Article 4 of the AI Act: What AI Literacy Means in Practice and How You Prove It

What Article 4 says today

Article 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025, together with the prohibited practices. It was the first AI Act obligation to switch on, and the only one that applies horizontally to every provider and every deployer, whether they run a customer service chatbot or a high-risk system.

In July 2026 the text changed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and replaced Article 4. The new wording has three parts:

• Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the systems are to be used in.
• The obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
• The Commission and the Member States support the efforts of organisations, in particular SMEs, and the Commission publishes practical examples of compliance on the single information platform of Article 62.

Who it covers

Article 4 speaks of “staff and other persons dealing with the operation and use of AI systems on their behalf”. In the Questions and Answers the Commission published in May 2025, the reading is broad: persons “under the organisational remit” of the organisation. That includes contractors, service providers and in some cases even clients using your system.

In practice, for a Greek organisation of medium or large size, this means three groups:

1. Employees who use AI daily, usually general-purpose tools (Copilot, ChatGPT, Gemini) embedded in their workflow. This is the largest group and the one most often forgotten, because they “don’t work with AI”, they just use it.
2. Employees who make or influence decisions with AI assistance: HR screening CVs with a shortlisting tool, underwriters, credit analysts, service managers relying on automated prioritisation. Here Article 4 meets the human oversight obligations of Article 26 for high-risk systems.
3. External partners operating AI systems on your behalf: a call centre company, a marketing automation provider, a technical maintenance team.

What counts as a “sufficient” measure

The Commission has said explicitly that it will not impose strict requirements on content or format. There is no mandatory certificate, no mandatory number of hours, no approved training body. There are, however, three directions that recur in the Q&A and in the analyses that followed:

A general understanding of AI. What an AI system is and is not, how it produces outputs, why it is confidently wrong, what bias means, what a hallucination is, which data must never be entered.

Understanding by role and by use. The measure must match the sector, the specific use and the background of the people. A lawyer in an insurer needs different content from a warehouse supervisor in a pharmaceutical company. The same seminar for everyone is the most common weakness.

Understanding the risks of your own position. Do you develop AI, use third-party AI, or both? Which of your systems touch decisions about people? The measure has to reflect that picture.

The Commission also warned that asking staff to read the system’s instructions for use is probably not enough. Training is not mandatory in the narrow sense, but it is hard to argue you “took measures” without some form of it.

The question that matters: what can you show

This is the heart of it, and this is where most organisations that “did something” fail. Article 4 is not in the fine tiers of Article 99. Penalties for breaching it are set by each Member State within the national penalty regime. That leads many to conclude the obligation is “soft”. It is the wrong conclusion, for three reasons.

First, market surveillance authorities look at Article 4 in the context of every other check. If a high-risk system causes a problem, the first question will be whether the people operating it were prepared. The Commission has already said enforcement is more likely where non-compliance stems from a lack of “appropriate training and guidance”. A supervisor who finds Article 4 was ignored will not treat it as a standalone offence; it will treat it as an aggravating factor.

Second, Article 4 connects to obligations that do have teeth. GDPR accountability when an employee pastes personal data into a public tool. The management training duty under NIS2 (Law 5160/2024). Contractual commitments to clients and insurers. In all of these, proof that staff were trained is part of the defence.

Third, and most practically: if you cannot show what you did, it is as if you did not do it. An email with a link to a video is not evidence. An attendance sheet in Excel without content is not evidence. An external certificate for two IT staff does not cover the 400 employees using Copilot.

What an adequate answer looks like

From the AI governance engagements we have run in regulated industries, the programme that survives an audit has five elements. None of them is complicated. The difficulty is having all of them together and keeping them current.

1. An inventory of AI use by role. Which AI systems are used, by which teams, for which decisions. Without this you cannot define what each person needs to know. The inventory usually also surfaces shadow AI nobody had recorded.

2. A programme by level. A baseline for everyone who uses general-purpose AI. A specialised level for those who influence decisions about people, focused on human oversight, the system’s limits and when to override it. A level for management, about responsibilities rather than technology.

3. Assessment. Not because the law demands it, but because without assessment you cannot claim the measure “supported the development” of AI literacy. A short assessment after each module is what turns attendance into understanding.

4. A record per employee. Who, when, on which content, with what result. The record must be exportable, timestamped and tamper-evident. This is the document that will be requested.

5. Repetition. Systems change, people change roles, new hires arrive. A 2025 programme does not cover the employee who joined in September 2026. Annual refresh and onboarding for every new role is the minimum.

The cost question

The argument we hear most often is that such a programme for hundreds of employees is expensive. That is true if it is done the classic way: external trainer, classroom, day rate, for each department separately. It is not true if the baseline is delivered asynchronously, with content per department, assessment and an automatic record, and the trainer is spent where it has value: on the roles that influence decisions and on management.

That logic is why we built Credenz: the Article 4 baseline as a programme per department, with assessment and a sealed certificate per employee, without the organisation setting anything up from scratch. The specialised level and management remain human work, and that is where the AI governance service focuses.

What to do this month

If you have not started, the order we suggest is this. First the inventory: one week to learn who uses what. Then a policy: one page saying what is allowed, what is not, and who to ask. Then the baseline programme for everyone, with a record. Then the specialised programme for the roles that influence decisions. Management joins the programme at the start, not at the end, because its own training is the first thing that will be requested in any audit, for the AI Act as much as for NIS2.

If you have started, the control question is a single one: pick an employee at random from a department that uses AI and try to produce, within ten minutes, the evidence of their training. If you cannot, that is the gap.