Article 4 AI Literacy — The Obligation Already in Force Since February 2025
The obligation most organizations overlooked — and why it matters more than they think.
Already in force since February 2025
Article 4 of the EU AI Act requires all providers and deployers of AI systems to take measures ensuring a sufficient level of AI literacy among their staff and anyone else operating AI systems on their behalf. This obligation became applicable on February 2, 2025 — making it one of the first enforceable requirements of the Act. It applies to all AI systems, regardless of risk level.
The European Commission's May 2025 Q&A clarified key aspects: there is no standardized training format required, no certification obligation, and no mandate to formally measure employee knowledge levels. However, organizations must demonstrate that they have taken substantive measures — not merely asked staff to read a user manual. Documentation of training activities is expected.
Who must be trained
Article 4 applies to all staff directly dealing with AI systems, plus "other persons dealing with the operation and use of AI systems on their behalf." The European Commission interprets "other persons" broadly, including contractors, service providers, and even clients who use AI systems on the organization's behalf. The scope is wider than many organizations initially assumed.
For deployers of high-risk AI systems, there is an additional obligation under Article 26 to ensure that staff responsible for human oversight are sufficiently trained to perform that function effectively. This goes beyond general AI literacy to require specific competence in understanding, interpreting, and supervising the particular AI system being overseen.
Why it matters strategically
Article 4 is not a standalone compliance checkbox. It is the foundation for every other obligation in the Act. Human oversight (Article 14) cannot work if the people overseeing the system do not understand it. Risk management (Article 9) requires judgment about AI risks. Incident reporting (Article 62) requires recognition that something has gone wrong. Without AI literacy, none of these obligations can be meaningfully fulfilled.
National market surveillance authorities will begin active enforcement from August 2, 2026. While standalone enforcement of Article 4 is considered less likely than enforcement of high-risk obligations, a lack of AI training will almost certainly be treated as an aggravating factor when regulators investigate other breaches.
Penalties
Non-compliance with Article 4 falls under the general infringement tier: up to €7.5 million or 1.5% of global annual turnover, whichever is higher (Article 99(4)). While this is the lowest penalty tier under the Act, it is still substantial. More importantly, the absence of AI literacy training creates vulnerability across your entire compliance program.
What adequate training looks like
At minimum, the European Commission expects organizations to ensure a general understanding of AI within the organization: what AI is, how it works, what AI is used in the organization, and what its opportunities and risks are. Beyond this baseline, training should be proportionate to role, risk level, and context. Staff operating high-risk systems need deeper training than those using minimal-risk tools.
Related reading
Assess your exposure
Take our free 5-minute assessment to determine how these obligations apply to your organization.
Start the assessmentThis article provides general information about AI regulation. It does not constitute legal advice. Lexara Advisory LLC is an AI governance consulting firm, not a law firm. Published April 2026. About the author.