EU AI Act Article 4: The AI Literacy Duty After July 2026

If your people use AI at work in the EU, then in our reading EU AI Act Article 4 probably applies to your company. It is the article on AI literacy, and it was amended in July 2026. This guide explains what the article says now, who it covers, and what a sensible company does about it.

This guide summarises official EU sources, checked on 5 October 2026. It is not legal advice. Ask your lawyer how the rules apply to your company.

Key takeaways

Article 4 is still a duty. Companies “shall take measures to support the development of AI literacy” of their staff and of others who use AI on their behalf.^[1]
Since July 2026, the article states that it “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.^[1]
The Commission says that no mandatory trainings are imposed and that no certificate is needed. Organisations can keep an internal record of what they did.^[3]
The duty has applied since 2 February 2025.^[5] National authorities supervise it as of 2 August 2026.^[3]

What does EU AI Act Article 4 say?

Article 4 is the part of the EU AI Act that deals with AI literacy. In its current version, the first paragraph reads as follows. The “consolidated version” is the current text with all changes included.

“Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”EU AI Act, Article 4(1), consolidated version of 27 July 2026

The Act also defines the term. AI literacy means “skills, knowledge and understanding that allow providers, deployers and affected persons […] to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause”.^[2]

In plain words: people who use AI at work should know what the tool can do, where it goes wrong, and what harm a mistake can cause.

What changed in July 2026?

An EU regulation, often called the AI Omnibus, entered into force on 27 July 2026.^[4] It changed several parts of the AI Act, including Article 4. The Commission describes the change in one line: the “previous AI literacy requirement for companies is simplified, with the Commission and the Member States taking a stronger role in promoting AI literacy”.^[4]

What Article 4 of the EU AI Act says since July 2026: still a duty, no guaranteed level, support from the Commission and Member States

Three things are worth knowing:

It is still a duty. The Commission’s own question-and-answer page says the article was amended to “ensure AI literacy remains an obligation for providers and deployers of AI systems”.^[3]
No level is guaranteed. The same page says “no specific – or ‘sufficient’ – level is mandated”. In our reading, the duty is to take measures, not to prove what each person knows.
The EU supports companies. Paragraph 2 says the Commission and the Member States, which are the EU countries, “shall support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs”. The Commission is to publish practical examples of how to comply.^[1]

The Commission says no “sufficient” level is mandated. A guide that still asks you to ensure one is, in our reading, out of date.

Who does Article 4 apply to?

The article names two groups: providers and deployers. Put simply, a provider develops an AI system and puts it on the market. Most readers are deployers. The Act defines a deployer as a person or organisation “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”.^[2] If your company uses Claude, ChatGPT or an AI feature inside your customer database for work, you are, in our reading, a deployer.

The duty covers more than employees. It includes “other persons dealing with the operation and use of AI systems on their behalf”. The Commission gives examples: “a contractor, a service provider, a client”.^[3]

What about companies outside the EU? The Act also covers providers and deployers in a country outside the EU “where the output produced by the AI system is used in the Union”.^[6] In our reading, a Swiss or British company whose AI output is used in the EU should not assume it is outside. That is a question for your lawyer.

Since when does it apply, and who enforces it?

Since 2 February 2025. Article 4 sits in Chapter I of the Act, and Chapters I and II “shall apply from 2 February 2025”.^[5]
Supervised as of 2 August 2026. The Commission says enforcement “is not with the AI Office”, which is the Commission’s own AI unit. It is with national market surveillance authorities, the bodies in each country that supervise products. They “will start supervising and enforcing the rules as of 2 August 2026”.^[3]
Penalties are a national matter. Under Article 99, “Member States shall lay down the rules on penalties and other enforcement measures”.^[7] The Commission adds that national authorities “could impose penalties” for breaches of Article 4, and that enforcement “follows a proportionate approach”.^[3]

In our reading, the answer to “what is the fine?” depends on national law. Ask your lawyer. The Commission also notes that the AI Act “doesn’t create criminal offences or a right to compensation”.^[3]

What “taking measures” can look like: four steps

The law does not prescribe a programme. The Commission says there is “no one size fit all” and that “no strict requirements or mandatory trainings are imposed”.^[3] What follows is our suggestion for a mid-sized company. It is one sensible way, not the only one, and it is not legal advice.

