Regulation explainerPeople & Organizational Performance

EU AI Act AI literacy: what Article 4 asks of employers, and how to meet it

Article 4 of the EU AI Act requires organizations that provide or use AI systems to take measures supporting the AI literacy of their staff and of others operating AI on their behalf. The Digital Omnibus on AI softened the wording but kept the duty2. This explainer covers what the article now says, who it reaches, how to turn it into a role-based program and what evidence to keep.

Reviewed 8 min read

On this page
  1. What Article 4 said originally, and what it says now
  2. What the amendment left unchanged
  3. Article 4 and the provisions that sit next to it
  4. What AI literacy means in a workplace
  5. Scope questions employers ask about Article 4
  6. A role-based AI literacy curriculum
  7. Evidence of AI literacy measures worth keeping
  8. Common mistakes in AI literacy programs
  9. Questions and answers
  10. Sources

What Article 4 said originally, and what it says now

Article 4 sits in the AI Act's opening chapter, which has applied since 2 February 20253. As first adopted, it required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with AI systems on their behalf1.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and replaced Article 4 in full2. Providers and deployers must now take measures to support the development of AI literacy among their staff and others dealing with the operation and use of AI systems on their behalf, and the article states that no specific level of literacy is required of any individual2. The Commission and Member States must support those efforts, including with practical compliance examples on the single information platform, and the AI Board must adopt recommendations on promoting AI literacy2.

In practical terms, the duty moved from an outcome (a sufficient level) to conduct (appropriate measures). It did not disappear: an organization that has taken no measures is still out of line with the article. Supervision sits with national market surveillance authorities, which the Commission's guidance says began supervising and enforcing the rules in August 2026, under penalties set by national law3. The same guidance expects sanctions to be proportionate and indicates that enforcement is most likely where an incident shows staff lacked appropriate training and guidance3.

What the amendment left unchanged

Article 4 and the provisions that sit next to it

Literacy measures are easier to design when you can see which neighboring duties they support. The wider set of deployer duties is covered in EU AI Act deployer obligations; this page stays with the workforce side.

EU AI Act (Regulation (EU) 2024/1689), Article 4 as amended by Regulation (EU) 2026/1744

European Union

Applies whenYou provide or deploy any AI system within the Act's scope, including from outside the EU where the system's output is used in the Union12.

  • Take measures to support the AI literacy of staff and other persons operating or using AI systems on your behalf2.
  • Account for their technical knowledge, experience, education and training, and the context in which the systems are used2.

EU AI Act, Article 26 (obligations of deployers of high-risk AI systems)

European Union

Applies whenYou use a system listed as high-risk, such as AI for recruitment, promotion decisions or evaluating worker performance1.

  • Assign human oversight to people who have the necessary competence, training and authority, and the support they need1.
  • As an employer, inform workers' representatives and affected workers before putting a high-risk system into service at the workplace1.

EU AI Act, Article 14 (human oversight by design)

European Union

Applies whenA provider designs a high-risk system; deployers depend on the oversight features it builds in1.

  • Enable the people overseeing the system to understand its capacities and limitations, detect anomalies and stay aware of the tendency to over-rely on its output1.
  • Let overseers decide not to use the system, override its output or stop it1.

What AI literacy means in a workplace

The Act defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of their opportunities, risks and possible harms1. For an employer, that becomes three practical questions for each group of staff: do they understand what their tools can and cannot do, do they know the rules that apply to their use, and do they know what to do when something goes wrong?

Context matters more than volume of content. A recruiter using a screening tool needs to understand ranking errors and candidates' rights; an engineer integrating a model needs to understand evaluation and failure modes; a finance analyst using a general assistant needs to know which data may be entered and how to check the output.

Scope questions employers ask about Article 4

  • If

    Contractors, agency workers or service providers operate AI systems for you.

    Then

    Include them in your measures, or require equivalent measures by contract.

    The Commission reads the duty as covering people broadly under the organization's remit, not only employees3.

  • If

    Your organization is based outside the EU, but people in the EU use your AI system or its output.

    Then

    Assume Article 4 applies, and cover the staff who build, operate or support that system.

    The Act reaches providers and deployers in third countries where the output is used in the Union1.

  • If

    Staff use general-purpose chat assistants for everyday work.

