What does the EU AI Act require for AI literacy (Article 4)?

As at September 2026, Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The measures must take into account people's technical knowledge, experience, education and training, the context in which the AI systems are used, and the persons or groups on whom they are used.

The current wording comes from Regulation (EU) 2026/1744, the Digital Omnibus on AI, which replaced Article 4 of the Artificial Intelligence Act. The new Article 4(1) ends with a sentence that sets the limit of the duty:

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and the possible harm it can cause. In learning terms, that is a competency framework problem as much as a course problem: the organization decides what each group of people needs to know and do, then supports them to get there.

The Digital Omnibus softened the standard but kept the obligation on organizations. The original 2024 text required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy". The amended text requires measures to support the development of AI literacy and states that no specific level has to be guaranteed.

The European Commission's AI literacy questions and answers confirm that the adopted text keeps AI literacy as an obligation for providers and deployers. Regulation (EU) 2026/1744 was signed on July 8, 2026, published in the Official Journal on July 24, 2026, and entered into force on the third day after publication, July 27, 2026. Readers who saw early commentary on the November 2025 proposal should note that the proposal's shift of the whole duty to public authorities was not adopted.

The AI Act is an EU regulation, so it applies directly in all 27 Member States without national transposition. The closing provision that follows Article 113 states that it "shall be binding in its entirety and directly applicable in all Member States".

For readers outside the EU, the distinction matters. An EU regulation is law in every Member State from its application date, with identical text everywhere. An EU directive sets goals that each Member State must write into its own national law (transposition) by a deadline, so the detail differs by country. The AI Act is a regulation, but Member States still pass national laws on penalties and designate the authorities that enforce it, so enforcement practice can vary.

The AI Act also reaches beyond the EU. It applies to providers placing AI systems on the EU market regardless of where they are established, and to deployers established or located in the EU.

Article 4 has applied since February 2, 2025, and national market surveillance authorities supervise and enforce it from August 2026. The dates below are taken from Article 113 of the AI Act, the Digital Omnibus and the Commission's questions and answers.

Penalties for Article 4 are set by each Member State, not by a fixed amount in the AI Act. The Commission states that national market surveillance authorities could impose penalties and other enforcement measures for infringements of Article 4, and that any sanction must be proportionate and based on the individual case.

Article 99(1), as amended in 2026, says national rules may include administrative fines, warnings and non-monetary measures, and must take into account the interests of small and medium-sized enterprises. The AI Act itself does not create criminal offenses or a right to compensation, according to the Commission's questions and answers. In practice the main exposure is an authority asking what measures were taken, and the organization being unable to show any.

A reasonable program is targeted by role and by risk, not a single generic course. The Commission suggests organizations consider a general understanding of AI, their role as provider or deployer, the risks of the AI systems they provide or use, and the existing knowledge and context of each group of staff, including legal and ethical aspects.

The Commission also states that relying only on an AI system's instructions for use, or asking staff to read them, might be ineffective. It notes there is no one size fits all format, and that "other persons" can include a contractor, a service provider or a client acting on the organization's behalf. Where AI is used to produce learning material itself, see how to govern AI generated learning content.

This mapping approach is covered in how to map training to compliance obligations. The distinction between attendance and demonstrated capability is explained in completion tracking vs competency verification.

An internal record of training and other literacy initiatives is enough; no certificate is required. The Commission states: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives."

• An inventory of AI systems in use, with the organization's role (provider or deployer) for each.
• The target groups defined for AI literacy, and the reasoning for what each group needs.
• Learning content, with version history, and the date each version was issued.
• Completion and assessment records per person, including contractors acting on the organization's behalf.
• For high-risk deployments, the names of people assigned to human oversight and evidence of their competence, training and authority.

A consistent audit trail makes these records easy to produce if a market surveillance authority asks. The same structure supports human in the loop controls for AI assisted decisions.

Knowledge Foundry models AI literacy as a set of role based concepts and assessment points linked to Article 4 and, for high-risk deployments, Article 26(2). Each learning item carries provenance back to the obligation, so the record of measures taken can be produced by role, by AI system and by date.