AI literacy under Article 4 AI Act: duty and practice

Article 4 is short. Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. They must take into account their technical knowledge, experience, education and training, the context in which the AI systems are to be used, and the persons or groups of persons on whom the systems are to be used.

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and the possible harm it can cause. The point is not programming skill but informed, responsible use.

Under Article 113(a) the duty has applied since 2 February 2025. It does not depend on whether a system is high-risk: an office that only uses a writing assistant is a deployer and therefore bound.

The addressees are providers and deployers — in practice almost every company and university using AI. Those to be trained are the organisation's own staff and other persons dealing with the operation or use of AI systems on its behalf. That can include agency workers, freelancers or service providers who operate AI systems for the organisation.

Not everyone needs the same. A clerk drafting text with a language model needs different knowledge from a team running AI to pre-screen applications, or a manager deciding on deployment. Article 4 expressly requires prior knowledge and context to be taken into account — a single course for everyone is permissible but rarely enough.

The regulation sets no number of hours and no curriculum. "To their best extent" and "sufficient" are deliberately open terms: what is expected is a proportionate, risk-based effort. The greater the potential harm and the more people are affected, the more literacy is needed. The Commission has published questions and answers on AI literacy that read the provision this way and stress that no specific certificate is required.

A sensible structure is a core for everyone plus role-specific modules. It works best to tie content to the systems actually in use: people who know how their own tool fails check its output better than people who heard a general introduction. Equally important are the organisation's own rules: which data may go into which system, who checks results, how problems are reported?

Article 99(3) to (5) list the infringements with fixed fine ranges; Article 4 is not among them. So the regulation provides no direct EU fine for a lack of AI literacy. However, Article 99(1) requires Member States to lay down penalties and other enforcement measures for infringements of the regulation; whether and how they do so for Article 4 follows from national law.

Missing training can still become costly indirectly. If faulty AI use causes harm, the obvious question is whether the organisation exercised due care — and Article 4 describes a benchmark for that. It also matters for breaches of other duties, such as the GDPR or Article 26 for high-risk systems, whether staff were competent.

In autumn 2025 the Commission proposed reshaping Article 4 and shifting the promotion of AI literacy more towards Member States and the Commission. Until an amendment is published in the Official Journal, the current wording applies. Whatever the outcome, training remains the most effective safeguard against mistakes in AI use.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.

A robust programme starts with the AI inventory: only once it is clear who uses which systems can needs be defined per group. That yields a core module for everyone, role modules and a rule on when to refresh, for example when new tools arrive or rules change.

Learning platforms help with assignment, reminders and evidence. What matters is that records show content, date and the link to the role, and that they can be checked when needed. A short knowledge check at the end shows whether the content has landed and gives the record weight.