AI literacy under Article 4 — what's required

Article 4 of the EU AI Act is short, broad, and binding on every European company that uses AI in any capacity. It has applied since 2 February 2025, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) reworded it with effect from 27 July 2026: the duty to act stays, the demand for a particular level of literacy is gone. This guide is the practical interpretation.

What Article 4 actually says

Since 27 July 2026, Article 4(1) reads:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

Paragraph 2 has the Commission and the Member States support providers and deployers, SMEs in particular, and has the Commission publish practical examples of how to comply. Paragraph 3 has the AI Board adopt recommendations. The earlier wording asked for measures to ensure, to their best extent, “a sufficient level of AI literacy”; that phrase is gone.

In plain language: anyone whose work involves AI systems — your developers, your product managers, your customer-support reps using AI-augmented tooling, your sales team using AI prospecting tools — should get the support to build the AI literacy that fits what they actually do. You must take the measures; you do not have to guarantee the result for each person.

Who’s in scope

The provision binds both providers and deployers — which means almost every European company. If you build AI features, you’re a provider. If you use a third-party AI tool (Copilot, ChatGPT for Work, an AI candidate-screening service), you’re a deployer.

It covers your staff (employees and contractors) and also “other persons dealing with the operation and use of AI systems on your behalf” — which means your offshore developers, your agencies, your support outsourcers. The literacy requirement follows the work, not the org chart.

How much is enough

There is no certification scheme, and the article itself now says that no particular level has to be guaranteed for any individual. What has to fit are the measures: they take into account people’s technical knowledge, experience, education and training, the context the AI is used in, and the people it is used on. In practice the support differs by role:

• An ML engineer training a high-risk model needs to know risk management, data governance, evaluation methodology, fairness metrics, and the relevant Articles of the Act
• A product manager scoping a chatbot needs to understand Article 50 transparency obligations and what the Article 5 prohibitions mean for prompt engineering
• A customer-support rep using an AI summariser needs to understand that summaries can be wrong, what to do when they are, and how to flag failures
• An executive who buys AI tools needs to understand vendor due diligence and the deployer obligations under Article 26

The effort rises with both the role and the risk tier of the AI involved. A team using a minimal-risk autocomplete needs less support than a team operating a high-risk credit scoring engine.

One duty is stricter than Article 4. From 2 December 2027, a deployer of a high-risk AI system under Annex III must assign human oversight to people who have the necessary competence, training and authority (Article 26(2)). That concerns named people, not literacy in general.

What we recommend

Article 4 prescribes no format, and we know of no published enforcement practice yet. What follows is our own practical advice for a programme you can show:

1. A documented programme. “We mentioned AI in onboarding” is hard to show. A written training plan is easy to show.
2. Role-specific content. A one-size-fits-all training video rarely fits the context the article asks you to consider. Engineers need different content than account managers.
3. Periodic refresh. The AI landscape moves fast. An annual refresher is a sensible default.
4. Records of completion. Names, dates, training modules. The audit trail.

What a programme can look like

A minimal AI literacy programme for an SME has five elements:

1. A baseline module for all staff

A 30–45 minute primer covering:

• What AI is and isn’t (rough generative-vs-discriminative, ML-vs-rules)
• The EU AI Act in one page: prohibited, high-risk, limited, minimal
• The company’s policy on using AI tools (which are approved, which aren’t)
• How to flag AI errors and harms
• Where to ask questions

2. Role-specific extensions

Layer on top of the baseline:

• Engineering / data science: model evaluation, bias testing, the Article 9–15 obligations if you build high-risk systems
• Product: intended-use classification, Article 50 transparency design, human oversight design patterns
• Customer-facing roles: when AI assistance can be wrong, escalation paths, what users must be told
• HR / people: what Article 5 prohibits in workplace AI, what Annex III item 4 means for the ATS

3. Tool-specific micro-trainings

A 5–10 minute walk-through every time a new AI tool is rolled out — what it does, what it doesn’t do, when not to trust it.

4. Records

A simple table: who, what, when, evidence (e.g., a course-completion timestamp). Article 4 has no record-keeping rule; records are simply how you show, when anyone asks, which measures you took.

5. Refresh cadence

Annual baseline refresh. Role-specific refresh whenever the regulation, your AI stack, or the role substantially changes.

What you can borrow

You don’t have to build all of this from scratch. The European Commission publishes questions and answers on Article 4 and, as the amended article requires, practical examples of how companies comply. The OECD has a free AI literacy framework. The CEN-CENELEC JTC 21 group has work in progress on standards. Use them as scaffolding.

Inside Maditon specifically, the “Learn EU AI Act” tutor and its quizzes are designed to give each member of your team a structured way to develop and demonstrate AI literacy as part of normal product use. Every learning session and every quiz score is captured per user — feeding directly into your Article 4 records.

What this is not

Article 4 does not require:

• A specific certification (none exists)
• A guaranteed level of AI literacy for any individual — the amended article says so expressly
• Identical training for every employee
• External validation (you can run the programme in-house)
• Training the public — only your staff and “other persons dealing with the operation and use”

It does require measures that fit your people and your AI — proportionate, and best documented. The single biggest mistake is to read the 2026 amendment as the end of the duty. It isn’t: the obligation to take measures has applied since February 2025 and still does. Build the programme now if you haven’t.