AI Literacy: The EU AI Act Obligation Every Employer Now Faces

Most enterprise leaders now know the EU AI Act imposes obligations on high-risk AI systems. Fewer realise that one of its most immediate obligations — Article 4, the AI-literacy duty — has been in force since 2 February 2025, applies to every provider and deployer regardless of risk classification, and sits alongside the Act's general date of application, 2 August 2026. This guide sets out what the obligation requires since the Digital Omnibus amendment, how that differs from the original 2024 wording, and what a defensible programme looks like.

What Article 4 Actually Says

Article 4 of the EU AI Act was replaced by Article 1, point (5) of Regulation (EU) 2026/1744 (Official Journal of the European Union, L series, 24 July 2026; in force since 27 July 2026). Paragraph 1 of the new Article 4 reads:

> "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

Paragraph 2 asks the Commission and the Member States to support providers and deployers, in particular SMEs, and requires the Commission to publish practical examples of how to comply. Paragraph 3 asks the AI Board to adopt recommendations that support the promotion of AI literacy.

Under the original 2024 wording, providers and deployers had to take measures "to ensure, to their best extent, a sufficient level of AI literacy". The amendment replaces that sentence; the old text is no longer the law.

Three properties matter:

• The obligation is on the employer, not the employee. The enterprise must take measures. It cannot pass the obligation to individuals by asking them to self-certify.
• It applies universally. Every provider and every deployer of AI, regardless of whether the systems used are high-risk, limited-risk, or minimal-risk under the Act's taxonomy. A retailer using a general-purpose chatbot has the same Article 4 obligation as a bank running an Annex III credit-scoring system.
• It is context-sensitive. The article says the measures must take account of people's technical knowledge, experience, education and training and the context of use. The measures that suit a nurse using clinical decision support differ from those that suit a marketing analyst using a copy generator, and a one-size-fits-all programme does not, on its face, reflect that.

What 2 August 2026 Means for Article 4

Article 4 has been in force since 2 February 2025, but the practical enforcement question in most enterprises was "who exactly could act against us for failing?" Until the Act's general date of application the answer was less clear.

2 August 2026 is the date from which the EU AI Act generally applies (Article 113) — the date from which its remaining provisions, including those on market surveillance and enforcement by national authorities, apply. Article 4 itself, as part of Chapter I, has applied since 2 February 2025, and the Act's penalty rules (Chapter XII) since 2 August 2025. Which authority will examine an Article 4 concern depends on how each Member State has designated its competent authorities, so check the position in each Member State where you operate.

Article 4 itself carries no dedicated fine. Article 99 sets three tiers: up to €35 million or 7% of worldwide annual turnover for prohibited practices; up to €15 million or 3% for the specific operator obligations listed in Article 99(4), of which Article 4 is not one; and up to €7.5 million or 1% for supplying incorrect information to authorities. An Article 4 shortcoming may still be an aggravating factor if an authority investigates a downstream incident — an unsafe AI output, a biased decision, a data-protection breach — under other provisions. The Digital Omnibus amendment (in force since 27 July 2026) rewrote Article 4 so that providers and deployers must take measures to support AI literacy, without any duty to guarantee a specific level for any individual. The defensible position is therefore a documented, role-tiered programme, not a claim that every employee is now expert.

What the Commission's Guidance Says, and How to Use It

The Commission's AI Literacy Q&A and its Repository of AI Literacy Practices — which catalogues over 40 initiatives collected from companies and public-sector bodies between December 2024 and June 2025 — were written when Article 4 still asked for a "sufficient level" of literacy. They did not set a threshold, and they described the aim in terms of outcomes: whether staff can operate the AI system safely in their real role, not whether they collected a certificate. We have not checked whether the Q&A has been updated since the amendment, so read both as examples of practice, not as the current legal standard.

Working from that guidance, a defensible programme covers, per role, at least:

• What the AI tool actually does, in plain language — how it produces its outputs, what its inputs are, what its trained purpose is.
• Where failures occur and mistakes happen — including bias, hallucination, drift, and the specific failure modes of the tool in question.
• How to recognise a wrong, biased, or misleading output — role-specific examples and heuristics.
• How to handle data responsibly — including any GDPR interaction and any tool-specific data-handling constraints.
• *When not to rely on the tool* — the boundary of appropriate use, and the fallback the employee should reach for.
• What the consequences are for people affected — a literacy in the human downstream impact, not just the technical mechanism.

A generic "Introduction to AI" video that covers none of these role-specific elements is hard to defend as a measure that takes account of each person's knowledge and context, as the article now requires.

