Article 4 AI Act: the literacy obligation that already applies

Article 4 of the AI Act is one of the least conspicuous but most broadly applicable provisions of the law. It has applied since 2 February 2025, it touches virtually every organisation that uses AI systems — including those that merely deploy a generative AI assistant — and it was not postponed by the Digital Omnibus agreement of May 2026.

What the provision requires

Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons operating and using AI systems on their behalf. They must take into account the technical knowledge, experience and training of those involved, the context in which the systems are used, and the persons on whom the systems are used.

Three elements deserve emphasis. The obligation rests on two roles at once: providers and deployers. The circle is wider than an organisation's own staff: contractors and hired workers using AI on the organisation's behalf are covered too. And the yardstick is relative: what counts as sufficient depends on the system, the user's role and the group affected. A development team building a credit scoring model needs a different level of literacy than a customer service team using a chat assistant.

What the provision does not require

The regulation prescribes no mandatory number of training hours, no specific course and no certificate. The European Commission confirms that open norm in its questions-and-answers document: organisations decide for themselves how to reach the required level. The AI Office supports this with a living repository of AI literacy practices, which serves as a reference but has no normative status.

Enforcement: an open norm, not a hollow one

Article 99 of the regulation, which governs administrative fines, does not list Article 4 as an independent ground for a fine. That does not make the provision toothless. The national market surveillance authorities had to be designated by 2 August 2025; from the general date of application of 2 August 2026 they can take Article 4 compliance into account in their supervision; in the Netherlands the Data Protection Authority and the RDI take a coordinating role. Demonstrable literacy also weighs into the assessment of other obligations — whoever must organise human oversight of a high-risk system (Articles 14 and 26) cannot do so without staff who understand the system — and into civil liability for damage caused by AI use.

A workable approach

The provision and the Commission document suggest a sober approach: map which AI systems the organisation uses and who works with them; determine per role what level of knowledge is needed; organise training or instruction tailored to that; and record what was done, for whom and when. That record is not a formal requirement of Article 4, but it is the only way to make a plausible case to a supervisor that the open norm has been met.

The Digital Omnibus agreement of 7 May 2026 softens the provision's wording slightly, but leaves the obligation itself and its date of application untouched. Organisations that have been waiting are already more than a year behind on a live obligation.

Sort it now? Our AI literacy course trains your team in 45 minutes — role-specific, with a certificate as evidence for your file.