EU AI Act Article 4: The AI Literacy Duty Your Company Already Has

What the law actually says

Article 4 of Regulation (EU) 2024/1689 is one sentence:

“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.” Article 4, Regulation (EU) 2024/1689

Unpacking the load-bearing phrases:

• “Providers and deployers”: not just AI companies. A deployer is any organisation using an AI system under its authority. A marketing team drafting copy in ChatGPT makes the company a deployer.
• “Shall take measures”: an active, ongoing duty. Doing nothing is non-compliance by default.
• “Sufficient level of AI literacy”: proportionate to three factors: the context of use, the system's complexity, and the person's role. A recruiter screening CVs with AI needs more than someone summarising meeting notes.
• “To their best extent”: an effort standard, which cuts both ways. It forgives imperfection but punishes inaction. The question a regulator asks is “show me the measures.”

The enforcement timeline

Article 4 began to apply on 2 February 2025. What changes on 2 August 2026 is that the national market surveillance authorities designated under the Act receive their formal supervisory powers, and with them, the ability to investigate and sanction. The European Commission's own Q&A confirms the duty applies now, with formal oversight beginning August 2026. The Digital Omnibus agreement of May 2026, which deferred the high-risk rules to 2027–2028, did not touch Article 4.

In other words: eighteen months of grace are ending. Companies that treated AI literacy as aspirational are about to meet regulators who treat it as overdue.

What “sufficient” literacy means for ordinary AI use

For the vast majority of organisations, the relevant AI use is not exotic. It is employees using chat assistants with company information. For that context, sufficient literacy means staff understand at minimum:

1. What not to share. Customer personal data, credentials, source code, confidential terms, and why: consumer AI tiers may retain and train on inputs.
2. Output limitations. Models hallucinate; outputs need verification before decisions or publication.
3. Which tools are sanctioned for which data categories, and what the escalation path is when a new tool is needed.

And the organisation must be able to document all of it. The Commission's guidance does not require measuring literacy levels, but it does stress keeping records of the measures taken.

Why annual training fails the “best extent” test

The standard corporate response (an annual e-learning module) has two weaknesses as Article 4 evidence:

It is static while the risk is continuous. Employees adopt new AI tools monthly. A training record from January says nothing about the tool an employee started using in June. Without visibility into actual AI usage, you cannot even say whom the training needs to cover. The shadow AI problem is an Article 4 problem.

It does not change behaviour at the moment of risk. The point of literacy is that the employee about to paste a customer database into a chatbot stops. A slide viewed eleven months ago rarely achieves that; an explanation that appears at the exact moment of the paste does. In-the-moment education is both the most effective measure and the most persuasive evidence, because every intervention is logged.

Building an Article 4 file a regulator will accept

1. Map real usage. Deploy browser-level visibility to learn which AI systems staff actually use and which data categories flow toward them. This defines the scope “to their best extent” demands.
2. Train proportionately. Role-based guidance: heavier for HR, finance, and engineering; lighter for occasional users. Record completion.
3. Reinforce at the point of risk. Real-time warnings and explanations when sensitive data is about to reach an AI tool turn policy into practice, and generate a timestamped record that the measure operates.
4. Review on a cycle. Quarterly: new tools discovered, incident classifications trending, repeat-risk users retrained. Minute it.

The cost of getting it wrong

Article 4 breaches are sanctioned under the national penalty regimes Member States adopted for the Act, with intermediate-tier exposure reaching into the millions. But the realistic scenario is worse, because an Article 4 failure is rarely discovered on its own. It surfaces when an untrained employee causes an incident, typically a personal-data leak into an AI tool. At that point the organisation faces the AI Act question (“where were your literacy measures?”) and the GDPR questions (Articles 32 and 33, with fines up to €20M or 4% of turnover) for the same event. The cheapest moment to fix both is before the incident.