EU AI Act Article 4 explained: the AI literacy duty in plain English
Temja·June 30, 2026· 8 min read
the short version
- →Article 4 has applied since February 2025. It is live law, not a future plan.
- →It asks you to take measures that support AI-literacy development for people who use AI on your behalf, adapted to their knowledge and context.
- →It does not require a guaranteed specific individual level or a certificate. Internal records can show which measures you took.
- →National supervision and enforcement apply from 2 August 2026.
A century ago, factories learned a hard rule and never unlearned it. Powerful machinery needs trained people. You do not walk onto a forklift because a leaflet says it is safe. You earn a permit, you practice with your hands, you report the near miss. Article 4 of the EU AI Act carries that rule into the office. Your team now runs the most capable machine it has ever owned, and the law asks a simple question back: can they handle it?
What Article 4 actually says
The amended text is short. Providers and deployers of AI systems must take measures that support the development of AI literacy among their staff and anyone else operating AI on their behalf. Those measures take account of knowledge, experience, education, training, use context, and affected people. It expressly says no specific individual level has to be guaranteed.
Read the word literacy carefully
Literacy is about people, not tools. It is not proof that you bought an approved product. It is proof that the humans using AI can spot when something is off and know what to do next.
The definition of AI literacy sits in Article 3(56): the skills, knowledge and understanding that let people make informed use of AI, and become aware of its opportunities, its risks, and the harm it can cause. Notice the balance. It is not only about danger. It is about competent, confident use.
Who it covers
- Deployers: any company that uses an AI system in its work. That is almost everyone now.
- Providers: companies that build or sell AI systems.
- Other persons operating AI on your behalf: the Commission has been clear that this reaches contractors, service providers, and sometimes clients acting for you.
The last point surprises people. If a contractor runs an AI agent inside your process, their literacy is your concern too. This is why many vendors now hand buyers a literacy attestation as part of the sale.
The dates that matter
Article 4 is not waiting for August 2026. It already applies. Here is the timeline that shapes most compliance plans.
AI literacy applies
The Article 4 duty to take AI-literacy measures starts to apply.
Tap a point.
How context shapes the measures
The law does not hand you a syllabus, and that is deliberate. A data scientist and a finance clerk do not face the same risks, so the measures that support their development can differ. The Commission describes a flexible, context-based approach. Practical exercises are a strong way to learn, but Article 4 does not require a particular test or guaranteed score.
Recognition is what you know. Behavior is what you do when the clock is running and the invoice looks real.
This is where a lot of programs quietly fail. A person who can circle the phishing email in a slide has shown recognition. Put the same person in front of a convincing poisoned invoice, mid task, and watched knowledge does nothing. The reflex was never built. The gap is measurable.
Injection-catch rate before and after hands-on drills, from a two-wave program. Knowing the risk is not the same as catching it live.
The hard twin: Article 26
For high risk systems, literacy stops being soft. Article 26(2) says a deployer must assign human oversight to people who have the competence, training and authority to do it, plus real support. Read that as a gate. For any Annex III high risk deployment, such as hiring, credit, or essential services, a trained and empowered overseer is a legal precondition of running the system at all. Training moves from nice to have to compliance gate.
What it can cost to get wrong
Penalties live in Article 99. They scale with your global turnover, and the regulator takes the higher of a percentage or a fixed cap. Move the slider to see where your organisation would sit.
higher of 7% (€4m) or €35m fixed, so the fixed floor applies
higher of 3% (€2m) or €15m fixed, so the fixed floor applies
higher of 1% (€1m) or €7.5m fixed, so the fixed floor applies
Illustration of Article 99. The regulator picks the higher of a percentage and a fixed cap. Not legal advice.
How to prove it to an auditor
The legal duty is to take the measures, not to buy a particular course or certificate. The Commission says organisations can keep internal records of training and other guiding initiatives. A clear record helps show what you did, for whom, and when without pretending that one score proves legal compliance.
- 1Map roles to riskList who uses AI and what they can reach. Greater reach and consequence justify deeper support and practice.
- 2Train for behaviour, not attendanceUse hands on practice, not only slides. A drill record beats a completion certificate every time.
- 3Keep a tamper evident trailWho was trained, on which content version, with what result, re tested over time. Version your content so you can show what the law said when.
- 4Re test on a cycleLiteracy decays and the tools change. One and done is not a defence.
The one line to remember
Demonstrated competence beats demonstrated attendance. A completion certificate says a person sat through something. A drill record says a person met a live threat and either caught it or learned exactly what it would have cost.
Test yourself
Three quick questions. If you get them all, you are ready to shape a program.
1. When did the Article 4 AI-literacy duty start to apply?
2. What does amended Article 4 require?
3. For a high-risk system, human oversight must be done by someone who is:
take these with you
- 01Article 4 is live now and requires measures that support AI-literacy development in context.
- 02Literacy is behavioural. The test is whether people act safely under real conditions, not whether they watched a video.
- 03For high risk systems, Article 26 turns trained oversight into a precondition of operating at all.
- 04Keep a versioned, tamper evident record of which measures covered whom and what happened in practice.
Questions people ask
Is Article 4 in force yet?
Yes. It has applied since 2 February 2025, was amended in July 2026, and national supervision and enforcement apply from 2 August 2026.
Do small companies have to comply?
Yes. There is no size exemption. The measures can reflect the firm's knowledge, experience, AI-use context, and affected people.
Is there an official Article 4 certificate?
No. Article 4 mandates no certificate or guaranteed individual level. Organisations can keep internal records of training and other literacy initiatives to show the measures they took.
What is the fastest way to start?
Map who uses AI, give them hands on training that matches their role, and keep a record of the result. Evidence of competence is the goal.
from reading to reflex
See what trained behaviour looks like.
The drill takes about eight minutes. No sign-up, no card. Meet the poisoned invoice and find out if you reach STOP in time.
keep reading