AI literacy training under AI Act Article 4: what the law requires and how to train staff by role

What Article 4 of the AI Act requires

Article 4 of the AI Act requires every provider and deployer of an AI system to take measures for the AI literacy of its staff and of other persons who operate or use AI systems on its behalf. It has applied since 2 February 2025 to all AI systems, not only high-risk ones, so a company whose staff draft text or search documents with a chat assistant is in scope. Since Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026, the measures have to “support the development of AI literacy”, and the law no longer asks for “a sufficient level” of it. The Commission’s AI literacy Q&A, last updated on 27 July 2026, says no certificate is needed and an internal record of trainings can be kept. According to the same Q&A, national market surveillance authorities supervise and enforce the obligation from August 2026.

Article 3(56), which the 2026 amendment left unchanged, defines AI literacy as the “skills, knowledge and understanding” that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of the opportunities, risks and possible harm of AI. Our EU AI Act guide for companies running LLMs covers the rest of the regulation.

The AI literacy obligation in 2024 and after the July 2026 amendment

As published on 12 July 2024, Article 4 asked providers and deployers to “take measures to ensure”, as far as possible, “a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training, the context of use and the persons on whom the systems are used.

Article 1, point (5) of Regulation (EU) 2026/1744 replaced it with three paragraphs. Paragraph 1 keeps the persons and the factors, but providers and deployers now “shall take measures to support the development of AI literacy” of those persons, and “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

Regulation (EU) 2024/1689, Article 4 (OJ L, 12.7.2024); Regulation (EU) 2026/1744, Article 1, point (5) (OJ L, 24.7.2026); consolidated Article 4 as at 27 July 2026 on the Commission’s AI Act Service Desk.

The obligation has applied since 2 February 2025 under both texts, as part of Chapter I (Article 113(a)). The new wording took effect when the amending regulation entered into force on 27 July 2026, and the consolidated AI Act as at that date carries it.

Recital 8 of the amending regulation cites stakeholder experience that stringent obligations to ensure a sufficient level “would not be suitable for all types of providers and deployers”, and data showing that such obligations create “an additional compliance burden, particularly for smaller enterprises”. The Commission had proposed on 19 November 2025 to shift the obligation to the Member States and the Commission; according to its Q&A, the adopted text keeps it with providers and deployers.

Who needs AI literacy training: staff, contractors and clients

The Commission’s Q&A reads “other persons” in Article 4 as people who are not employees but are “broadly under the organisational remit”, such as a contractor, a service provider or a client. In general, staff of a service provider or contractor need the appropriate AI skills for their task, as employees do. Depending on the specific risk, the Q&A adds, literacy can be useful for customers and clients too, and Article 4(1) asks companies to consider “the persons or groups of persons on whom the AI systems are to be used”.

Article 4 applies to every AI system the company provides or deploys, bought or built. Asked whether a company whose employees use ChatGPT to write advertisement text or translate must comply with Article 4, the Q&A answers yes; our guide to shadow AI policy and controls covers how to find and govern such use. A company that builds its own assistant can also be its provider, and recital 20 of the AI Act says that, depending on the context, AI literacy can include understanding “the correct application of technical elements during the AI system’s development phase”.

Staff with a degree or experience in AI development normally count as AI literate, the Q&A says, “but it depends on the AI tool in question and their specific qualification”, and the organisation should consider what else they need to know, such as the legal and ethical aspects of AI. An AI officer is not required, because, in the Q&A’s words, “no specific governance structure is mandated”.

The minimum steps in the Commission’s AI literacy Q&A

The Commission’s AI literacy Q&A lists what providers and deployers should consider at least: a general understanding of AI in the organisation, their role as provider or deployer of AI systems, the risks of those systems, and AI literacy actions built on that analysis. It states that “no strict requirements or mandatory trainings are imposed”, that the AI Office sets no sector-specific requirements and that Article 4 does not oblige companies to measure employees’ knowledge of AI. It also warns that relying on the instructions for use “or asking the staff to read them might be ineffective” in many cases. An IT department can turn the four steps into this procedure.

