Article 4 AI Literacy — The Obligation Already in Force Since February 2025

The obligation most organizations overlooked — and why it matters more than they think.

Already in force since February 2025

Article 4 of the EU AI Act requires all providers and deployers of AI systems to take measures ensuring a sufficient level of AI literacy among their staff and anyone else operating AI systems on their behalf. This obligation became applicable on 2 February 2025 — making it one of the first enforceable requirements of the Act. It applies to all AI systems, regardless of risk level.

The European Commission's May 2025 Q&A clarified key aspects: there is no standardized training format required, no certification obligation, and no mandate to formally measure employee knowledge levels. However, organizations must demonstrate that they have taken substantive measures — not merely asked staff to read a user manual. Documentation of training activities is expected.

Who must be trained

Article 4 applies to all staff directly dealing with AI systems, plus "other persons dealing with the operation and use of AI systems on their behalf." The European Commission interprets "other persons" broadly, including contractors, service providers, and even clients who use AI systems on the organization's behalf. The scope is wider than many organizations initially assumed.

For deployers of high-risk AI systems, there is an additional obligation under Article 26 to ensure that staff responsible for human oversight are sufficiently trained to perform that function effectively. This goes beyond general AI literacy to require specific competence in understanding, interpreting, and supervising the particular AI system being overseen.

Why it matters strategically

Article 4 is not a standalone compliance checkbox. It is the foundation for every other obligation in the Act. Human oversight (Article 14) cannot work if the people overseeing the system do not understand it. Risk management (Article 9) requires judgment about AI risks. Incident reporting (Article 62) requires recognition that something has gone wrong. Without AI literacy, none of these obligations can be meaningfully fulfilled.

National market surveillance authorities obtain full enforcement powers on 2 August 2026 — a date that does not move under the Digital Omnibus. While standalone enforcement of Article 4 is considered less likely than enforcement of high-risk obligations, a lack of AI training will almost certainly be treated as an aggravating factor when regulators investigate other breaches.

Penalties

Non-compliance with Article 4 falls under the general infringement tier: up to €7.5 million or 1.5% of global annual turnover, whichever is higher (Article 99(4)). While this is the lowest penalty tier under the Act, it is still substantial. More importantly, the absence of AI literacy training creates vulnerability across your entire compliance program.

What adequate training looks like

At minimum, the European Commission expects organizations to ensure a general understanding of AI within the organization: what AI is, how it works, what AI is used in the organization, and what its opportunities and risks are. Beyond this baseline, training should be proportionate to role, risk level, and context. Staff operating high-risk systems need deeper training than those using minimal-risk tools.

Related reading

Article 2 Scope · EU AI Act Timeline · EU AI Act Fines · EU Authorised Representative

Assess your exposure

Take our free 5-minute assessment to determine how these obligations apply to your organization.

Start the assessment