Article 4(1), as amended, requires providers and deployers to take measures supporting AI literacy development among their staff and among other people operating AI systems on their behalf. What counts as adequate depends on that person’s technical knowledge, experience, education, and training, plus the context the system is used in and who the system’s outputs affect.
The amendment matters here. Earlier wording leaned toward ensuring a sufficient level of literacy. The current text states directly that the article doesn’t require providers or deployers to guarantee any specific level of AI literacy for any individual. That’s a shift from an outcome-based duty to an effort-based one, though it doesn’t remove the obligation to show what measures were taken, for whom, and why they fit the role.
Who is covered
This provision reaches further than almost anything else in the Act. It applies to both providers and deployers, and to any AI system regardless of risk classification. A marketing team using a generative writing tool is in scope in the same way a compliance team running a credit-scoring model is, even though what “adequate literacy” looks like for each will differ enormously.
There’s no fixed curriculum or certification built into the text. Article 3(56) defines AI literacy as the skills, knowledge, and understanding that let providers, deployers, and affected people make informed use of AI systems and stay aware of the risks involved.
Timeline and existing guidance
Article 4 sits in Chapter I, which took effect 2 February 2025, the same date as the Article 5 prohibitions and well ahead of the rest of the Act’s risk-tiered obligations. A Digital Omnibus addition, Article 4(2), commits the Commission to publishing practical compliance examples, and the AI Office already runs a public Q&A on Article 4 along with a living repository of more than 40 AI literacy practices submitted by organisations, built from two rounds of AI Pact pledger surveys. Neither is binding or a certified standard, but both are genuine, already-published reference points for what other organisations are doing. Netherlands-based teams also have the Dutch DPA’s own follow-up guidance on AI literacy to draw on alongside it.
Why no fine tier doesn’t equal no risk
Article 4 doesn’t appear among the provisions listed in Article 99(4), which sets a €15 million or 3%-of-turnover fine tier for breaches of specific articles: provider obligations under Article 16, deployer obligations under Article 26, transparency obligations under Article 50. It’s also not swept into the €35 million or 7% tier reserved for Article 5 breaches.
That doesn’t make it consequence-free. Member States retain a general duty under Article 99(1) to set effective, proportionate, and dissuasive penalties for any infringement of the Regulation, which can extend to Article 4 without a named tier. AI literacy also underpins obligations that do carry hard fines. Article 14’s human oversight requirement only works if the people assigned to it actually understand the system well enough to exercise it. A regulator investigating a different provision will still ask what measures were taken to prepare staff, and having nothing to show is a weak position regardless of whether Article 4 itself was the charge.
What proportionate looks like in practice
Since the obligation scales with role and context, a workable programme is usually built around a handful of tiers rather than one training module for everyone.
| Role | What “literate” looks like |
|---|---|
| Executive / board | Understands where AI is deployed across the organisation, the risk categories involved, and their own governance responsibilities |
| Compliance or risk officer overseeing high-risk systems | Understands how the specific model produces outputs, its known limitations, and how to recognise failure modes |
| Staff operating an AI system directly | Understands the tool’s intended use, its boundaries, and how to escalate unexpected output |
| General staff using low-risk tools | Understands basic output verification and the organisation’s policy on AI-generated content |
For regulated-industry teams, this doesn’t have to start from zero. Banks and insurers already run model risk governance functions for traditional statistical models. Extending that same structure to cover AI-specific literacy, what makes a model’s failure modes different from a regression’s, how to read drift signals, when a black-box output needs escalation, is usually faster than building a parallel AI-literacy programme from scratch.
What a “measure” actually is
The article doesn’t define the term, which leaves room for a genuinely wide range of things to count, provided they’re proportionate to the role. In practice, organisations tend to draw from a small set of options rather than defaulting straight to formal training:
- Role-specific onboarding material covering the systems that role will actually touch, rather than a generic “AI 101” module.
- A walkthrough of a system’s Article 13 instructions for use, for staff who operate it directly, so literacy is tied to the actual tool rather than AI in the abstract.
- Internal documentation or a wiki page explaining a system’s known limitations and escalation path, kept current as the system changes.
- A designated internal point of contact for AI-related questions, distinct from a formal training programme but still a genuine measure.
- Executive briefings on the organisation’s AI risk categories and governance responsibilities, for the board tier specifically.
- Refresher sessions triggered by a system update or a new deployment, rather than a one-off session at hire.
What a defensible record needs
Article 4 doesn’t mandate a specific documentation format. There’s no statutory template, unlike some other provisions in the Act. But a record that would hold up if questioned tends to include the same handful of things regardless of who built it: who received which measure, when, tied to their role and the specific system they interact with, plus a short note on why that measure was judged proportionate for that role. A course-completion log proves attendance, not that the measures fit the person and the risk, which is what the article actually asks for. This is also where the record intersects with other obligations worth having in place anyway, such as an AI system inventory or a broader compliance checklist. The literacy record is easier to produce on demand when it’s tied to a system-by-system inventory rather than kept as a standalone HR record.
Article 4 compliance checklist
- AI literacy measures identified for every role that operates or is affected by an AI system, not just technical staff
- Measures scaled to role: executive, oversight, direct-operator, and general-user tiers each have something distinct
- Measures tied to specific systems, not just generic AI awareness content
- A record kept of who received which measure, when, and why it was judged proportionate for that role
- Records refreshed when a system changes or a new one is deployed, not treated as a one-off exercise
- Programme checked against the AI Office’s published repository and Q&A for reference points
- Literacy records linked to your AI system inventory rather than held as a standalone HR log
Frequently asked questions
2 February 2025, one of the earliest provisions in the Act to take effect.
No. It requires measures proportionate to role, technical knowledge, and context. It explicitly doesn't guarantee or mandate a specific literacy level for any individual.
Article 4 isn't among the provisions carrying a specific fine tier under Article 99(4), unlike Articles 16, 26, or 50. Member States can still set general penalty rules under Article 99(1), and gaps here can weaken an organisation's position in investigations tied to other obligations.
No. It applies to any AI system at any risk tier, for both providers and deployers.
Article 4 requires both providers and deployers to ensure that staff involved in the operation and use of AI systems have a sufficient level of AI literacy, taking into account their role and the specific systems they work with. The Act does not prescribe a specific training format or number of hours. What it requires is demonstrable, role-appropriate understanding; which means you need to document what training was given, to whom, and when.
