Article 4 of the EU AI Act: what AI literacy actually requires

Providers and deployers of AI systems must take AI literacy measures for their staff and other persons dealing with the operation and use of those systems on their behalf. As amended by Regulation (EU) 2026/1744, the article itself makes its nature as a measures-based obligation explicit: it “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.

In practice: you do not document a level attained; you document the measures you took and the basis on which you determined their scope.

The article lists what to take into account when calibrating the measures:

• the technical knowledge, experience, education and training of each person;
• the context the systems are intended to be used in;
• the persons or groups of persons they are to be used on.

Documenting those three points is what turns “we ran a session” into a decision you can stand behind. It is the part almost no checklist covers, and the one everything else rests on.

“And other persons dealing with the operation and use of AI systems on their behalf” is not your payroll. It is the agency running your campaigns with AI tools, the law firm drafting with an assistant, the external technician operating your customer-service system, the recruitment company screening applications for you. None of them is on your payroll and all of them are in. Part of the measures, therefore, is agreed by contract rather than delivered as training.

Two things worth holding in mind at the same time, because they are usually told badly when told apart.

First: Article 4 does not appear in the enumeration of Article 99(4), the list of provisions carrying the Regulation's highest fines. Anyone selling you training “to avoid the Art. 4 fine” is telling you the law wrong.

Second: that does not mean what it seems to mean. Article 26(2) requires that human oversight of a high-risk system be entrusted to persons with “the necessary competence, training and authority” — and Article 26 is on that list. Training comes in through another door, and that door does carry those fines.

The useful argument is not the fear-based one. It is simpler: the obligation has been in force since February 2025, you comply by documenting, and whoever does not document has nothing to show the day a client, an auditor or an authority asks.

1. List who uses which AI systems — staff and the external parties acting on your behalf.
2. Size the measures per group against the article's three criteria, and put it in writing.
3. Deliver: sessions, usage guides, per-tool ground rules. What is proportionate to your case, not a master's degree.
4. Record date, content, attendees and rationale. Without a record, there is nothing to show.

Download the AI literacy checklist →

In Alethexis M1 · Visibility, your Art. 4 measures are recorded next to the inventory they refer to: which measure, for whom, on what basis, and its traceable evidence.

How it works →