EU AI Act Article 4: what employers must do about AI literacy

Article 4 of the EU AI Act asks providers and deployers to take measures to support the development of AI literacy among staff and others using AI systems on their behalf, reflecting their roles and context of use. It has applied since 2 February 2025; the wording was amended on 27 July 2026.

This guide is general information, not legal advice. Take advice on your own exposure.

What does Article 4 of the EU AI Act say?

Article 4 is the AI Act’s specific provision on AI literacy. It applies to providers and deployers of AI systems and concerns staff, as well as other people who operate or use AI systems on their behalf.

The original version of Article 4 required organisations to take measures to “ensure, to their best extent, a sufficient level of AI literacy”. That wording applied from 2 February 2025.

That is no longer the current wording.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced Article 4. Since 27 July 2026, providers and deployers must “take measures to support the development of AI literacy”. The amended text also makes clear that they are not required to guarantee a specific level of AI literacy for every individual.

The provision still requires organisations to consider context. Relevant factors include people’s technical knowledge, experience, education and training, the circumstances in which the AI system is used and the people or groups affected by that use.

For employers, that points away from a single generic course for everybody. The level and type of development should reflect what different people actually do with AI.

Who does Article 4 apply to?

Article 4 applies to providers and deployers of AI systems within the scope of the Regulation.

In workplace terms, a deployer may be an organisation using an AI system under its authority in the course of its activities. The literacy obligation concerns its staff and other people dealing with the operation and use of those systems on its behalf.

That can include more than the people who selected or procured an AI system. Employees may use general-purpose AI tools, AI functions built into existing software or other AI-enabled systems as part of everyday work.

The amended Article 4 does not prescribe identical training for all of them. It specifically requires organisations to take people’s technical knowledge, experience, education and training, as well as the context of use, into account.

That makes role and use case important. Someone occasionally using AI to help draft internal text does not necessarily need the same development as a person whose work involves evaluating AI-generated analysis or using AI outputs in decisions that affect others.

Does the EU AI Act AI literacy obligation apply to UK companies?

UK companies can fall within scope when they place or put AI systems into service in the EU, deploy AI through an establishment or location in the Union, or are outside the EU but output from their AI system is used there. The precise position depends on the activity. Take legal advice on your own exposure.

Article 2 gives the AI Act an extraterritorial reach in defined circumstances. It covers providers placing AI systems on the EU market or putting them into service there, deployers established or located in the Union, and providers or deployers outside the EU where the output produced by the AI system is used in the Union.

This means “UK company” is not, by itself, enough to answer the question. A business needs to look at what role it plays, where its relevant activities take place and how AI-system outputs are used.

A UK organisation with no relevant EU activity may reach a different conclusion from a UK-headquartered organisation operating through EU entities or deploying AI in ways that fall within Article 2.

Even where Article 4 does not directly apply, organisations may still decide to document AI literacy for internal governance, customer requirements or procurement. Those are business decisions rather than proof that the Regulation applies.

What changed, and when?

Date	What happened	What it means for employers
1 August 2024	Regulation (EU) 2024/1689 entered into force following publication in the Official Journal.	The AI Act became EU law, with provisions applying in stages.
2 February 2025	Chapters I and II began to apply, including Article 4 on AI literacy.	Providers and deployers within scope became subject to the AI literacy obligation.
27 July 2026	Regulation (EU) 2026/1744 came into force and replaced the wording of Article 4.	The duty changed from seeking to “ensure” a sufficient level to taking measures to “support the development of AI literacy”.
2 August 2026	The AI Act reached its general application date, subject to provisions with separate dates.	The wider governance and enforcement framework moved into its general application phase.

The July 2026 amendment matters because older guidance may still quote the original “ensure” language. For current employer guidance, that wording should now be treated as historical.

The obligation itself has not disappeared. The amended Article 4 remains a requirement to take measures, but it is framed around supporting development rather than guaranteeing a defined outcome for each employee.

What does “AI literacy” mean under the AI Act?