    Then

    Treat this as deployment and cover it with short, tool-specific guidance.

    Professional use makes your organization a deployer; only purely personal, non-professional use falls outside1.

  • If

    A team oversees a high-risk system.

    Then

    Go beyond literacy: train named overseers on that system, its limits and their authority to stop it.

    Article 26 requires competence, training and authority for human oversight1.

A role-based AI literacy curriculum

AudienceWhat they need to understandFormat that tends to workRefresh when
All staff who use AI toolsApproved tools, data they must not enter, how to check outputs, how to report problemsA short module plus a one-page guide per toolA tool is approved or a policy changes
Power usersPrompting for reliable results, verification habits, the limits of the tools in their own workWorkshops built on their own tasks and examplesTool capabilities change or errors recur
Builders and integratorsEvaluation, failure modes, logging, security and the obligations their system triggersTechnical sessions tied to the delivery processEach new system or major model change
Leaders and approversWhat evaluation results mean, accountability for AI-assisted decisions, the organization's risk appetiteBriefings attached to real investment decisionsStrategy or regulation changes
Overseers of high-risk systemsThe system's purpose, limits and override procedure; automation bias; escalation routesSystem-specific training with practical exercisesBefore assignment and after any system change

One person can sit in several rows. Map people to rows from your AI inventory, not from job titles alone.

Evidence of AI literacy measures worth keeping

No certificate is needed3, but you should be able to show what you did and why it fits your context.

0 of 7 checked

Common mistakes in AI literacy programs

One generic e-learning module for everyone

Early signalCompletion is high, but staff cannot name the tools they are allowed to use.

MitigationSplit content by audience and anchor it in the organization's own tools and cases.

Training disconnected from the AI inventory

Early signalNew tools go live without any guidance reaching their users.

MitigationMake literacy material part of the approval step for every new AI system.

No refresh cycle

Early signalMaterials still describe tools or rules that have since changed.

MitigationSet refresh triggers per audience and review the log every quarter.

Contractors left out

Early signalOutsourced teams run AI-assisted processes without any guidance from you.

MitigationExtend measures by contract and check them during supplier reviews.

Questions and answers

Is certification required to comply with the AI literacy duty?

No. The Commission's guidance says there is no need for a certificate, and the amended article does not require any specific level of literacy for any individual32. What you need is evidence that you took measures suited to your staff and your AI systems. An internal record of audiences, materials, participation and refresh decisions is usually the right level of documentation.

How long should AI literacy training be?

There is no minimum duration. Length should follow the audience and the risk: general staff may need a short module and a guide for each tool, while overseers of high-risk systems need system-specific training with practice. Judge sufficiency by whether people can explain the limits of their tools and what to do when output looks wrong, not by hours completed.

How does AI literacy training relate to GDPR training?

They overlap but are not the same. Data protection training covers the lawful processing of personal data; AI literacy covers how AI systems behave, where they fail and how to use them responsibly. Combine the two where staff enter personal data into AI tools, since that is where both sets of rules meet, but do not assume a data protection module satisfies Article 4.

Did the Digital Omnibus remove the AI literacy obligation?

No. It changed the wording from ensuring a sufficient level of AI literacy to taking measures that support it, added support duties for the Commission and Member States, and asked the AI Board to adopt recommendations2. Providers and deployers remain bound, and the separate oversight-competence duty for deployers of high-risk systems continues3.

Who in the organization should own AI literacy?

Ownership works best when shared: compliance or the AI governance function defines what must be covered, learning and development designs and runs the measures, and the owner of each AI system supplies tool-specific content. One accountable executive should approve the curriculum map and see the refresh log, so literacy keeps pace with the AI inventory.

Sources

  1. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) — EUR-Lex · checked 10 October 2026
  2. Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 on simplifying the implementation of harmonised AI rules (Digital Omnibus on AI) — EUR-Lex · checked 10 October 2026
  3. AI Literacy: Questions and Answers — European Commission · checked 10 October 2026

More in People & Organizational Performance

Back to People & Organizational Performance

Next step

Map your AI literacy measures to the tools in use

Share your AI inventory, or the list of tools staff use today, and your current training. We will point out which audiences are not yet covered and which evidence is missing.

Review our AI literacy plan