Article 4: the AI literacy duty that already applies, decoded

Article 4 is the shortest operative article in the EU AI Act — one sentence — and the easiest to overlook. It sits in Chapter I, which means it applies to every AI system you provide or use professionally, not just high-risk ones. And unlike the high-risk obligations arriving in August 2026, it is already law in force.

What Article 4 says

Under Article 113 of Regulation (EU) 2024/1689, Chapters I and II apply from 2 February 2025 — the same date the Article 5 prohibitions took effect. Article 4 has been a live obligation ever since.

Who it applies to

Both roles, explicitly:

• Providers — organisations that develop AI systems or place them on the market under their own name; and
• Deployers — organisations using AI systems under their authority in a professional context. If your teams use a vendor chatbot, a scoring model, or an AI-assisted screening tool, that is you.

The duty covers your staff and “other persons” operating or using AI on your behalf — which reaches contractors and service providers acting for you, not just employees. And because Article 4 sits outside the high-risk chapter, it is not limited to high-risk systems: it attaches to AI system use generally.

What “sufficient AI literacy” means

Article 4 is a best-effort obligation (“to their best extent”), not a certification scheme. There is no prescribed curriculum, exam, or minimum hours. What it demands is proportionate, context-specific competence, calibrated to:

Factor in Article 4	What it means for you
Technical knowledge, experience, education and training	A data scientist and a call-centre agent using the same system need different training — one size does not fit all roles
The context the AI systems are used in	Literacy for a credit-scoring model is not literacy for a marketing copy assistant — training must be system- and use-case-specific
The persons or groups the systems are used on	Where AI affects customers, candidates or other people, staff must understand the risks and limitations for those affected

In practice, “sufficient” means people who operate or rely on an AI system understand what it does, where it fails, what its outputs do and do not mean, and what their own obligations are when using it. For deployers this connects directly to Article 26: the human oversight you must assign under Article 26(2) has to go to people with the necessary competence and training — which is Article 4 made concrete.

Enforcement — and the missing fine

Here is the nuance most summaries get wrong in one direction or the other. Article 99, the Act’s penalty article, does not list Article 4 — there is no dedicated administrative fine for an AI literacy breach as such. But that does not make it a dead letter:

• National authorities supervise it. Member State market surveillance authorities enforce the Act (the governance and enforcement framework applies from 2 August 2025), and Article 4 is part of what they can examine.
• It surfaces inside other breaches. Untrained staff are evidence in the wrong direction when an authority assesses your Article 26 duties — competent human oversight, use per instructions, monitoring — or the circumstances of any other infringement.
• It is the first thing anyone checks. Regulators, auditors and enterprise customers increasingly ask for evidence of AI training programmes. “We have no record of who uses AI or what training they had” is a bad opening position.

Meeting Article 4 in practice

A defensible Article 4 programme is four steps, in order:

1. Inventory: establish which AI systems your organisation provides or uses, and who operates, uses or depends on each one. You cannot train the right people on systems you have not catalogued.
2. Map roles to literacy needs: per system, decide what its operators, overseers and downstream users each need to understand — capabilities, limitations, failure modes, and the rules that apply to it.
3. Deliver role-based training: targeted and system-specific beats a generic all-hands e-learning. Depth should follow risk: a high-risk system’s oversight owner needs far more than a casual user of an office assistant.
4. Document the measures: keep a record of what training was given, to whom, on which systems, and when it is refreshed. Article 4 is a duty to take measures — the evidence that you took them is the compliance artefact.

Why literacy starts with an inventory

Every factor in Article 4 is per system and per person: the context a system is used in, who deals with its operation, who it is used on. None of that can be answered at the level of “the company uses AI.” The prerequisite is a register of your AI systems that records what each one is, what it is used for, and who works with it — the same register your Article 6 classification and Article 26 duties will hang off in 2026.

This page is a practical explanation, not legal advice. Always confirm requirements against the official text of Regulation (EU) 2024/1689.