Article 3(56) defines AI literacy around the skills, knowledge and understanding needed to make informed use of AI systems and to understand their opportunities, risks and possible harms.

The definition also places those abilities within the rights and obligations people have under the Regulation. In other words, AI literacy is not simply the ability to prompt an AI tool.

For an employer, the useful question is what somebody needs to understand to use the AI systems relevant to their job appropriately.

That could involve how a system works at a practical level, where its limitations matter, how to evaluate outputs, when human judgement is required, which risks arise in the particular use case and what responsibilities the employee retains.

What are the penalties for an Article 4 gap?

Article 99, as amended, requires Member States to establish penalties and other enforcement measures that can apply to infringements of the AI Act. Those measures may include administrative fines, warnings and non-monetary measures, and must be effective, proportionate and dissuasive.

There is, however, an important distinction for Article 4.

The Regulation does not list Article 4 as a standalone provision within the specific EU-level administrative fine bands set out in Article 99(3) to (5). It would therefore be misleading to attach one of the headline AI Act fine figures directly to an AI literacy shortfall.

Member States are responsible for setting rules on penalties and other enforcement measures under Article 99(1). The practical enforcement position can therefore depend on the relevant national regime and the circumstances of the case.

For that reason, employers should avoid treating Article 4 as either “there is a fixed fine” or “there is no enforcement risk”. Neither is an accurate summary of the current text.

This guide is general information, not legal advice. Take advice on your own exposure.

What must employers actually do about AI literacy?

Article 4 does not give employers a prescribed course syllabus, minimum number of training hours, or universal test score.

It tells providers and deployers to take measures to support AI literacy while considering people’s knowledge, experience, education, training and the context in which AI systems are used.

A practical employer process can be organised into six steps.

1. Inventory the AI systems people actually use. Include approved systems, AI functions inside existing workplace software and general-purpose tools that employees use for work. You need to know what is in use before you can decide what literacy is relevant.
2. Map roles to AI exposure and responsibility. Identify who uses which systems, what they use them for, and where outputs influence customers, colleagues, decisions, or business processes. Different roles will have different learning needs.
3. Define the literacy each role needs. Use Article 3(56) and the context factors in Article 4 as the starting point. Specify what people need to understand about use, opportunities, limitations, risks, and their own responsibilities.
4. Choose and deliver development that fits the role. A common foundation can help, but deeper training should reflect real work. Give people opportunities to apply what they learn rather than treating content completion as the endpoint.
5. Assess and record what happened. Keep dates, cohorts, content or development delivered, relevant assessments, and the people responsible. Where useful, track whether capability changes after people have practised in their work.
6. Review when systems, roles or use cases change. AI literacy is not necessarily a one-time event. Revisit the requirements when the organisation introduces a new system, expands an existing use case or changes who is responsible for its use.

What evidence do we need to show AI literacy to a regulator?

Article 4 does not prescribe a certificate or fixed evidence format. A practical evidence log can show which AI systems are in use, which roles are exposed, what literacy each role needs, who completed which development and when, how learning or capability was assessed, the review date, and the owner responsible for keeping the record current.

The distinction matters. A certificate of completion can be one piece of evidence, but it does not by itself explain why the training was appropriate for the role or how an employer considered the context required by Article 4.

A useful evidence record therefore connects the decisions together: system, role, need, development, assessment and review.

Keep it simple enough to maintain. A beautifully designed document that is never updated is less useful than a clear record that changes when the organisation’s use of AI changes.

Is a 20-minute foundations course enough?

A short foundations course can be useful for common knowledge, but Article 4 is context-based and does not define course length as the test. The UK government says some AI Skills Boost courses can take under 20 minutes. Whether that is enough for a role depends on the systems used, responsibilities involved, and development needed.

The UK programme is designed around foundation skills for using simple AI tools at work. That is a useful floor for many workers, particularly where an employer wants a consistent baseline.

Article 4 asks a different question: what measures are appropriate given the person’s knowledge, experience, training and context of use?

