Article 4 of the EU AI Act explained: AI literacy in the company

Article 4 is the shortest article of the EU AI Act – and the only one that concerns almost every company. It has no annexes, no risk classes and no schedule of fines, and that is exactly why it is read so differently: from “does not apply to us” to “we need a certificate right now”. Neither is true. Here is what it says, since when, for whom – and what a company does with it.

Not sure whether this applies to your company? Five short questions →

What Article 4 says

Until July 2026 Article 4 read, slightly shortened:

“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in […].”

Since July 2026 the revised version applies (amended by the “Digital Omnibus”): “ensuring” a sufficient level became promoting AI literacy; responsibility for guidelines and support programmes now lies more with the Member States and the European Commission. The addressee has stayed the same: the company that uses AI. Official text on EUR-Lex →

AI literacy is defined in Article 3(56) as the skills, knowledge and understanding that allow AI systems to be used knowledgeably and to be aware of the opportunities, risks and possible harm. In everyday terms: knowing what the AI can do, what it makes up, what must never go in and when it is better not to use it.

Since when it applies – and to whom

The Regulation entered into force on 1 August 2024. Article 4 was among the first provisions to become applicable: since 2 February 2025 (Article 113). It addresses providers – those who develop AI systems or place them on the market under their own name – and deployers: anyone who uses an AI system professionally under their own responsibility. Only purely private use is excluded.

So a deployer is also the metalworker whose office rewords quotations with ChatGPT, the stonemason using Copilot in Outlook, the tax firm having analyses explained. The Regulation expressly includes “other persons dealing with AI systems on their behalf” – contractors and service providers. Anyone in the company who does not use AI is not meant; in many companies the group is considerably smaller than the whole workforce.

What Article 4 does not prescribe

  1. No particular training. Neither duration nor form nor provider. An in-house talk can be enough.
  2. No level, no assessment, no certificate. There is no official body that issues an “AI certificate”, and no obligation to hold one.
  3. No AI officer. Unlike data protection, the Regulation does not require a named person.
  4. No specific fine for Article 4. The Regulation names no fixed amount for missing AI literacy. It does, however, oblige the Member States (Article 99) to provide for effective and proportionate measures in case of infringements of the Regulation.

What Article 4 asks for is a duty of effort with a sense of proportion: appropriate to knowledge, experience, education and the context in which the AI is used. A company with five office staff and ChatGPT needs something different from a company that uses AI in recruitment.

Why it still matters

Because the question does not come from the supervisory authority but from others: from the insurer after a data protection incident, from the customer in a supplier questionnaire, from the auditor at the ISO certification, from the lawyer when an employee has entered customer data into a free account. Data protection, the duty of care of management and liability have not changed with the relaxation. Those who can then document what they have done stand differently from those who cannot. More: why an AI literacy record? · What else the AI Act regulates for companies

How a company implements Article 4

  1. Clarify who works with AI. Office, sales, work preparation, costing, management – and which tools. That is the group of people, nobody else.
  2. Set rules. One page: which tools are allowed, what may go in, what never, who checks results.
  3. Impart knowledge. A talk or workshop, in-house or with a trainer – what belongs in an AI literacy training.
  4. Document. An assessment per employee that records who showed what and when. At AI4Cert: 20 questions on the ground rules and three practical tasks with a real AI, around 30 minutes. Record as a PDF with a reference number, valid for twelve months; summary record for the company; seal for the website.
  5. Repeat yearly. The AI tools change, people change. A reminder comes by itself.

Register your company How the assessment works

Frequently asked questions

What does Article 4 of the AI Act say? Providers and deployers of AI systems should see to it that their staff and other persons dealing with AI systems on their behalf have AI literacy – appropriate to their knowledge, experience, education and the context in which the AI is used. Since the revision in July 2026 the wording is “promote” rather than “ensure”.

Since when has Article 4 applied? Since 2 February 2025 (Article 113). The Regulation itself entered into force on 1 August 2024; Article 4 was among the first provisions to become applicable.

Who does Article 4 apply to? Providers and deployers of AI systems. A deployer is anyone who uses an AI system professionally under their own responsibility – including a craft business whose office works with ChatGPT or Copilot. Only purely private use is excluded.

What does AI literacy mean under the Regulation? The skills, knowledge and understanding to use AI systems knowledgeably and to be aware of the opportunities, risks and possible harm (Article 3(56)). In everyday terms: knowing what the AI can do, what it makes up, what must never go in and when not to use it.

Does Article 4 prescribe a training or a certificate? No. Neither a particular training nor a level, a certificate or an assessment. How a company promotes and documents the literacy of its people is up to the company.

What happens if a company does nothing? For Article 4 the AI Act names no specific fixed fine. National authorities may nevertheless provide for measures in case of infringements. In practice the question usually comes up elsewhere first: after a data protection incident, in a supplier questionnaire, in an audit or towards the insurer. Then it counts whether the company can document what it has done.

Article 4 AI Act, Art. 4 KI-VO, EU AI Act Article 4 – is that all the same? Yes. “AI Act” is the English name of Regulation (EU) 2024/1689, “KI-VO” the German short form. It is always the same article.