EU AI Act Article 4: AI Literacy — What Your Company Must Do

Article 4 is part of Regulation (EU) 2024/1689, known as the EU AI Act. In its current wording it obliges providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf (text of Article 4).

The measures take into account people’s technical knowledge, experience, education and training, the context in which the systems are used, and the persons on whom they are used. So training will not be identical for every role in the company.

The obligation is not limited to technology companies. According to the European Commission it also applies to a company whose employees use ChatGPT to write or translate text: they should be informed about the specific risks, for example hallucination (Commission Q&A). The text does not exempt small companies, but it provides support for them, especially for SMEs.

The European Commission presented the Digital Omnibus on AI on 19 November 2025 as a proposal (Commission Q&A). It is no longer a proposal: it was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, and enters into force on the third day after publication, that is, from 27 July 2026.

The regulation replaces Article 4. The obligation remains, but instead of ensuring, to their best extent, a sufficient level of AI literacy, companies take measures to support its development and are not required to guarantee a specific level for any individual. The Commission and Member States support their efforts, and the AI Board adopts recommendations.

The Commission confirms that the obligation stays but no specific or “sufficient” level is mandated; for deployers of high-risk AI the duty to train staff for human oversight also remains (Commission Q&A).

Article 4 covers providers and deployers of AI systems — which includes companies that only use AI systems built by others. It covers staff as well as “other persons dealing with the operation and use of AI systems on their behalf”.

The Commission explains that these are not necessarily employees but people within the organisation’s remit — for example a contractor, a service provider or a client. Depending on the risk, it can also be useful for clients to have some literacy (Commission Q&A).

The AI Act’s rules also apply to companies outside the EU if the AI system is placed on the Union market, used in the Union, or its use affects people there; the Commission says this holds for Article 4 too (Commission Q&A). For a company in Bulgaria this means the obligation depends on using AI, not on company size.

A certificate is not needed. The Commission is explicit: organisations can keep an internal record of training and other guiding initiatives (Commission Q&A). There is also no obligation to measure employees’ knowledge.

There is no single format: the Commission writes that there is no one-size-fits-all approach and no strict requirements or mandatory trainings are imposed. In many cases, however, simply relying on a system’s instructions for use, or asking staff to read them, may be ineffective. Different levels of training for different people are allowed.

The Commission says that at least four steps should be considered when building a programme — they are in the table. The Commission’s repository of AI literacy practices is a useful reference, but replicating practices from it does not automatically grant a presumption of compliance.

Article 4 has applied since 2 February 2025, so the obligation to take measures already exists (Regulation 2024/1689, Article 113). The supervision and enforcement rules apply from 2 August 2026 (Commission Q&A).

Supervision is not with the AI Office but with national market surveillance authorities. They can impose penalties and other measures based on Member States’ national law. The Commission stresses that enforcement is proportionate: the nature and gravity of the infringement and whether it is intentional or negligent are taken into account.

The Commission notes that a penalty may be more likely where there is proof of an incident caused by a lack of appropriate training and guidance for staff. The AI Act itself creates no criminal offences and no right to compensation; private claims are governed by national law (Commission Q&A).

The steps below follow the questions in the Commission’s Q&A and are not legal advice. The aim is for training to rest on an analysis of the company rather than on an identical course for everyone. The first four steps point to the Commission’s Q&A so you can check each one yourself.

If these steps are part of a broader programme, see AI transformation for companies · the Encorp AIM method and AI governance and the EU AI Act.

The first three steps are analytical and can be done in-house, for example with a short questionnaire to department heads. The fourth is the training itself: it helps when different roles — leadership, sales, finance, HR and IT — receive different content. The fifth and sixth make the work verifiable: the record shows the company has taken measures, and the periodic review keeps the plan current.

Training is phase 1 of Encorp AIM and is organised by role and department. It ends with an attestation of completed AI literacy training (Article 4 of the EU AI Act).

The attestation is an internal document for the company’s file — it is not a certification under the law and does not replace the risk assessment. The Commission expressly states that no certificate is needed; the record of completed training is part of the evidence that the company has taken measures.

See AI training for companies for the formats and AI governance and the EU AI Act for the rules around using AI in the company.

In practice Article 4 is easiest to address as part of a broader programme: the same training that builds skills also produces the record for the file. If you want to see where you stand first, start with the free AI readiness test.