EU AI Act Article 4: what the AI literacy duty means for your company

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, and its provisions apply in stages. One of the first to apply is Article 4 on AI literacy, in force since 2 February 2025. This article touches far more companies than is usually assumed, because it applies not only to those who build AI but to those who use AI systems.

What does Article 4 say?

The text is short: providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.

Three things in that text matter in practice. First, “deployers” means any organisation that uses an AI system in its activities, not only those who built it. Second, it requires “measures”, not a specific course or certificate. Third, the measures must fit the context: an employee who uses AI to edit text needs a different literacy than one who uses AI to make decisions about customers.

Who does it apply to?

A company whose staff use AI tools for work tasks is covered. It does not matter whether that is a chatbot for writing text, an automated system for processing invoices, or an AI feature inside a program already in use. The European Commission's questions and answers published in May 2025 confirm that the obligation applies from 2 February 2025 and covers all staff working with AI systems, regardless of role.

What is required in practice?

• Know which AI systems the company uses. Without that list it is impossible to say who needs which literacy.
• Assess the role each group of staff plays with those systems: using outputs, checking them, making decisions based on them.
• Provide knowledge that matches the role: how the system works, where it goes wrong, what may and may not be fed into it, how to check the output.
• Keep evidence that measures were taken: a programme, an attendance list, a date. The regulation prescribes no format, but a supervisory authority will need to see something.

What is not required?

The regulation sets no minimum number of hours, no mandatory certificate, and no accredited provider. The Commission's answers state that organisations decide themselves which measures are appropriate in their context. That means one day of hands-on training with the company's real tools can meet the requirement better than a generic online course nobody remembers.

How to meet it so that it is useful, not just formal?

The best way to comply with Article 4 is the same thing that pays off anyway: train people to work with the specific tools they use, on their own tasks and data samples. Managers need to be able to evaluate an AI proposal and its risk; staff need to know what may be given to a system, how to check the result, and when to hand over to a person. Such training ends with a list of rules and a list of participants, and both are evidence.

That is how the training service is built: the programme is fitted to your tools and processes, and after the training you keep documents you can show.

This article is not legal advice. For your specific situation, consult a lawyer on how the regulation applies.