AI literacy under Article 4: which measures are required

Who it applies to

The AI Act distinguishes between providers, who develop AI systems, and deployers, who use them. Most companies are deployers: as soon as employees work with AI on the company’s behalf, Article 4 applies. This includes widely available tools such as ChatGPT, Copilot or translation services.

It covers everyone who uses AI on the company’s behalf, including freelancers. In its questions and answers on Article 4, the European Commission also mentions contractors and service providers: the people working for them need the AI knowledge their task requires, just like your own employees. Schools and education providers that use AI are also affected.

What the AI Omnibus changed

With the AI Omnibus, Regulation (EU) 2026/1744, the EU amended the AI Act in summer 2026. The amending regulation entered into force on 27 July 2026. The new Article 4 has applied since then.

Previously, providers and deployers were to ensure, to their best extent, that their staff had a sufficient level of AI literacy. Now Article 4 requires measures that support the development of AI literacy. Nobody has to guarantee a specific level for individual people any more. Technical knowledge, experience, education and training, the context in which AI is used and the people on whom it is used are still taken into account.

So the obligation remains. It is an obligation to act, not a promise of a result. In practice, you need to take suitable measures and be able to show that you have. You do not have to prove that every individual then has a particular level of knowledge.

What your team should know

In its questions and answers, the European Commission lists minimum points that an AI literacy programme should consider. You can read them as questions for your own organisation:

• General understanding: What is AI, how does it work, which AI do we use, and what are its opportunities and dangers?
• Role: Do we develop AI systems ourselves or use systems developed by others?
• Risk: What do employees need to know when working with the system in question, and which risks do they need to be aware of?
• Tailoring: What do people already know, and in what context and for whom is the system used?

For teams that use ChatGPT for advertising copy or translations, for example, the Commission is clear: they should be informed about the specific risks, such as hallucinations. These are answers that sound convincing and are still wrong. The Commission also considers it ineffective in many cases to rely solely on an AI system’s instructions for use or to ask employees to read them.

Which measures are suitable

Article 4 does not explicitly require training. Training is the obvious route. We recommend a combination of four building blocks:

Which measure suits whom depends on the task. You can apply this decision guide directly to your team:

• If someone uses AI rarely, for an occasional translation, for example, the basics are enough: how AI tools work, why results must be checked and which data must not go in.
• If someone uses AI every day to produce texts, quotes or analyses, add more depth: writing good prompts, checking results, verifying sources, labelling according to your organisation’s rules.
• If someone selects tools, approves results or leads a team, responsibility, contracts with providers and your own rules belong in the training too.
• If a tool helps make decisions about people, for example on job applications or learning outcomes, the basics are not enough. Check whether it is high-risk AI.
• If freelancers or service providers use AI on your behalf, agree in the contract which knowledge you expect and which rules apply.

An everyday example

An engineering firm with 18 employees. Before: Some staff use ChatGPT with private accounts to draft quotes and emails. Nobody knows exactly who uses which tool. There are no rules on which project data may go into a prompt. If an authority or a client asks, the firm has nothing to show.

After: Management has chosen an approved tool with a business account and drawn up a list of who uses it for what. Everyone has attended a basic training session. The employees who write quotes every day have also practised checking results on their own texts. A one-page set of rules is on the intranet, and a project manager is the contact person. Certificates of attendance, the rules and the tool list are kept in a shared folder.

The firm can now show which measures it has implemented. New employees go through the same steps, and the list is updated whenever a new tool is added.

How to document implementation

The AI Act does not prescribe any particular form of documentation. According to the European Commission’s questions and answers, no certificate is required either. Companies can keep internal records of training and other measures. Record what you have implemented so that you can show it if asked:

• who attended which training and when, for example with certificates of attendance
• the rules on AI use that apply, with the date
• which AI tools are in use and who uses them

This outline works as a template for such a document. For a small team, it fits on two pages:

• Tools: name, purpose, who uses it, with which account, since when
• Roles and measures: which group receives which training or instruction, and why
• Attendance: name, date, topic, type of measure, certificate filed yes or no
• Rules: current version of the AI policy with its date; keep earlier versions
• Contact person: who answers questions and reviews new tools
• Refreshers: when and for what reason the measures were last reviewed

Article 4 does not require a dedicated AI officer. The Commission makes clear that no particular organisational structure is prescribed for this. A named contact person still helps in day-to-day work.

Who checks and from when

The obligation under Article 4 has applied since 2 February 2025. Since 2 August 2026, the national market surveillance authorities have been supervising compliance. According to the European Commission’s questions and answers, they can also impose penalties for breaches of Article 4. Any penalty must be proportionate in the individual case. The Commission considers penalties more likely where an incident can be traced back to a lack of training and guidance.

Next steps

These steps put Article 4 into practice in your organisation:

• Ask your team which AI tools they use, including ones they have set up privately.
• Assign people to the roles in the decision guide.
• Define approved tools and rules, see Can my team use ChatGPT?
• Plan training for each role and name a contact person.
• Create the document using the outline above and set a date for the next review.

If you would rather not set up the training yourself, our AI training under the EU AI Act includes a certificate of attendance for each participant. Do you already know who in your team uses which AI tool?

Frequently asked questions

Sources

1. EU AI Act, Regulation (EU) 2024/1689, consolidated version of 27 July 2026, EUR-Lex
2. Regulation (EU) 2026/1744 (AI Omnibus), EUR-Lex
3. European Commission: AI Literacy, Questions and Answers

Updated: 1 October 2026. This article is not legal advice.