EU AI Act Article 4: What the AI Literacy Requirement Means for Your Organization (2026 Update)

If your organization uses AI tools at work, and almost every organization now does, the EU AI Act has something to say about how prepared your people are to use them. Article 4, the Act's AI literacy provision, is one of the few parts of the law that applies to nearly every organization, not just companies building high-risk AI systems.

It has also just changed. In July 2026, the EU's "Digital Omnibus on AI" (Regulation (EU) 2026/1744) rewrote Article 4. The obligation survived, but its wording and its legal standard are different from the version that first applied in February 2025. Here's what it says now, who it applies to, and what a sensible AI literacy program looks like.

This guide is general information, not legal advice. For the authoritative text, see the regulations on EUR-Lex linked at the end, and talk to your legal team about your specific situation.

What Article 4 requires

The original Article 4 of the AI Act (Regulation (EU) 2024/1689) read:

Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.

The amended Article 4 keeps the obligation on the same organizations, but changes what they must do: providers and deployers must now take measures to support the development of AI literacy of their staff and of others operating or using AI systems on their behalf. The words "ensure" and "sufficient level" are gone.

In plain terms: you no longer have to guarantee that every employee reaches a particular level of AI literacy. You do still have to take real, deliberate measures to build it, and be able to show what you did.

Who it applies to

Article 4 covers two groups:

• Providers: organizations that develop an AI system, or have one developed, and put it on the market or into service under their own name.
• Deployers: any organization that uses an AI system under its authority in a professional context. If your employees use generative AI assistants, AI features in your CRM or HR software, or AI-powered analytics at work, your organization is very likely a deployer.

The Act can also reach organizations outside the EU, for example providers placing AI systems on the EU market, and providers or deployers whose AI system's output is used in the EU. If you have EU operations, customers, or employees, assume Article 4 is relevant to you.

When it applies, and how it's enforced

• 2 February 2025: the original Article 4 started to apply.
• July 2026: the amended Article 4 took effect through the Digital Omnibus.
• From August 2026: national market surveillance authorities supervise compliance, with penalties set in each Member State's national law.

Article 4 has never come with its own fine in the AI Act itself, and the amended standard is lighter. But that doesn't make it optional. A missing or token AI literacy effort is also a weak foundation if something goes wrong with an AI system your people were using, and AI literacy underpins several other obligations in the Act, such as the human oversight required for high-risk systems.

What "AI literacy" means here

The AI Act defines AI literacy as the skills, knowledge, and understanding that allow people to make an informed deployment of AI systems, and to gain awareness of the opportunities and risks of AI and the possible harm it can cause.

That definition is broader than "knows how to write a prompt." It includes:

• Understanding what AI is and isn't: how the systems your teams use work at a conceptual level, and where they tend to fail.
• Using AI well: getting useful results, checking outputs, and knowing when not to use AI at all.
• Recognizing risks: inaccuracy and hallucination, bias, privacy and confidentiality, intellectual property, and over-reliance.
• Knowing your context: the rules, policies, and responsibilities that apply to your role and your organization's AI use.

How to build an Article 4-ready AI literacy program

The European Commission's AI literacy Q&A, published in 2025 before the amendment, gave practical guidance that still makes sense under the new wording: there's no required certificate or one-size-fits-all curriculum, measures should fit the roles and risks involved, and keeping internal records of what you've done is enough. Here's a practical way to put that into action.

1. Map who uses AI, and how. Inventory the AI systems in use, from general-purpose assistants to AI features embedded in business software, and which roles use them. A marketing team drafting copy with an assistant has different needs than an HR team screening candidates with AI-assisted software.

2. Set a baseline for everyone. Every employee who touches AI should share a common foundation: what AI is, how generative AI works, its main failure modes, and your organization's acceptable-use policy.

3. Go deeper by role and risk. Add targeted training where the stakes are higher: people making decisions about customers or employees, people handling sensitive data, managers who set AI strategy, and technical teams building with AI.

4. Include data literacy. AI systems are only as good as the data behind them, and their outputs are data that people have to interpret. Teams that can question a chart or a statistic are far better at questioning an AI-generated answer.

5. Keep records. Track who completed what training and when, alongside your AI use policy and your inventory of AI systems. This is the evidence you'll point to if a regulator, auditor, customer, or works council asks what you've done.

6. Refresh it. AI tools change quickly. Revisit the program at least annually, and whenever you roll out a significant new AI system.

How Data Literacy helps

We've spent a decade helping organizations build data literacy, and we now help them build AI literacy the same way: practical, role-relevant, and taught by practitioners.

• AI literacy courses such as AI Literacy Fundamentals, Harnessing Generative AI, and Advancing Responsible AI, with an AI Coach that answers learners' questions in context.
• Live workshops, virtual or in person, tailored to your industry, your tools, and your teams.
• Completion records your team administrators can export for documentation.
• SCORM packages to run the courses inside your own learning platform.

See training options for your organization

Frequently asked questions

Is AI literacy training still mandatory under the EU AI Act after the 2026 amendment?

Article 4 still requires providers and deployers to take measures to support their staff's AI literacy. Training is the most common and most demonstrable measure. What changed is that you no longer have to guarantee a "sufficient level" for every individual.

Do employees need a certificate?

No certificate is required. Keeping internal records of the training and other measures you've taken is the practical way to show what you've done.

Does Article 4 apply to small companies?

Yes, it applies to providers and deployers of any size. The amended text asks the Commission and Member States to support organizations in meeting it, particularly SMEs.

We only use off-the-shelf tools like ChatGPT or Copilot. Does it apply to us?

Very likely. Using an AI system under your organization's authority in a professional context generally makes you a deployer.

What should our records include?

Who was trained, on what, and when; which AI systems are in use and by whom; your AI acceptable-use policy; and how training is matched to roles and risk.

Sources

• Regulation (EU) 2024/1689 (the AI Act), on EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), on EUR-Lex
• European Commission: AI literacy questions and answers