In short
- Article 4 has applied since 2 February 2025 and binds both providers and deployers, with no size threshold and no sector carve out.
- The duty covers staff and other persons operating AI systems on your behalf, which reaches contractors and outsourced teams.
- The standard is calibrated: sufficient literacy given technical knowledge, experience, education, training and the context of use. There is no fixed curriculum.
- Article 4 carries no penalty of its own in Article 99. Its practical weight is evidential, because a literacy failure is what an oversight failure under Article 14 looks like from the inside.
- A defensible record is 3 things: who was trained, on what, and when, per role rather than per headcount.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
Article 4 is one sentence long and has been in force since February 2025. It is also the obligation most often discovered late, because nothing about it looks like compliance work.
There is no register to file, no assessment to submit and no penalty attached to it directly. What there is, is a standard.
01What does Article 4 actually require?
Sufficient AI literacy, calibrated to the person and the context.
The text requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. The calibration factors are named: technical knowledge, experience, education and training, and the context in which the systems are used.
Two phrases do the work. “Other persons” extends past the payroll to contractors and outsourced operators. “To their best extent” sets a duty of effort rather than of result, which is easier to meet and harder to evidence.
02Who is covered, and to what depth?
| Role | What sufficient looks like | Evidence that closes it |
|---|---|---|
| Operator using system output daily | Knows failure modes and when to escalate | Role specific session, dated |
| Reviewer exercising human oversight | Can override, and knows on what basis | Article 14 procedure plus sign off |
| Engineer building on a model | Understands limitations and evaluation | Technical briefing, version aware |
| Contractor operating on your behalf | Same as the equivalent internal role | Contract clause plus attendance record |
The last row is the one organisations miss. Outsourcing the operation of a system does not outsource the literacy duty, because the text reaches persons dealing with the operation on the deployer’s behalf.
03Why does an obligation with no penalty matter?
Because it is the foundation another obligation stands on.
Article 99 does not attach a specific fine to Article 4. That has led some organisations to treat it as advisory. The exposure is elsewhere: Article 14 requires that high-risk systems be designed so that human oversight is effective, and the person exercising that oversight has to be capable of exercising it.
When a supervisory authority asks how oversight worked in a specific case, the answer involves a named person who saw an output and made a decision, which is also what an audit asks to see. If that person cannot explain what the system does or when it is unreliable, oversight was nominal. The literacy failure is what the oversight failure is made of.
04What does a defensible record look like?
| Element | Weak version | Defensible version |
|---|---|---|
| Who | 92% completion rate | Named roles mapped to systems |
| What | AI awareness module | Content list per role, 1 page |
| When | Rolled out in 2025 | Dated per person, refreshed annually |
| Contractors | Not tracked | Clause plus attendance evidence |
A completion percentage is the metric organisations already have and the one that answers the least. It shows that a module was clicked through. It does not show that the person reviewing loan decisions understands what the model is bad at.
05What is the reasonable first step?
Map roles to systems, then ask one question per pairing.
For each AI system in the inventory, and an inventory is the prerequisite for almost everything else, list the roles that touch it and ask what that role needs to know to use it safely. The answers are usually short and they differ sharply between roles, which is the point the single generic module misses.
The work is measured in days rather than quarters, and it produces the artefact that Article 4 lacks a template for: a written statement of what sufficient means here, and a record showing it was delivered.
06Frequently asked questions
Is AI literacy training mandatory in the EU?
Yes. Article 4 of the AI Act requires providers and deployers to take measures ensuring a sufficient level of AI literacy among their staff and other persons operating AI systems on their behalf. It has applied since 2 February 2025.
Does Article 4 apply to small companies?
Yes. The obligation has no size threshold and no exemption for small or medium enterprises. What varies is the level of literacy that counts as sufficient, because the standard is calibrated to the context and to the people involved.
What is the penalty for failing the AI literacy obligation?
There is no penalty attached specifically to Article 4 in the penalty provisions. The exposure is indirect: an organisation whose operators did not understand the system will struggle to show that human oversight under Article 14 was effective.
Does a generic e-learning module satisfy Article 4?
It can be part of an answer and rarely is the whole one. The text calibrates the required level to the person's role and the context of use, so a single module delivered identically to a developer, a call centre agent and a board member is unlikely to be sufficient for all three.
07References and method
- Regulation (EU) 2024/1689, Article 4, for the AI literacy obligation and the factors that calibrate it, and Article 113 for the application date of 2 February 2025.
- Regulation (EU) 2024/1689, Article 3(56), for the definition of AI literacy.
- Regulation (EU) 2024/1689, Article 14, for the human oversight requirement that literacy underpins, and Article 99 for the penalty structure that does not name Article 4.
- The three part record suggestion is editorial, prepared by The Guardrail, and is not drawn from a published standard or a Commission template.