assessing results and recognising an error in their own work.
• Decision-makers, procurers and overseers: the Act's risk classes, the obligations of a deployer of a high-risk system, how human oversight is arranged, and documentation.

For a deployer of a high-risk system, Article 26 adds its own requirement: human oversight must be assigned to persons who have the necessary competence, training and authority. There, training is no longer only the general Article 4 duty but a condition for being allowed to use the system at all.

The timeline

The AI Act entered into force on 1 August 2024, and its application is staged. The Omnibus moved the high-risk dates.

Date	What starts
2 Feb 2025	General provisions, prohibited practices and the Article 4 literacy obligation in its original form
2 Aug 2025	Obligations for general-purpose AI models and the governance structure
27 Jul 2026	Regulation (EU) 2026/1744 in force: the new Article 4
2 Aug 2026	The bulk of the Act, national supervision and penalties
2 Dec 2027	Annex III high-risk systems (moved by the Omnibus)
2 Aug 2028	High-risk systems tied to product legislation, Annex I (moved by the Omnibus)

The literacy obligation has therefore applied since February 2025. That supervision and penalties began only in August 2026 did not postpone it: an authority may ask what the organisation has done since February 2025.

What happens if the obligation is not met

The penalties in Article 99 have no line of their own for Article 4, and the Commission has confirmed that failing the literacy obligation does not directly lead to a fine under the Act. The new wording, which requires no guaranteed level for anyone, confirms the same. It does not follow that the obligation is meaningless.

First, national authorities supervise compliance from August 2026, and a member state may provide for penalties nationally. Second, when harm arises from the use of AI, such as a wrong decision or personal data leaked into a language model, the first question is what the organisation had done for its users' competence. Third, public procurement and large customers increasingly ask for proof that a supplier's staff can use AI responsibly. In all three the answer is the same: documented measures whose content, participants and dates can be shown.

In the public sector there is a further layer: the requirements of administrative law and the GDPR do not step aside because a language model wrote the draft of a decision. The official is responsible for the result, and has to be able to assess it.

How to meet the obligation in practice

1. Map the use. Which AI systems the organisation uses, who uses them and for what. Include what staff use without a separate decision.
2. Divide staff into levels. The whole workforce, those who use AI in their work, and decision-makers and overseers. Each level gets its own content.
3. Choose content that matches your own use. A general introduction to AI is not enough if the problem is what may be entered into Copilot. The examples have to come from the organisation's own work.
4. Repeat and update. The Article speaks of supporting development, not a one-off course. When tools, uses or rules change, literacy is updated. Microlearning suits this better than an annual training day.
5. Document. Who completed which training, when, and how competence was verified. An attendance list shows that a measure was taken; an exam shows that it worked.

The Commission maintains a living repository of examples of how organisations have met the Article 4 requirements, and the new Article obliges it to publish practical examples on the single information platform. They are not binding guidance, but they show what an authority finds credible: role-specific, recurring and documented training.

In Finland

The AI Act is directly applicable law, so the obligation is in force in Finland without national legislation. How supervision is organised is decided nationally: the government bill proposes the Finnish Transport and Communications Agency Traficom as the principal market surveillance authority, with sector authorities supervising their own fields. The Data Protection Ombudsman continues to supervise the processing of personal data also when the processor is an AI system.

For an organisation, the supervisor's name is secondary. What matters is that the question "what have you done for your staff's AI literacy?" can be asked, and that it is then answered with what has been done since February 2025.