AI Act Article 4: the AI literacy obligation explained

EU AI Act Article 4: who it applies to, what the 2026 Digital Omnibus changed, which measures to take and how to keep a record of AI literacy training.

Everyone6 min read

Last updated 28 September 2026.

General information, not legal advice. This page summarises public texts to help you plan a training programme. It does not replace advice from your lawyer or legal team, who alone can assess your situation. Only the texts published in the Official Journal of the European Union are authoritative.

Article 4 of Regulation (EU) 2024/1689, the EU Artificial Intelligence Act (AI Act), deals with AI literacy. It was one of the first obligations of the regulation to apply, and one of the few that concerns almost every organisation, whatever its size or sector, as soon as it uses AI tools.

What does Article 4 say?

In its current wording, amended in 2026 (see below), Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. Those measures take into account people's technical knowledge, experience, education and training, the context in which the AI systems are used, and the persons or groups on whom they are used.

The regulation defines AI literacy (Article 3, point 56) as the "skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause".

When does it apply?

  • 1 August 2024: Regulation (EU) 2024/1689 enters into force.
  • 2 February 2025: Article 4 applies (together with the prohibitions of Article 5).
  • 24 July 2026: Regulation (EU) 2026/1744, known as the "Digital Omnibus on AI", is published in the Official Journal; among other changes, it amends Article 4. It entered into force on 27 July 2026.
  • 2 August 2026: according to the European Commission, supervision and enforcement by national market surveillance authorities begins.

What did the 2026 Digital Omnibus change?

The original 2024 text required measures "to ensure, to their best extent, a sufficient level of AI literacy". As amended by Regulation (EU) 2026/1744, Article 4:

  • replaces that wording with a duty to support the development of AI literacy: the obligation now concerns the effort made, not a level to be reached;
  • states that it does not require providers or deployers to guarantee any specific level of AI literacy for any individual;
  • asks the Commission and the Member States to support organisations, particularly SMEs, and the European AI Board to adopt recommendations based on European competence frameworks.

The obligation has not gone away: it has become more flexible and more proportionate. An organisation should still be able to show that it has taken measures suited to how it uses AI.

The specific duties attached to high-risk AI systems remain separate: their deployers must assign human oversight to people with the necessary competence, training and authority (Article 26). The Digital Omnibus postponed most high-risk obligations to 2027 and 2028.

Who does it apply to?

Article 4 covers two groups:

  • providers, who develop an AI system or place it on the market;
  • deployers, meaning any person or organisation using an AI system under its own authority in a professional context.

A company that gives its employees a generative AI assistant, or uses a CV-screening or automated writing tool, is a deployer. The people to cover are staff, but also "other persons" who use those systems on the organisation's behalf: according to the Commission, this can include contractors, service providers and clients.

Which measures should you take?

The regulation does not prescribe a curriculum, a duration or a format. In its questions and answers on AI literacy, the European Commission states that no certificate is required and that an organisation can keep an internal record of the training and other initiatives it runs. A reasonable approach usually includes:

  1. Mapping uses: which AI systems, which teams, which data, which risks for the people affected.
  2. Tailoring by audience: a lawyer, a recruiter, a salesperson and a developer face different risks. Article 4 explicitly asks you to consider role and context.
  3. Covering the basics for everyone: what an AI system is, what it does well, its limits (hallucinations, bias), the data it must never receive, human review.
  4. Practising on everyday cases rather than relying on a single theory module.
  5. Documenting: who completed what, when, with which results, and how the programme is updated when tools change.

The 30-day AI literacy plan sets out a concrete sequence.

Is there a specific penalty for Article 4?

The regulation sets no fine amount specific to Article 4: the figures in Article 99 target other obligations (prohibited practices, obligations of operators of high-risk systems, incorrect information). Rules on penalties are left to the Member States, and the Commission notes that any penalty must be proportionate to the individual case. Enforcement lies with national market surveillance authorities. In practice, a lack of measures may also count against an organisation if an incident involving AI occurs.

How can Maketools help you keep a record?

Maketools does not issue compliance certificates and does not replace your own analysis. It helps you run training measures and document them:

  • Named skills: each game measures skills from a closed taxonomy (for example "protecting personal data", "spotting hallucinations", "keeping a human accountable"), identical across games.
  • Trustworthy scores: the score is recalculated by the server from the answers; a score sent by the browser is ignored.
  • Per-game reports: participation, completion rate, average score, pass rate and mastery by skill, filterable by group, with CSV and PDF export.
  • Your LMS: a SCORM 1.2 package sends each learner's score and status back to your learning platform, and an xAPI connector sends results to your LRS (Pro and Enterprise plans; SCORM for private games only).
  • Games adapted to your context: a fork lets you rewrite the cases with your own tools, teams and internal rules, which speaks directly to Article 4's context criterion.

By default, reports are pseudonymised: they are enough to show a programme's reach without naming anyone. Named reporting can be switched on if your organisation needs it (see player privacy).

Where to start

Begin with a short game on the basics: AI or Not AI? has players decide, request after request, what can and cannot be handed to AI. Open the catalogue to play without an account, then read the page for learning and development teams to roll it out.

Sources

The consolidated version of the regulation, including its amendments, is published on EUR-Lex: refer to it whenever in doubt.

Edit this page on GitHub