Last updated: 12 November 2026
Quick answer: The EU AI Act AI literacy requirement in Article 4 obliges providers and deployers of AI systems to take measures to support the AI literacy of their staff and others using AI on their behalf. It has applied since 2 February 2025, national authorities can enforce it from August 2026, and no certificate is required.
Most organisations that use AI at all are caught by Article 4. It is not limited to high-risk systems, and it covers the everyday tools your teams already use, from chat assistants to AI features inside CRM and HR software.
The obligation was softened in July 2026 by the Digital Omnibus on AI, but it was not removed. This guide explains what the EU AI Act AI literacy duty requires today, who it applies to, how regulators are likely to judge it, and how to build a proportionate programme with records you can show an auditor.
What is the EU AI Act AI literacy requirement?
It is a general duty on providers and deployers of AI systems to support the AI knowledge and skills of the people who operate and use those systems on their behalf. The aim is informed, responsible use rather than technical expertise for everyone.
The AI Act, Regulation (EU) 2024/1689, defines AI literacy in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and the possible harm it can cause.
Article 4 then turns that definition into an organisational obligation. It sits in Chapter I of the Act, alongside the general provisions, which is why it applied from the very first application date rather than waiting for the high-risk rules.
What does Article 4 say after the Digital Omnibus?
Since the Digital Omnibus entered into force on 27 July 2026, Article 4(1) requires providers and deployers to “take measures to support the development of AI literacy” of their staff and other persons dealing with AI systems on their behalf. The earlier duty to ensure a “sufficient level” of literacy is gone.
The amended text in Regulation (EU) 2026/1744 keeps the context factors from the original version. Measures must take into account people’s technical knowledge, experience, education and training, the context in which the AI systems are used, and the persons or groups on whom the systems are used. Two new paragraphs were added:
- Article 4(2): the Commission and the Member States must support and facilitate the efforts of providers and deployers, in particular SMEs, in meeting the obligation.
- Article 4(3): the European AI Board must adopt recommendations, taking into account European competence frameworks, to support the promotion of AI literacy.
The recitals explain that the change was made to reduce unnecessary compliance burden, particularly for smaller businesses. In practice, the obligation moved from an outcome standard (a sufficient level) to a conduct standard (taking measures). You still have to act, and you still need to be able to show what you did.
Original and amended wording compared
| Element | Original Article 4 (2024) | Amended Article 4 (July 2026) |
|---|---|---|
| Core duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Who is covered | Staff and other persons dealing with AI on the organisation’s behalf | Unchanged |
| Context factors | Knowledge, experience, education, training, use context, affected persons | Unchanged |
| Public support | Not in Article 4 | Commission and Member States must support providers and deployers, especially SMEs |
| AI Board role | Not in Article 4 | Recommendations based on European competence frameworks |
Who has to comply with Article 4?
Every provider and every deployer of an AI system within the scope of the AI Act. A deployer is any organisation using an AI system under its authority in a professional context, so a company that rolls out a generative AI assistant to staff is a deployer, even if it built nothing itself.
The duty covers more than employees. The European Commission’s AI literacy Q&A confirms that “persons dealing with the operation and use of AI systems on behalf” of the organisation can include contractors, service providers and, depending on the context, clients. If an outsourced support centre uses your AI tool to answer your customers, its agents are in scope.
Common mistake: assuming that Article 4 only matters for companies that develop AI or run high-risk systems. The obligation applies regardless of risk level. Risk level changes how deep your measures need to go, not whether you need them.
When did AI literacy obligations start, and when is enforcement?
The obligation has applied since 2 February 2025, and supervision and enforcement by national market surveillance authorities apply from August 2026. By the time you read this, both dates have passed.
The Commission’s AI Act overview confirms that the prohibitions and AI literacy obligations took effect in February 2025, general-purpose AI rules in August 2025 and transparency rules in August 2026. After the Omnibus, high-risk obligations follow on 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products.
That sequencing matters. An AI literacy programme built now is the foundation for the human oversight and training duties that arrive with the high-risk rules. Under Article 26(2), deployers of high-risk systems must assign human oversight to people who have “the necessary competence, training and authority”, which is a stricter, role-specific standard than Article 4.
What are the penalties for failing the AI literacy requirement?
The AI Act does not set a specific fine for Article 4. Article 99 lists fine tiers for prohibited practices and for named operator obligations, and Article 4 is not among them. Penalties are therefore left to national rules, which must be effective, proportionate and dissuasive.
The Commission’s Q&A states that any sanction must be proportionate and based on the individual case. The more realistic exposure is indirect. If an AI-related incident occurs, for example staff pasting personal data into a public chatbot or relying on an unverified AI output in a customer decision, a regulator is likely to ask what the organisation did to prepare those people. A weak answer on literacy can aggravate other findings under the AI Act or GDPR.
What does a good AI literacy programme include?
A good programme is risk-based, role-based and documented. The Commission describes a four-step approach: build a general understanding of AI, clarify your role as provider or deployer, assess the risks of the systems you use, and tailor literacy measures to the people and context involved.
The Commission is explicit that “no strict requirements or mandatory trainings are imposed”. Formats can range from formal courses to e-learning, workshops or written guidance. There is no requirement to appoint an AI officer or to obtain certificates.