A Role-Tiered Programme

The most common defensible structure is four tiers, sized to how the person interacts with AI in their work:

• Executive tier (board, C-suite) — strategy, risk, and regulatory framing. Focus on how the enterprise sees AI risk, the AI policy, the escalation path, and executive-level accountability. Typically half-day to one-day content, refreshed annually.
• General workforce tier (all staff who might use an AI-adjacent product) — foundational literacy on what AI is, how it fails, and the enterprise's acceptable-use policy. Typically 60–90 minutes, delivered on onboarding and annually.
• Heavy-user tier (staff whose primary tools are AI-driven — marketing, engineering, customer support, analysts) — deeper training on the specific tools they use, prompt-quality practice, hallucination detection, and data-handling for those tools. Typically 3–6 hours, refreshed twice yearly as tools evolve.
• Builder/technical tier (staff who develop, integrate, or operate AI systems for the enterprise) — training on responsible-AI engineering, model evaluation, red-teaming basics, EU AI Act deployer and provider obligations, and the enterprise's AI risk-management process. Typically multi-day, with role-specific certifications where they exist.

Each tier needs evidence: completion records, competency checks (short scenarios rather than multiple-choice), and role-manager sign-offs.

What the Digital Omnibus Changed

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) replaced Article 4. Under the original 2024 wording the duty was to take measures "to ensure, to their best extent, a sufficient level of AI literacy". Under the new wording it is to take measures "to support the development of AI literacy", and the Regulation adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". Two practical implications:

• Documented process beats claimed outcome. A regulator investigating an Article 4 concern will ask what did you do — training content, role assignment logic, completion records, competency checks, refresh cadence, incident-triggered re-training. A defensible programme is one that produces these artefacts continuously, not on demand.
• Context still sets the measures. The article says measures should take account of each person's technical knowledge, experience, education and training, the context the AI systems are used in, and the people on whom they are used. A hospital deploying clinical decision support has a very different literacy need than a retailer using a marketing copy generator — and the enterprise can and should document why its programme is calibrated the way it is.

Where Programmes Fail

• The one-video-fits-all approach. A single generic AI-literacy video, delivered once, is hard to defend as a measure that takes account of each person's knowledge and context, as the article requires. It also shows that the enterprise considered the obligation and settled for a token.
• Training with no evidence. If completion records, competency checks, and role assignments are not captured, the enterprise has no artefact to show a regulator. From an evidence perspective, an untracked programme is invisible.
• Assuming the tool vendor covers it. Tool vendors' user-facing materials are not the same as an enterprise AI-literacy programme. Vendor material can be an input, but the obligation to take measures is the enterprise's, for its people using the tool in its context.
• Static content. AI systems in use in the enterprise change quickly. A literacy programme that does not refresh at least annually — and preferably in response to significant tool changes or incidents — is likely to drift out of scope quickly.

Reference Points Worth Knowing

• The European Commission's Repository of AI Literacy Practices — over 40 initiatives, gathered in two waves in 2024–2025, with practical examples across sectors.
• The AI Literacy Q&A — the Commission's guidance document, published before the Digital Omnibus amendment; check whether it has since been updated.
• The EU AI Skills Academy, launched under the Digital Europe Programme in April 2025 — offers sector-tailored training and apprenticeships. Not a substitute for an internal programme, but a useful reference for scope and structure.
• The Pact for Skills, which engages industry partners in upskilling — a policy scaffolding rather than a training programme.

What Leaders Should Be Asking

• Do we have a documented AI-literacy programme, and is it role-tiered?
• Can we produce, on demand, completion records and competency checks per role, per person?
• Is our programme content role-context-specific — does it address the actual tools our people use in the actual jobs they do?
• What is the refresh cadence, and what triggers a re-training (e.g. new tool deployment, incident, regulatory update)?
• For our EU operations: who inside the enterprise owns the Article 4 obligation, and how does it connect to our wider AI governance programme?
• How does the AI-literacy programme feed evidence into our ISO 42001 audit and our AI risk-management process?

The Underlying Point

Article 4 is the EU AI Act obligation most enterprises are best positioned to meet — and most likely to underinvest in until enforcement forces the conversation. The organisations that will be exposed in 2027 are not the ones that did nothing; they are the ones that did a generic video and treated it as compliance. The obligation is one of effort, and the evidence of that effort — role-tiered content, competency checks, dated completion records, refresh cadence — is exactly the documented enterprise programme that also makes the AI work better.