1. List the AI systems in use and planned, built or bought, including AI features of SaaS tools and public chatbots used for work.
2. Note for each whether the company built it or uses it, which data it reaches and whether its output feeds decisions about people.
3. Write down the risks users of each system need to know, such as wrong answers, data leaving the company or instructions hidden in documents.
4. Sort the people by role and prior knowledge, and set the content and format of a module per role.
5. Deliver the module before access, record completion and repeat it when a tool, model, connector or use changes.

AI literacy training by role: users, administrators, developers, managers

Training concepts may differ in their level of detail, the Q&A confirms, and the table splits the content for a company that runs an internal assistant.

Our summary, based on Article 4(1) and recital 20 of Regulation (EU) 2024/1689, the Commission’s AI literacy Q&A (27 July 2026) and OWASP’s misinformation entry (LLM07:2026, LLM09:2025).

OWASP’s Top 10 for LLM Applications 2026, dated 3 August 2026 on its resource page, lists misinformation as LLM07:2026 and, on overreliance, notes that humans and systems “often treat fluent, confident, or well-structured outputs as authoritative”. The 2025 entry, LLM09:2025, recommends training users on “the importance of independent verification of generated content”. Recital 20 of the AI Act lists a related notion, “the suitable ways in which to interpret the AI system’s output”. A user session on the company’s own assistant can show a correct answer with its source, a confident wrong answer and a question outside the documents it can reach.

For administrators, the content is the permission model and the log: who sees which documents, what the query log records, who may read it and how long it is kept; our guide to a private ChatGPT alternative describes these components. Developers of RAG tools and agents learn how such systems are attacked, from instructions hidden in retrieved documents to tools with more rights than the user, which our article on prompt injection and LLM security covers. Managers who approve use cases have to recognise when a use moves towards a purpose listed in Annex III, such as filtering job applications, and send it to legal review first.

When we build a private AI platform, we train your team to work with it. Tell us which assistants you run or plan and who administers them.

How to document AI literacy measures

The Commission’s Q&A says there is no need for a certificate and that organisations “can keep an internal record of trainings and/or other guiding initiatives”.

Our summary; the Commission’s AI literacy Q&A (27 July 2026) says no certificate is needed and an internal record can be kept.

When access to an assistant depends on a completed module, the list of trained people and the list of users match, and contractors belong in the same record. The record holds personal data, so agree its retention and readers with your data protection officer.

In the first call we clarify your team’s level, goals and timelines, and you leave with a draft training programme. Describe the tools and roles you need to cover in the form below.

Enforcement and penalties for Article 4

Supervision and enforcement of Article 4 sit with national market surveillance authorities, not with the AI Office. Article 99 sets no fine amount for it, because its paragraphs 3 to 5 do not list Article 4. Penalties therefore follow the rules each Member State lays down under Article 99(1), which “may also include administrative fines, warnings and non-monetary measures”. Any sanction must be proportionate and based on the individual case, the Q&A adds.

The Q&A also describes private enforcement, a claim for damages by a person who suffers harm and attributes it to an organisation’s failure to meet Article 4; such claims run under national law, since the AI Act “doesn’t create criminal offences or a right to compensation”. Whether a company’s measures meet Article 4 is a legal assessment for its legal department. For deployers of high-risk systems, the separate duty to train the staff who carry out human oversight remains, as the Q&A notes; our AI Act guide covers Article 26 and its dates.

EU support: the repository of AI literacy practices

The Commission’s living repository of AI literacy practices, last updated on 10 August 2026, collects examples from AI Pact pledgers and other organisations; the Q&A counts more than 40, from e-learning platforms and in-person trainings to bootcamps. Its searchable version filters practices by sector, organisation size and type of practice. Replicating them “does not automatically grant presumption of compliance with Article 4”, the Commission states, but it will use the repository for the practical examples that Article 4(2) asks it to publish. We found no AI Board recommendation under Article 4(3) on the Board’s page, last updated on 18 September 2026.

General information on EU law as of October 2026, not legal advice for an individual case.

What we do

Our enterprise training builds tailored programmes from your team’s own tasks, online, on your site or blended, and AI is one of its topics. Eurokommerz holds the contract, and the training centre of our engineering partner Vixen.UNO delivers the training, with practitioner-instructors from its projects. The first call is free of charge, and the price is fixed before the training starts. Where our Private AI/ML service builds the platform, with a query log and data and permissions management, we also train your team to run it and develop it further.

FAQ