EU AI Act Article 4 AI Literacy: National Enforcement Has Started - What Evidence Regulators Will Actually Ask For
AI literacy is the EU AI Act obligation most organisations have in scope and fewest have documented. Article 4 applies to every provider and deployer of an in-scope AI system, not only those running high-risk systems. It has been applicable since 2 February 2025, and national market surveillance authorities have been able to enforce it since 2 August 2026 per MuchSkills' enforcement analysis. This guide explains what the duty requires, what changed under the Digital Omnibus, and what evidence to keep.
Who Article 4 covers
Article 4 covers providers and deployers of AI systems. The scope is the whole Act's scope, so a marketing team using a generative AI tool and a bank running a credit model are both covered. Unlike most of the Act, it is not limited to high-risk AI. If you are unsure whether you are a provider or a deployer, start with our guides to Article 26 deployer obligations and the Article 3(1) AI system definition.
What "sufficient" means
The Act does not prescribe a syllabus or a certificate. Staff and other people operating AI on your behalf need a sufficient level of AI literacy, judged against their technical knowledge, experience, education and training, the context of use, and the people affected. In practice that means training is role-based and proportionate to the risk of the systems each role touches as described by Secure Privacy.
| Role | Training focus | Depth |
|---|---|---|
| General staff using AI tools | Limits, hallucinations, data-protection rules, approved tools, when to escalate | Short, recurring |
| Business owners of AI systems | Risk classification, human oversight, incident escalation, vendor questions | Moderate |
| Operators of high-risk AI | Instructions for use, oversight duties, logging, automation bias | Deep, system-specific |
| Developers and data teams | Data governance, testing, documentation, robustness | Deep, technical |
| Leadership and board | Accountability, fines exposure, governance model | Briefing level |
What the Digital Omnibus changed
The Digital Omnibus, endorsed by Parliament and approved by Council in June 2026, softened the wording. Instead of an obligation that could read as guaranteeing literacy, the duty is framed as one of effort: organisations must take measures to support the development of AI literacy according to the same analysis. That helps in a dispute, but only if you can show the effort. Read the exact final text of Regulation (EU) 2026/1744 before relying on this summary. For the wider timeline, see our Digital Omnibus implementation status post.
Are there fines?
There is no standalone EU-level fine for Article 4, because Article 99 does not list it as a fineable provision. Two caveats matter. First, a documented literacy gap can count as an aggravating factor if a regulator finds another violation. Second, member states may set their own national penalties, so check domestic law in each country where you operate per MuchSkills. Our fines explainer covers the three tiers.
A policy document is not evidence of literacy. Regulators will look for records of who was trained, when, on what content, and how understanding was assessed.
The evidence file to build
List every AI system and who uses it. You cannot size training for tools you cannot see; see our shadow AI guide.
Assign each role a literacy tier based on the systems it uses and the decisions it influences.
Keep attendance, dates, content versions and the trainer or vendor for each cohort.
Use short quizzes or scenario checks and keep the results, not just completion flags.
Retrain when a new tool, a new use case or new guidance arrives, and log the trigger.
Have the governance forum sign off the programme and note gaps and fixes.
Pair the programme with your AI governance operating model so ownership is clear: someone named should own the literacy register.
Contractors and vendors
The duty extends to other persons dealing with AI systems on your behalf. Contract clauses should require contractors using AI in your name to meet comparable literacy standards, and your onboarding checklist should capture it. Our procurement guide shows where to add such clauses.
Does Article 4 apply if we only use ChatGPT-style tools?
Yes, if you are a deployer of an in-scope AI system. Article 4 is not limited to high-risk systems.
Do we need a certificate or accredited course?
No. The AI Office has said no certificate is required; what matters is sufficient, documented, role-appropriate training.
Can we be fined directly under Article 4?
Not at EU level under Article 99, but national rules may differ and a gap can aggravate other breaches.
How often should we retrain?
There is no fixed interval. Refresh on tool or use-case change and review the programme at least annually.
Who enforces it?
National market surveillance authorities, since 2 August 2026.
Bottom line
Treat Article 4 as an evidence problem. Build a role-based programme, keep records that prove it, and review it on a schedule. That is cheap compared with explaining an undocumented gap after an incident.
Related reading
Article 14 EU AI Act: Engineering Human Oversight That Actually Works
Article 14 is a design obligation, not an HR policy. Here's how to engineer the five oversight capabilities, split provider vs deployer duties, handle the biometric two-person rule, and build an audit-ready evidence trail.
EU AI Act Article 13: What Your Instructions for Use Must Contain, and What Deployers Should Demand From Vendors
Article 13 turns the instructions for use into the contract between a high-risk AI provider and its deployers. Here is what Article 13(3) requires, the evidence deployers should ask for, and where harmonised standards stand after 14 October 2026.
GPAI Models With Systemic Risk: The Safety and Security Chapter of the Code of Practice, Explained
Providers of the most capable general-purpose AI models carry extra duties. Here is what the Safety and Security chapter of the GPAI Code of Practice asks for, the incident timelines, and the dates that matter now the AI Office can enforce.