What does Article 4 require?

Providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The measures take into account people's technical knowledge, experience, education and training, the context the AI systems are used in, and the people they are used on.

Does it apply if we only use ChatGPT, Claude or Copilot?

Yes. A company that uses an AI system under its authority is a deployer (Article 3(4)), and Article 4 applies to deployers whatever the risk level. The Commission's Q&A gives the example of employees using ChatGPT to write advertising text or translate: they should be informed about specific risks such as hallucination.

Since when, and who enforces it?

Article 4 has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026, under penalty rules set in national law. The AI Office does not enforce Article 4.

Do we need a certificate or a test?

No. The Commission says no certificate is needed and that Article 4 does not entail an obligation to measure employees' knowledge. Organisations can keep an internal record of trainings and other guidance.

Is AI training mandatory under Article 4?

The Commission says there is no one size fits all, and no strict requirements or mandatory trainings are imposed. What a company needs depends on its answers to the four steps above. In many cases, only asking staff to read the instructions for use will not be enough.

Does copying the Commission's living repository make us compliant?

Not automatically. The repository collects more than 40 AI literacy initiatives from companies and public bodies, from e-learning to bootcamps. The Commission says replicating them does not currently grant a presumption of compliance. It will use the repository for the examples of compliance it publishes under Article 4(2).

Did the Digital Omnibus remove the duty?

No. In November 2025 the Commission had proposed shifting the duty to the Member States and the Commission. The adopted Regulation (EU) 2026/1744 keeps an obligation on providers and deployers to take measures, and drops the requirement of a sufficient level.

Do we need an AI officer or an AI governance board?

No. The Commission says no specific governance structure is mandated to comply with Article 4.

Are there extra Article 4 rules for banks, insurers or healthcare?

No. The AI Office imposes no sector-specific requirements, but the sector, the purpose and the risk level of each AI system should shape the training.

Do our developers need AI literacy training too?

People with a degree or experience in AI development are normally AI literate, but the Commission says it depends on the tool and their qualification. Check that they know your organisation's AI systems, their risks and how to mitigate them, and the legal and ethical aspects.

AI literacy under the EU AI Act (Article 4): what companies using AI tools must do

Last updated 9 November 2026

Article 4 of the AI Act is the one AI Act duty that already applies to almost every company that uses AI. It has applied since 2 February 2025, and it covers a company whose staff draft text in ChatGPT, write code with Claude Code or summarise documents with Copilot. The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote the article in July 2026. It is still an obligation.

This page sets out the text of Article 4 and the definition in Article 3(56), what the European Commission's AI literacy Q&A expects, when national authorities enforce it, and a checklist you can work through. Sources are EUR-Lex and the Commission, checked on 9 November 2026. It is not legal advice.

Create a company workspaceor write to contact@standardcompute.com

Deutsch Français Nederlands Español Italiano Svenska Norsk Dansk Suomi Polski

Short answers

What does Article 4 require?: Providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The measures take into account people's technical knowledge, experience, education and training, the context the AI systems are used in, and the people they are used on.
Does it apply if we only use ChatGPT, Claude or Copilot?: Yes. A company that uses an AI system under its authority is a deployer (Article 3(4)), and Article 4 applies to deployers whatever the risk level. The Commission's Q&A gives the example of employees using ChatGPT to write advertising text or translate: they should be informed about specific risks such as hallucination.
Since when, and who enforces it?: Article 4 has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026, under penalty rules set in national law. The AI Office does not enforce Article 4.
Do we need a certificate or a test?: No. The Commission says no certificate is needed and that Article 4 does not entail an obligation to measure employees' knowledge. Organisations can keep an internal record of trainings and other guidance.

The text of Article 4 and Article 3(56)

Article 4(1), as replaced by Regulation (EU) 2026/1744: “Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

Article 4(2) and (3) are addressed to the authorities. The Commission and the Member States support providers and deployers, in particular SMEs, and the Commission publishes practical examples of how to comply on the single information platform. The AI Board adopts recommendations that take European competence frameworks into account.

Article 3(56), which the Omnibus did not change, defines the term: “‘AI literacy’ means skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.”

