EU AI Act Article 4: the AI literacy duty for employers, after the 2026 amendment

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to support the AI literacy of their staff. It also covers other people who operate or use AI systems on their behalf. The duty has applied since February 2, 2025 (European Commission). An amendment in July 2026 kept the duty but removed any required level of literacy for an individual (AI Act Service Desk).

This guide covers what the article says now, who it applies to, what the European Commission has said about it, and what to document. This is general information, not legal advice.

What Article 4 says

The amended Article 4 has three paragraphs (AI Act Service Desk):

• Paragraph 1: providers and deployers must take measures to support the AI literacy of their staff and of others who deal with AI systems on their behalf. The measures should take account of people’s technical knowledge, experience, education and training, and the context in which the AI systems are used. The obligation does not require any specific level of AI literacy for any individual.
• Paragraph 2: the Commission and the Member States must support providers and deployers, especially small and medium-sized enterprises. The Commission must publish practical examples of how to comply.
• Paragraph 3: the European AI Board will adopt recommendations, drawing on European competence frameworks, that set common objectives.

The Act defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems. It includes awareness of the opportunities and risks of AI and the harm it can cause (AI Act Service Desk).

What changed in July 2026

The Commission proposed the Digital Omnibus on AI on November 19, 2025, as part of a wider effort to simplify EU digital rules. Its amendments to Article 4 entered into force in July 2026 (European Commission).

The Commission's Q&A says the change keeps AI literacy as an obligation for providers and deployers. It no longer mandates a specific or "sufficient" level (European Commission). The duty is now to take measures. It is not a duty to reach a measured outcome for each person.

That does not make the duty optional. An organization still has to act, and it should be able to show what it did.

Who Article 4 covers

The duty falls on providers and deployers. A provider develops an AI system or model and places it on the market under its own name. A deployer is any person or body that uses an AI system under its authority, except for personal, non-professional use (AI Act Service Desk). Most employers that let staff use AI tools at work are deployers.

• Everyday tools count. The Commission says a company whose staff use ChatGPT to write advertising text or translate content must comply. Staff should learn about risks such as hallucination (European Commission).
• It reaches beyond employees. "Other persons" include contractors, service providers and clients who deal with the organization's AI systems (European Commission).
• It reaches beyond the EU. The Act applies to organizations outside the EU when the AI system is placed on the EU market, used in the EU, or affects people in the EU (European Commission).
• Experience counts, but is not enough alone. The Commission says people with an AI degree or experience can normally be considered literate. The organization should still check their knowledge of the specific system, its risks and the legal and ethical issues (European Commission).

What the Commission says is not required

• No certificate.
• No test of each employee’s knowledge.
• No specific training format, and no fixed number of hours.
• No AI officer or AI governance board.

There is no need for a certificate.

The Commission also says training is not strictly mandatory in every case. It adds that relying on a system's instructions for use alone is often not enough (European Commission).

What a program should cover

The Commission suggests four elements as a minimum (European Commission):

1. A general understanding of AI in the organization: what it is, how it works, which AI systems the organization uses, and their opportunities and dangers.
2. The organization’s role: whether it is a provider, a deployer or both.
3. The risks of the AI systems it provides or uses, and how to reduce them.
4. Measures built on the first three points, which account for differences in staff knowledge and in how each system is used.

The Commission encourages organizations to cover legal and ethical points, including the AI Act itself. It also describes the approach as risk-based. A high-risk system calls for more than a general chatbot does (European Commission).

High-risk systems carry a separate duty

Article 26 sets extra duties for deployers of high-risk AI systems. Annex III lists AI systems used to recruit, select, evaluate or monitor workers as high-risk (AI Act Service Desk). For those systems, the duties apply from December 2, 2027 (AI Act Service Desk). Deployers must assign human oversight to people with the necessary competence, training and authority (AI Act Service Desk). The Commission says this duty to train staff for human oversight is unchanged by the 2026 amendment (European Commission).

Article 26 also requires employers to tell workers' representatives and affected workers before they use a high-risk AI system at the workplace (AI Act Service Desk).

Enforcement

National market surveillance authorities enforce Article 4, not the EU AI Office. Supervision and enforcement rules apply from August 2026. Penalties come from national law. The Commission says enforcement should be proportionate, and an incident linked to poor training may make enforcement more likely (European Commission).

What to document

The Commission says an organization can keep an internal record of training and other guidance (European Commission). A useful record answers five questions:

• Which AI systems does the organization use or provide, and is it a provider or a deployer for each?
• What are the main risks of each system, and which staff groups use it?
• What measures did each group receive: training, guidance, policy, supervised practice?
• Who completed them, and when?
• When will the measures be reviewed, for example after a new tool or a policy change?

The Commission's living repository collects AI literacy practices from companies and public bodies. Copying a practice from it does not in itself mean an organization complies (European Commission).

Where to go next

For the training itself, see AI literacy training for employees. For the record, see documenting AI literacy training. Emeri’s team AI use policy template covers the rules staff follow day to day.

Article 4 does not require a test, but some organizations choose to measure skill to target their training. Emeri’s AI literacy assessment page explains one approach, and the free check gives an individual baseline in about 15 minutes.