AI Act Article 4: The AI Literacy Obligation for Your Staff
Key takeaway
Article 4 of the AI Act has applied since February 2, 2025 to every organization that provides or uses an AI system, including ChatGPT or Copilot. Since its amendment entered into force on July 27, 2026, it requires measures to support staff AI literacy, without guaranteeing a specific level for each person. No certificate is needed: a proportionate training plan and an internal record are enough.
Key points
- Any company using AI professionally is a 'deployer' under the AI Act.
- The obligation has applied since February 2, 2025; supervision by authorities since August 2, 2026.
- Regulation (EU) 2026/1744 softened the text: take action, without guaranteeing a 'sufficient' level per person.
- The European Commission states no certificate is needed: an internal record of actions is enough.
- Measures are tailored to the tools used, the risks and people's profiles.
AI Act Article 4 in one sentence
Article 4 of the AI Act requires every organization that provides or uses an AI system to take measures to develop its staff's AI literacy. It has applied since February 2, 2025, and its text was softened by a regulation that entered into force on July 27, 2026.
This article complements our practical guide AI training for business: where to start. Here we focus on the legal obligation: what the text says, who is covered and how to comply simply.
What exactly does the text say?
The current text asks organizations to take action to support AI literacy, tailored to people and uses, without guaranteeing a specific level per individual. It has existed in two versions.
The original version (Regulation (EU) 2024/1689, applicable since February 2, 2025) required providers and deployers to ensure, "to their best extent, a sufficient level of AI literacy" of their staff.
The version in force comes from Regulation (EU) 2026/1744, known as the "Digital Omnibus on AI", published in the Official Journal on July 24, 2026. Article 4 now has three paragraphs:
- Providers and deployers take measures to support the development of AI literacy of their staff and other persons using AI systems on their behalf. They take into account their knowledge, experience, training, the context of use and the people affected. This obligation does not require them to guarantee any specific level of AI literacy of any individual.
- The Commission and Member States support these efforts, in particular those of SMEs. The Commission publishes practical examples of compliance.
- The AI Board adopts recommendations, including common objectives.
What is AI literacy?
It is the skills, knowledge and understanding that allow people to use AI in an informed way, aware of its opportunities, risks and possible harms. The definition is in Article 3, point 56, of the AI Act.
For an employee, this means knowing what an AI tool does well, when it can be wrong, which data never to share with it and how to check its answers.
Who is covered?
Almost every company: it is enough that your teams use an AI system at work. The AI Act distinguishes two main roles:
- the provider, which develops an AI system or places it on the market under its own name;
- the deployer, any person or organization using an AI system under its own authority, except for personal non-professional use.
An accounting firm whose staff use Copilot, a real estate agency writing listings with ChatGPT, a customer service team running an AI chatbot: all are deployers. The European Commission's AI literacy FAQ cites exactly the case of employees using ChatGPT to write or translate: they must, among other things, be informed of risks such as made-up answers.
Since when, and who enforces it?
The obligation has applied since February 2, 2025; supervision and enforcement rules have applied since August 2, 2026. The European Commission confirms this in its FAQ. National market surveillance authorities oversee compliance with the regulation.
On penalties, the AI Act sets no specific fine for Article 4. Article 99 leaves Member States to determine the regime of penalties and other enforcement measures, which may include warnings, taking the interests of SMEs into account.
What to do in practice
The Commission recommends four minimum steps, which can be taken with proportionate means. Here is how they translate for a small or mid-sized business:
| Step | Question to ask | Practical action |
|---|---|---|
| 1. Understand AI | What is AI, how does it work, which tools do we use? | Inventory of AI tools in use, official or not |
| 2. Identify your role | Are we a provider, a deployer, or both? | One line per tool in the inventory |
| 3. Assess risks | What risks per tool, data and use? | Classify uses: low risk, sensitive, prohibited |
| 4. Act by profile | What does each group of people need to know? | General awareness, role-based workshops, written rules |
Then keep a simple record: session dates, participants, content, usage rules shared. The Commission states that no certificate is needed and that an internal record is enough. At Ozapp, every participant receives a certificate of attendance, useful for that record.
Mistakes to avoid
The biggest mistake is doing nothing because the text was softened. The obligation to act remains, and so do the real risks: data leaks, errors in client documents, decisions based on made-up answers.
Other common mistakes:
- a single generic training for everyone, unrelated to real tasks;
- ignoring "shadow AI": tools teams use without approval;
- forgetting contractors who use AI on your behalf;
- documenting nothing, which makes any effort invisible during an inspection.
To frame everyday use, our article ChatGPT at work: rules and risks includes a sample usage policy.
What about high-risk AI systems?
If you use an AI system classified as high-risk, for example for recruitment or credit scoring, stricter obligations apply. Among other things, the deployer must assign human oversight to people with the necessary competence, training and authority (Article 26). The omnibus regulation sets the application of these rules at December 2, 2027 for systems listed in Annex III, including recruitment and credit scoring.
Our approach at Ozapp
Ozapp is an AI-first agency based in Belgium that builds AI agents, chatbots and automations, and trains teams to use them. Our AI consulting & training service covers the inventory of uses, usage rules and role-based workshops, in French, Dutch or English. For a free first assessment, try our AI maturity diagnostic, which takes GDPR and the AI Act into account.
This article is for information only and does not constitute legal advice.
- Explore our service: AI consulting & training
- Get a free quote: Contact
FAQ — AI Act Article 4
Does Article 4 of the AI Act apply to my company?
Yes, if your staff use an AI system at work. The AI Act calls any person or organization using an AI system under its authority a 'deployer', except for personal non-professional use. A small business whose team uses ChatGPT to write or translate is covered, as the European Commission confirms in its FAQ.
Do you need a certificate or accredited training?
No. The European Commission states that no certificate is needed and that organizations can keep an internal record of training and other guidance initiatives. A certificate of attendance is still useful as evidence, but Article 4 does not impose any specific body or label.
What are the penalties for not complying with Article 4?
The AI Act sets no specific fine for Article 4: the maximum amounts in Article 99 cover other obligations. Member States determine the regime of penalties and enforcement measures, which may include warnings. A lack of training can also weigh in if an incident is caused by misuse of AI.
What changed with the 2026 omnibus regulation?
Regulation (EU) 2026/1744 replaced the text of Article 4. Before, companies had to ensure, to their best extent, a sufficient level of AI literacy. Now they must take measures to support AI literacy, without being required to guarantee a specific level for any individual. The Commission and Member States must support them, especially SMEs.
What training is enough for a small business?
There is no mandatory format. For a business using assistants like ChatGPT or Copilot, an awareness session for the whole team, written usage rules and a hands-on workshop per role are a solid basis. People overseeing high-risk AI systems have stricter training obligations.