Who it covers

Your company, as soon as it uses an AI system in its professional activity. The duty applies to providers and deployers alike and is not limited to high-risk systems. A company that buys and uses AI tools is a deployer. One that develops an AI system and places it on the market or puts it into service under its own name is a provider.

Your staff and other persons acting on your behalf. The Commission's Q&A says Article 4 concerns anyone in the organisation directly dealing with an AI system. “Other persons” are people broadly under the organisation's remit who are not employees, for example a contractor, a service provider or a client. People working for a contractor need the AI skills their task requires, the same as employees.

Companies outside the EU. According to the Q&A, Article 4 applies like the rest of the AI Act to actors inside and outside the EU, as long as the AI system is placed on the Union market, used in the Union or its use has an impact on people located in the EU.

What “sufficient level” means now

The original Article 4 asked providers and deployers to “ensure, to their best extent, a sufficient level of AI literacy”. The Digital Omnibus replaced that wording. According to the Commission's Q&A, ensuring AI literacy remains an obligation, no specific or “sufficient” level is mandated, and there is no obligation to measure employees' knowledge.

What the Commission does expect is a programme that fits the organisation. Its Q&A lists what to consider at a minimum:

Minimum content of an AI literacy programme, from the Commission's Q&A
Step	The question to answer	What to write down
General understanding of AI	The question to answer: What is AI, how does it work, which AI do we use, and what are its opportunities and dangers?	What to write down: A short introduction every user completes before getting access
Your role	The question to answer: Do we develop AI systems, or use systems developed by another organisation?	What to write down: Provider or deployer, per AI system
Risk of the AI systems	The question to answer: What do employees need to know about this system, which risks must they be aware of, and how are they mitigated?	What to write down: Known risks per tool, such as hallucination, confidential data in prompts or code that needs review
People and context	The question to answer: How much do these people already know, what else should they know, and in which sector and for which purpose is the system used?	What to write down: Training content per role, and why it fits that role

From the Commission's AI literacy Q&A, last updated 20 October 2026. The Q&A encourages covering legal and ethical aspects, including an understanding of the AI Act.

The Q&A adds that in many cases relying on the instructions for use, or asking staff to read them, might be ineffective. Different levels of training for different groups are allowed.

For high-risk AI systems more applies. Article 26(2) requires deployers to assign human oversight to people who have the necessary competence, training and authority, and the Commission notes that this training duty remains in place after the Omnibus. The deployer duties for Annex III high-risk systems apply from 2 December 2027.

Dates and enforcement

Article 4 timeline
Date	What happens	Source
2 February 2025	What happens: Article 4 applies, with the rest of Chapters I and II of the AI Act	Source: AI Act, Article 113
2 August 2025	What happens: Member States are due to have national penalty rules in place	Source: Commission AI literacy Q&A
24 July 2026	What happens: Regulation (EU) 2026/1744, the Digital Omnibus on AI, is published in the Official Journal and replaces Article 4	Source: Official Journal
27 July 2026	What happens: Regulation (EU) 2026/1744 enters into force	Source: Regulation (EU) 2026/1744, Article 4
2 August 2026	What happens: National market surveillance authorities supervise and enforce Article 4	Source: Commission AI literacy Q&A
2 December 2027	What happens: Deployer duties for Annex III high-risk systems apply, including human oversight by trained staff (Article 26(2))	Source: AI Act, Article 113 as amended

Summary of the official texts, checked on 9 November 2026. Not legal advice.

National authorities can impose penalties and other enforcement measures under national law. The Commission stresses that any sanction must be proportionate and based on the individual case, taking into account the nature and gravity of the infringement and whether it was intentional or negligent. It adds that action is more likely where an incident is shown to result from a lack of training and guidance.

The Q&A also describes private enforcement: a person who suffers harm can sue under national law. The AI Act itself creates no criminal offences and no right to compensation.

A practical checklist

Eight steps that cover what the Commission's Q&A asks for and leave a record you can show an authority. The EU AI Act deployer checklist puts AI literacy next to the other deployer duties.

