EU AI Act Article 4 explained: the AI literacy duty in plain English
Temja·June 30, 2026· 8 min read
the short version
- →Article 4 has applied since February 2025. It is live law, not a future plan.
- →It asks you to make sure the people who use AI on your behalf understand it well enough to use it safely.
- →There is no certificate to buy. What matters is that your staff can recognise a risk and act on it, and that you can show it.
- →Enforcement powers arrived in August 2025. Most companies are building evidence now, ahead of the August 2026 wave.
A century ago, factories learned a hard rule and never unlearned it. Powerful machinery needs trained people. You do not walk onto a forklift because a leaflet says it is safe. You earn a permit, you practice with your hands, you report the near miss. Article 4 of the EU AI Act carries that rule into the office. Your team now runs the most capable machine it has ever owned, and the law asks a simple question back: can they handle it?
What Article 4 actually says
The text is short. Providers and deployers of AI systems must take measures to ensure a sufficient level of AI literacy among their staff and anyone else operating AI on their behalf. It tells you to take that person's role, experience and context into account. That is the whole duty in one sentence.
Read the word literacy carefully
Literacy is about people, not tools. It is not proof that you bought an approved product. It is proof that the humans using AI can spot when something is off and know what to do next.
The definition of AI literacy sits in Article 3(56): the skills, knowledge and understanding that let people make informed use of AI, and become aware of its opportunities, its risks, and the harm it can cause. Notice the balance. It is not only about danger. It is about competent, confident use.
Who it covers
- Deployers: any company that uses an AI system in its work. That is almost everyone now.
- Providers: companies that build or sell AI systems.
- Other persons operating AI on your behalf: the Commission has been clear that this reaches contractors, service providers, and sometimes clients acting for you.
The last point surprises people. If a contractor runs an AI agent inside your process, their literacy is your concern too. This is why many vendors now hand buyers a literacy attestation as part of the sale.
The dates that matter
Article 4 is not waiting for August 2026. It already applies. Here is the timeline that shapes most compliance plans.
AI literacy applies
Article 4 is in force. Staff who use AI need a basic, role-fit understanding of it.
Tap a point.
What sufficient means in practice
The law does not hand you a syllabus, and that is deliberate. Sufficient is proportionate. A data scientist and a finance clerk do not need the same training, because they do not face the same risks. The Commission favours a flexible, role based approach. So the honest test is behavioural, not academic.
Recognition is what you know. Behavior is what you do when the clock is running and the invoice looks real.
This is where a lot of programs quietly fail. A person who can circle the phishing email in a slide has shown recognition. Put the same person in front of a convincing poisoned invoice, mid task, and watched knowledge does nothing. The reflex was never built. The gap is measurable.
Injection-catch rate before and after hands-on drills, from a two-wave program. Knowing the risk is not the same as catching it live.
The hard twin: Article 26
For high risk systems, literacy stops being soft. Article 26(2) says a deployer must assign human oversight to people who have the competence, training and authority to do it, plus real support. Read that as a gate. For any Annex III high risk deployment, such as hiring, credit, or essential services, a trained and empowered overseer is a legal precondition of running the system at all. Training moves from nice to have to compliance gate.
What it can cost to get wrong
Penalties live in Article 99. They scale with your global turnover, and the regulator takes the higher of a percentage or a fixed cap. Move the slider to see where your organisation would sit.
higher of 7% (€4m) or €35m fixed, so the fixed floor applies
higher of 3% (€2m) or €15m fixed, so the fixed floor applies
higher of 1% (€1m) or €7.5m fixed, so the fixed floor applies
Illustration of Article 99. The regulator picks the higher of a percentage and a fixed cap. Not legal advice.
How to prove it to an auditor
This is the part most teams underestimate. Doing the training is not the duty. Being able to show the training worked is the duty. A program that cannot produce that record has not met the obligation. It has only meant to.
- 1Map roles to riskList who uses AI and what they can reach. The more an agent can do on their behalf, the more literacy they owe.
- 2Train for behaviour, not attendanceUse hands on practice, not only slides. A drill record beats a completion certificate every time.
- 3Keep a tamper evident trailWho was trained, on which content version, with what result, re tested over time. Version your content so you can show what the law said when.
- 4Re test on a cycleLiteracy decays and the tools change. One and done is not a defence.
The one line to remember
Demonstrated competence beats demonstrated attendance. A completion certificate says a person sat through something. A drill record says a person met a live threat and either caught it or learned exactly what it would have cost.
Test yourself
Three quick questions. If you get them all, you are ready to shape a program.
1. When did the Article 4 AI-literacy duty start to apply?
2. Article 4 asks you to prove which of these?
3. For a high-risk system, human oversight must be done by someone who is:
take these with you
- 01Article 4 is live now and asks you to make AI users literate, in proportion to their role.
- 02Literacy is behavioural. The test is whether people act safely under real conditions, not whether they watched a video.
- 03For high risk systems, Article 26 turns trained oversight into a precondition of operating at all.
- 04Evidence is the deliverable. Keep a versioned, tamper evident record of who was trained and how they did.
Questions people ask
Is Article 4 in force yet?
Yes. It has applied since 2 February 2025. Enforcement powers followed in August 2025, and most high risk obligations land in August 2026.
Do small companies have to comply?
Yes. There is no size exemption. The duty is proportionate, so a small firm with light AI use owes less than a large one, but the obligation still applies.
Is there an official Article 4 certificate?
No. There is no accredited certificate. What matters is evidence that your staff can use AI safely, which you keep and can show on request.
What is the fastest way to start?
Map who uses AI, give them hands on training that matches their role, and keep a record of the result. Evidence of competence is the goal.
from reading to reflex
See what trained behaviour looks like.
Run the 3 minute drill. No sign up, no card. Meet the poisoned invoice and find out if you reach stop in time.
keep reading