A five-step AI literacy checklist
- Inventory your AI use. List the AI systems you provide or deploy, including embedded AI features in SaaS tools and approved generative AI assistants. Note the owner, purpose and user groups for each.
- Map people to systems. Identify which roles use which systems and whether any contractors or partners act on your behalf. Group them into tiers, for example all staff, regular users, decision-makers relying on AI output, and technical teams.
- Set proportionate content per tier. Everyone needs the basics: what AI is, typical failure modes, your acceptable use policy and what data must never be entered. Users of higher-impact systems need deeper training on limitations, bias, verification and escalation.
- Deliver and record. Run the training, and keep an internal record of who completed what, when and on which version of the material. The Commission notes that an internal record is sufficient.
- Review and refresh. Update content when you adopt new systems, when incidents or near misses occur, and at a regular interval you define in your policy.
In practice: tie the literacy programme to your AI acceptable use policy. Staff who acknowledge the policy and complete the matching training module create one evidence trail instead of two. A central policy management process makes those acknowledgements easy to track.
Example of a tiered programme
| Audience | Typical AI exposure | Suggested measures |
|---|---|---|
| All staff | General-purpose assistants, AI features in office tools | Short introduction, acceptable use policy, data handling rules, how to report problems |
| Frequent users | Drafting, summarising, customer support tools | Verification of outputs, recognising hallucinations, confidentiality, transparency duties towards customers |
| Decision-makers | AI-assisted scoring, screening or recommendations | Limits and bias of the system, when to override, documenting human judgement |
| Technical teams and providers | Building, configuring or fine-tuning AI | Data quality, testing, monitoring, security, documentation duties under the AI Act |
| Contractors acting for you | Your AI tools used on your behalf | Contractual requirement to complete relevant modules, access only after completion |
If you are already managing AI governance, policies and training evidence in spreadsheets, a shared platform helps. You can start your 14-day free trial of Enactia’s AI-powered GRC platform and see how AI inventories, policies and training evidence connect across frameworks.
How does AI literacy fit with ISO 42001 and GDPR?
AI literacy overlaps with controls you may already run. If you are implementing ISO/IEC 42001:2023, the AI management system standard, its competence and awareness clauses (7.2 and 7.3) cover much of the same ground. Evidence of AI training can support both.
GDPR also expects staff awareness and training as part of appropriate organisational measures, and DPOs have a formal awareness-raising task. When AI systems process personal data, one combined module on AI and data protection is often more effective than two separate sessions. The ISO 42001 framework page and our ISO 42001 certification roadmap explain how an AI management system brings these threads together.
Mapping once and reusing evidence is where cross-framework tools add value. Enactia’s Compliance Universe maps a single training or policy control to the AI Act, ISO 42001 and GDPR so the same evidence satisfies each.
Key takeaways
- Article 4 applies to all providers and deployers of AI systems, not only high-risk ones, and it has applied since 2 February 2025.
- Since 27 July 2026 the duty is to take measures to support AI literacy, not to ensure a sufficient level, but action and evidence are still expected.
- National authorities can supervise and enforce AI literacy from August 2026, with proportionate, case-by-case sanctions.
- No certification or AI officer is required; a risk-based, role-based programme with internal training records is the practical standard.
- Build literacy now as the base for stricter human oversight duties under the high-risk rules from December 2027.
Frequently asked questions
Does the AI literacy requirement apply if we only use ChatGPT or Copilot?
Yes. Using a general-purpose AI assistant in a professional context makes your organisation a deployer of an AI system, so Article 4 applies. Your measures can be light for low-risk use, for example a short module and an acceptable use policy, but you should be able to show that staff were informed about limitations, data handling rules and how to report problems.
Did the Digital Omnibus remove the AI literacy obligation?
No. The Digital Omnibus on AI, Regulation (EU) 2026/1744, amended Article 4 so that providers and deployers must take measures to support the development of AI literacy, rather than ensure a sufficient level. The obligation itself remains, and the Commission and Member States now also have a duty to support organisations, especially SMEs.
Do employees need an AI literacy certificate?
No. The European Commission confirms that Article 4 does not require certificates, specific courses or a dedicated AI officer. Organisations can choose formats that suit their context, such as e-learning, workshops or written guidance, and an internal record of who completed which training is enough to evidence the measures taken.
Are contractors and outsourced staff covered by Article 4?
They can be. Article 4 covers staff and other persons dealing with the operation and use of AI systems on the organisation’s behalf. The Commission’s guidance says this can include contractors and service providers, depending on context and risk. A practical approach is to require relevant training in contracts before granting access to your AI tools.
What is the fine for not meeting the AI literacy requirement?
The AI Act does not set a specific fine for Article 4, and it is not listed in the Article 99 fine tiers. Member States set penalties, which must be proportionate. The bigger risk is that poor literacy aggravates other findings after an AI-related incident, for example under the AI Act transparency rules or GDPR.
Conclusion: treat AI literacy as a living programme
The EU AI Act AI literacy requirement is now lighter in wording but broader in reach than many organisations assume. Start with an inventory of the AI you use, train people according to their role and risk, keep simple records and refresh the content as your AI use changes. For the wider picture, see our guide to EU AI Act high-risk system compliance.
If you want to manage AI inventories, policies, training evidence and cross-framework controls in one place, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
