Article
AI Act Article 4: what AI literacy actually requires of a company
Article 4 is the AI Act duty that reaches almost every company that uses AI at all, and it is the one most often described wrongly. It does not ask for certificates, a minimum score or a named course. It asks a provider or a deployer of an AI system to take measures that support the AI literacy of the people who work with that system.
What the article says now
Article 4 was replaced in full by Regulation (EU) 2026/1744, with effect from 27 July 2026. The wording in force asks providers and deployers to take measures to support the AI literacy of their staff and of other people dealing with the operation and use of AI systems on their behalf. The measures take account of those people's technical knowledge, experience, education and training, of the context the systems are used in, and of the people the systems are used on.
The last sentence of the article decides what a company owes: the obligation does not require anyone to guarantee a specific level of AI literacy in any individual. The verified wording and its sources.
Who it reaches
The duty falls on providers and on deployers. A deployer is the company using the system under its own authority, so a firm that switches on an AI feature in its CRM or its applicant tracking system is a deployer of that feature.
The people the measures are for are wider than the payroll. The Commission's questions and answers on AI literacy, which are guidance and not binding, read "persons dealing with the operation and use of AI systems on their behalf" as people under the organisation's remit who are not employees: a contractor, a service provider, in some cases a client.
| Group | Inside the duty |
|---|---|
| Staff who use the system | yes |
| Contractors and service providers who operate it for you | yes |
| A client working within your organisation's remit | can be, says the Commission |
| The people the system is used on | not as learners, but the measures must take them into account |
What a reasonable measure looks like
Because the article ties the measures to knowledge, context and the people affected, there is no single course that fits everyone. The recruiter who reads a ranked shortlist needs to know what the ranking is built from and when to ignore it. The developer who wires a model into a support desk needs to know what it does with customer data. The same training for both is easy to buy and hard to defend.
A short, honest set of measures usually covers four things:
- which AI systems this person touches, and what each one is used for
- what the system can get wrong in this use, and what that would cost the people it is used on
- when the person must not rely on the output, and who to tell
- where to find the instructions and the internal rules that apply
What to keep as a record
The Commission's guidance says there is no need for a certificate and that an organisation can keep an internal record of training and other guiding initiatives. That record is worth keeping even though the article does not prescribe it, for one practical reason: the same guidance notes that national authorities could impose penalties for breaches of Article 4, and that this becomes more likely where an incident can be traced to a lack of training and guidance.
A one-page record per system is enough to start with: who uses it, what they were shown and when, and what triggers a refresh, such as a new feature, a new use or a new group of users.
Where this fits
AI literacy is one entry in a larger file: the inventory of what you use, the decisions you made about each use, and the triggers that reopen them. The AI Act File walks through that file document by document, with a printable form for each, including the training record described above.