Four steps for AI literacy in a mid-sized company: list who uses AI, sort by role, train on real work, keep a record

A four-step approach. Our suggestion, not a legal requirement and not legal advice.
Step	What you do	Why
1. List	Write down who uses which AI tool, including contractors who work for you	The duty covers staff and others who use AI on your behalf
2. Sort	Group people by role and by how sensitive their use is	The article asks you to consider knowledge, experience and context
3. Train	Teach each group on its own tasks, not with one general course	People remember what they practised on real work
4. Record	Keep a simple record of what was done, for whom, and when	The Commission says organisations can keep an internal record

1. List who uses AI

Start with a plain list: which tools, which teams, which outside people. For example, a sales team that uses an AI assistant in its customer database, a finance team that uses ChatGPT for analysis, and an agency that writes your marketing texts with AI.

2. Sort by role and context

Not everyone needs the same knowledge. A person who drafts emails needs the basics: what the tool does, when it is wrong, what never to paste into it. A person who uses AI to screen job applicants needs much more, because the possible harm is larger.

3. Train on real work

A general course on prompts is the usual answer, and it changes little. People learn when they bring a task from their own week and solve it with the tool. This is how our weekly office hours work. See how the PromptPartner Academy runs them.

4. Keep a record

The Commission is clear on this point: “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.”^[3] A simple table can do this: the date, the group, the topic, who took part.

What you do not need

The Commission’s question-and-answer page says three things on this.^[3] This is a summary, not legal advice.

No certificate. Organisations can keep an internal record.
No mandatory course. No strict requirements or mandatory trainings are imposed.
No AI officer under Article 4. The page says “no specific governance structure is mandated to comply with article 4”. Other rules may ask for more.

The Commission also keeps a public collection of examples, the “living repository of AI literacy practices”. One caution from its own page: copying those practices “does not automatically grant presumption of compliance with Article 4”. In plain words, copying an example does not prove that you comply.^[8]

How this fits into your AI rollout

AI literacy is one of five decisions a company makes when it sets its rules for AI. The others are which tools are approved, which data may go in, what AI may do, and who owns each use. Our guide to an AI governance framework for mid-sized companies puts all five on one page.

In our method, training is not a separate project. It runs next to the build: while the use cases go live in your systems, your people learn to use them. See how the method works.

Frequently asked questions

What is Article 4 of the EU AI Act?

It is the article on AI literacy. Providers and deployers of AI systems must take measures to support the AI literacy of their staff and of other people who use AI on their behalf. It has applied since 2 February 2025 and was amended in July 2026.

Is AI training mandatory under the EU AI Act?

Taking measures is mandatory. A specific training is not. The European Commission says that no strict requirements or mandatory trainings are imposed, and that there is no single format that fits every organisation.

Do we need a certificate to prove AI literacy?

No. The Commission states that there is no need for a certificate. Organisations can keep an internal record of trainings and other guiding initiatives.

What changed in Article 4 in 2026?

Since 27 July 2026, the article asks companies to take measures to support AI literacy, without guaranteeing any specific level for any individual. The Commission and the Member States received a stronger role in supporting companies.

What is the penalty for breaching Article 4?

In our reading, it depends on national law. Member States set the rules on penalties. The Commission says national authorities could impose penalties for breaches of Article 4, and that enforcement follows a proportionate approach.

Does Article 4 apply to companies outside the EU?

It can. The AI Act covers providers and deployers in a country outside the EU where the output produced by the AI system is used in the Union. A Swiss or British company should check this with a lawyer.