AI Act training: the AI literacy obligation, Article 4

The AI literacy obligation in Article 4 of the AI Act applies to providers and deployers of AI systems. They must take measures to develop their staff's skills. It has applied since February 2, 2025. Since summer 2026, its enforcement has been a matter for national authorities, and the text has been relaxed: it requires measures, not a guaranteed level.

Here is what Article 4 says, who is covered, what the European Commission clarifies and how to train without piling up modules.

What does Article 4 of the AI Act say?

Article 4 of Regulation (EU) 2024/1689 deals with AI literacy. This means the skills and knowledge needed to use AI in an informed way. It has applied since February 2, 2025, like the first provisions of the regulation.

In its original wording, it required measures to ensure, to their best extent, a sufficient level of AI literacy among staff. Regulation (EU) 2026/1744, known as the “digital omnibus” on AI, amended it in July 2026.

According to the European Commission, the obligation remains for providers and deployers. It does not require guaranteeing a specific level of AI literacy for each individual. Member States and the Commission must support these efforts, and the European Artificial Intelligence Board adopts recommendations.

Who is covered?

Two categories of actors are covered. The provider develops an AI system or places it on the market. The deployer uses it under their own authority, in a professional setting.

Most companies are deployers as soon as their teams use a generative assistant, a resume screening tool or a scoring system. The people covered are employees and other persons who use AI on the organization's behalf, such as contractors or subcontractors.

• A customer service team that drafts its replies with a generative assistant.
• An HR team that uses a resume shortlisting tool.
• A legal team that summarizes contracts with a language model.
• An IT department that integrates an AI component into a product.

What do you actually need to do?

The European Commission states in its questions and answers that no certificate is required. The obligation does not ask for each employee's knowledge to be measured either. No particular structure is imposed, such as an AI officer or a governance committee.

Training is not strictly mandatory, but sticking to user instructions is generally insufficient. Deployers of high-risk systems must also ensure that the employees in charge of human oversight are trained.

Organizations can keep internal records of their training actions. That is the best defense if an authority asks questions.

Who enforces it, and from when?

The Commission indicates that supervision and enforcement of Article 4 have applied since August 2, 2026. They are a matter for national market surveillance authorities, not the European AI Office.

Penalties depend on national law. Enforcement is proportionate: the authority takes into account the nature and seriousness of the failure, and whether it was intentional. The AI Act does not create a criminal offense or a right to compensation of its own.

What the relaxation changes, and what it does not

The 2026 amendment removes the idea of a “sufficient” level to be guaranteed. It does not remove the obligation to act. An organization that has done nothing for its employees would be badly placed to answer an authority.

In practice, the question becomes: what have you done, for whom, and why were these measures suited to your uses? Three elements are enough to structure the answer.

1. An inventory of AI uses: which tools, which jobs, which data.
2. Proportionate measures: training, a usage policy, guidelines, support.
3. A record: dates, audiences, content, participant feedback.

A program built this way remains useful if the framework changes again, because it rests on your uses and not on the wording of an article. Other training obligations follow the same logic, as our article on proof of training shows.

How do you train for AI literacy?

A good program starts from real uses, not from a general course on artificial intelligence. The Commission asks that people's technical knowledge, experience and education be taken into account, as well as the context of use.

Four levels, four contents

1. All users: what a model does, its limits, plausible errors, data not to enter.
2. Exposed jobs: HR, legal, customer relations, finance, with their own use cases and risks.
3. Managers: deciding what can be automated, reviewing assisted work, answering the team's questions.
4. Technical teams: choice of systems, documentation, incident monitoring.

Our articles on training managers in AI and on GDPR training for employees link this content to data protection.

An example three-month sequence

A trainer can spread the effort rather than concentrating everything into one day. Month one is for the inventory of uses and a short shared awareness session. Month two offers practice scenarios by job, on the use cases listed. Month three adds a refresher session with managers, who review the errors observed.

This progression follows the way skills settle: you see them, try them, come back to them. It also produces records at different dates, which shows a sustained approach rather than a one-off exercise.

It fits what the Commission says: the organization adapts measures to the context, the starting knowledge and the risks of each job.

Practice rather than reading

Knowing that a model can be wrong is not enough. The right reflex is to reread, to check a source, to refuse to pass on sensitive data. It is built by doing, with feedback on what was done.

Imagine a customer service rep who receives from a colleague a text generated by an assistant, containing an invented regulatory reference. They must check it before sending it to the customer, and explain why:

• “I check the reference in the official source before replying to the customer.”
• “I don't paste a file's data into a tool the company hasn't approved.”
• “This text is a draft. I reread it and I'm the one who signs.”

Face Up lets trainers create this kind of role play from their real cases. The learner speaks, by voice or on video, with a persona played by an AI. They then receive a debrief: strengths, points to improve, an action plan, quotes of what they said. They can play again. See the page on role plays.

Common mistakes

• A single module for everyone. The text asks for context and role to be taken into account.
• Believing the relaxation removes the obligation. It remains, in the form of measures to be taken.
• Keeping nothing. Without a record, it is impossible to show your efforts to an authority.
• Training without framing uses. A clear usage policy is part of literacy.
• Forgetting contractors. The text also covers people who use AI on the organization's behalf.

Frequently asked questions

Is Article 4 still in force after the digital omnibus?

Yes. It remains applicable to providers and deployers. It now requires measures to support AI literacy, without guaranteeing a given level for each person.

Do I have to issue employees with a certificate?

No. The European Commission states that no certificate is required. An internal record of training actions is enough as proof of the efforts made.

Is my company covered if it only uses an AI assistant?

Yes, as a deployer, as soon as the tool is used in a professional setting. The scale of the measures depends on the uses and the risks.

How does this relate to other mandatory training?

Training hours are limited. Building AI literacy into practice scenarios on compliance, such as GDPR or ethics, avoids multiplying modules. We detail this in our overview of mandatory training.

To get started, list your AI uses by job, then choose two or three situations to practice. The article on the difference between completion and competence helps you choose the right indicators. To see a role play on one of your uses, book a demo.