AI literacy checklist for companies that use AI tools
Step	What to do	Evidence to keep
1. List the AI tools in use	What to do: Chat assistants, AI features in other software, coding agents and model APIs, with the teams that use each one	Evidence to keep: AI inventory with an owner and the users of each tool
2. Set your role per tool	What to do: Deployer for tools you use; provider for systems you develop and put into service under your own name	Evidence to keep: Role noted in the inventory
3. Write down the risks per tool	What to do: Hallucination, confidential or personal data in prompts, unreviewed code, AI-generated content published to the public	Evidence to keep: Risk notes per tool
4. Train by role	What to do: A base module for everyone, and deeper modules for power users and developers, for managers who approve use, and for anyone overseeing a high-risk system	Evidence to keep: Training plan with the content for each role
5. Publish an AI usage policy	What to do: Approved tools, which data may go into prompts, human review of outputs, who to ask	Evidence to keep: Policy with version and date, for example from the AI usage policy template
6. Keep training records	What to do: Date, people, content and the tool covered; no certificate is needed	Evidence to keep: Internal training register
7. Cover contractors	What to do: People who operate or use AI on your behalf need the skills their task requires	Evidence to keep: A contract clause or the contractor's training records
8. Review when tools change	What to do: A new tool, model or use case: update the inventory, the risks and the training	Evidence to keep: Review dates in the register

Not legal advice. Your legal team decides what Article 4 requires of your company.

When you buy AI tools, the LLM gateway RFP template includes requirements for per-app records of models and providers, which give step 1 a reliable source.

Records a gateway can add to your file

A training register shows who was trained. It helps to also know who actually uses which models. Standard Compute is one way to keep that record for model APIs, Claude Code and Claude Desktop. Organize your company into teams, invite colleagues by email, and give every person and every app its own key, all under one company account. Decide which models each key can use, so every app and every team member gets exactly the models you approve.

Every admin change is recorded with before and after values, including new people and new keys, so access can be matched against the training register. Connect Microsoft Entra ID or any SAML identity provider so your people sign in to Standard Compute with their work accounts.

These records show access and use. They are not a training record, and they do not show that anyone is AI literate.

Questions from legal, compliance and procurement

Is AI training mandatory under Article 4?: The Commission says there is no one size fits all, and no strict requirements or mandatory trainings are imposed. What a company needs depends on its answers to the four steps above. In many cases, only asking staff to read the instructions for use will not be enough.
Does copying the Commission's living repository make us compliant?: Not automatically. The repository collects more than 40 AI literacy initiatives from companies and public bodies, from e-learning to bootcamps. The Commission says replicating them does not currently grant a presumption of compliance. It will use the repository for the examples of compliance it publishes under Article 4(2).
Did the Digital Omnibus remove the duty?: No. In November 2025 the Commission had proposed shifting the duty to the Member States and the Commission. The adopted Regulation (EU) 2026/1744 keeps an obligation on providers and deployers to take measures, and drops the requirement of a sufficient level.
Do we need an AI officer or an AI governance board?: No. The Commission says no specific governance structure is mandated to comply with Article 4.
Are there extra Article 4 rules for banks, insurers or healthcare?: No. The AI Office imposes no sector-specific requirements, but the sector, the purpose and the risk level of each AI system should shape the training.
Do our developers need AI literacy training too?: People with a degree or experience in AI development are normally AI literate, but the Commission says it depends on the tool and their qualification. Check that they know your organisation's AI systems, their risks and how to mitigate them, and the legal and ethical aspects.

Sources

Regulation (EU) 2024/1689 (AI Act): Article 3(56), Article 4 as originally adopted, Article 113 (EUR-Lex), checked 2026-11-09
Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 24 July 2026: Article 1(5) replaces Article 4 (EUR-Lex), checked 2026-11-09
AI Act, Article 4: AI literacy, consolidated text (AI Act Service Desk), checked 2026-11-09
AI Act, Article 26: obligations of deployers of high-risk AI systems, checked 2026-11-09
AI Act, Article 113: entry into force and application, checked 2026-11-09
European Commission: AI literacy, questions and answers (last updated 20 October 2026), checked 2026-11-09
European Commission: living repository of AI literacy practices, checked 2026-11-09

Create a company workspace, give every person and app its own key with the models you approve, and keep the access record next to your training register.

Create a company workspace