For some roles, foundations may cover much of what is needed at a particular point in time. Other roles may need additional development around judgement, risk, specialist workflows or repeated application in real work.

How does Article 4 relate to the UK’s AI skills push?

The UK government launched the expanded AI Skills Boost programme on 28 January 2026, aiming to equip 10 million UK workers with AI skills by 2030. The programme gives UK adults access to free industry-developed courses.

Skills England published its AI foundation skills for work benchmark on the same date. The benchmark defines six foundation skills across technical, non-technical and responsible or ethical domains, aimed at using simple AI tools confidently and responsibly at work.

Courses selected for AI Skills Boost are checked against that benchmark, and qualifying course completion can lead to a virtual AI foundations badge.

This UK initiative and Article 4 are not the same thing. One is a national skills programme and benchmark; the other is an EU law obligation for providers and deployers within the Regulation’s scope.

A UK employer can use the government foundations programme as part of its wider approach while still asking what different roles need beyond those foundations.

Frequently asked questions

Does Article 4 apply to UK companies?

A UK company can fall within the AI Act where its activities meet Article 2’s territorial scope, including certain EU market activity, deployment through an EU establishment or location, or use in the Union of output from an AI system operated by a provider or deployer outside the EU. Take legal advice on your circumstances.

When did Article 4 take effect?

Article 4 began to apply on 2 February 2025, when Chapters I and II of the AI Act entered into application. Its wording was then amended with effect from 27 July 2026. The obligation therefore predates the AI Act’s general application date of 2 August 2026.

What changed in July 2026?

The Digital Omnibus replaced the original duty to seek to “ensure” sufficient AI literacy with a requirement to support the development of AI literacy. It also states that providers and deployers do not have to guarantee a particular level for every person. The obligation remains, but its wording is now explicitly measures-based.

Is there a fine for ignoring Article 4?

The AI Act does not assign Article 4 its own fixed EU fine in the specific administrative fine bands in Article 99. Article 99 does, however, require Member States to set penalties and other enforcement measures for infringements. The applicable consequences therefore require analysis of the relevant national regime and circumstances.

What is a “sufficient level” of AI literacy?

That phrase came from the original Article 4 wording and should not be presented as the current legal test. Since 27 July 2026, Article 4 requires measures supporting AI literacy and says no specific individual level must be guaranteed. Role, knowledge, experience, education, training and context of use still matter.

Do we need to train everyone?

Article 4 concerns staff and other people dealing with the operation and use of AI systems on behalf of providers and deployers. It does not prescribe identical training for every employee. The appropriate development should reflect people’s knowledge, experience and the context in which the relevant AI systems are used.

Does online training count?

Article 4 does not prescribe a particular delivery format. Online courses can therefore form part of the measures an organisation takes. The more important question is whether the development is appropriate to the people, AI systems and context involved, and whether the organisation can explain and evidence the approach it chose.

How do we evidence AI literacy?

Keep a practical record of the AI systems in use, relevant roles, expected literacy, development delivered, dates, assessments, review points and named owners. Article 4 does not prescribe a specific certificate or template, so the evidence should show the reasoning and measures behind your approach rather than relying on completion alone.

Does the UK have an equivalent law?

The UK does not simply replicate Article 4 through the AI Skills Boost programme. AI Skills Boost is a government-industry skills initiative, supported by Skills England’s foundation benchmark, rather than the same statutory obligation. UK employers should assess Article 4 separately where their activities may fall within the EU AI Act’s territorial scope.

How often should AI literacy training be refreshed?

Article 4 does not set a fixed annual or quarterly refresh cycle. Review the approach when something material changes, such as a new AI system, a different use case, expanded responsibilities or a change in the people affected. Scheduled reviews can help, but frequency should follow the organisation’s actual AI use and risk context.

What should employers do next?

Start with the systems people already use, map the roles involved, and document why different groups need different levels of AI literacy. Then keep a record of what development took place and when that decision should be reviewed.