The European Union’s AI Act came into force on 2 February 2025. One of the provisions that is already in force is Article 4: AI literacy. This provision requires all providers and users of AI systems to ensure that their staff, as well as other stakeholders working with AI on their behalf, possess sufficient AI literacy.
At first glance, this may seem like a vague or bureaucratic obligation, but at its core it concerns the safe, responsible and lawful use of AI. In this blog, I explain exactly what the obligation entails, what the European Commission has recently clarified on this matter in a comprehensive Q&A, and what this means in practical terms for organisations.
From 2026, AI literacy will also be monitored by national regulators. The aim is to prevent AI applications within organisations from leading to risks or harm as a result of a lack of knowledge, poor judgement or incorrect assumptions about what AI can and cannot do.
What exactly does Article 4 of the AI Regulation/AI Act entail?
Article 4 stipulates that providers and users of AI systems must take measures to ensure an adequate level of AI literacy. AI literacy is defined as the skills, knowledge and understanding that enable those involved to use AI systems in an informed manner, understand the risks, avoid harm, and act responsibly in accordance with their rights and obligations.
This obligation is highly practical in nature. Organisations are expected to take into account the technical knowledge, experience, training and context of their staff and other stakeholders when designing their AI literacy policies. This means that not every organisation needs to implement the same measures, but it does mean that every organisation must take this matter seriously.
Who is subject to this obligation?
The obligation applies to both ‘providers’ and ‘deployers’ of AI systems. These include not only internal staff, but also people who use AI on behalf of the organisation. Examples include externally hired developers, consultants or customers who have access to your AI solutions. Furthermore, Article 4 is closely linked to other provisions of the AI Act, such as transparency (Article 13) and human oversight (Article 14), and indirectly contributes to the protection of individuals affected by AI.
Is it compulsory to assess knowledge?
Although Article 4 does not require organisations to assess their staff’s AI knowledge in a quantifiable manner, it does stipulate that organisations must take that knowledge into account when ensuring AI literacy. It is therefore not compulsory to set exams or record scores, but it is necessary to consider what your staff know, what they should know, and how you can bridge that gap.
What does AI literacy mean in practice?
The AI Act sets out four key components that an AI literacy programme should, at a minimum, include:
- A general understanding of AI within the organisation: What is AI? How does it work? Where and why is AI used within the organisation? What are the benefits and risks?
- Understanding the organisation’s role: Do we develop our own AI systems, or do we use systems developed by others?
- Awareness of the level of risk: Which AI systems do we use? What are the risks and how are they mitigated?
- Alignment with the users’ profile: What is the level of knowledge of our staff or service providers? What do they still need to learn, given their tasks and responsibilities?
These elements must also cover the legal and ethical aspects of AI use. An understanding of the AI Act itself, as well as principles relating to responsible use of algorithms, discrimination, transparency and oversight, are relevant in this regard.
Is there a risk-based approach?
Yes. Organisations must adapt their approach to the risk level of their AI systems. Those working with high-risk AI systems – as defined in Chapter III of the AI Act – must take more stringent measures than those who merely use a simple chatbot for customer service. For high-risk applications, training materials are generally not sufficient. In-house training, guidelines and ongoing support are essential.
Is training compulsory?
Training is not always compulsory, but in many cases it is advisable or even unavoidable. Simply sending out a user manual is often not enough. The AI Act requires organisations to take appropriate measures that are effective given the level of knowledge of those involved and the context of the AI system. The Commission points out that Article 26 of the AI Act explicitly requires that staff be adequately trained when using high-risk systems.
What does a training session like that involve?
There is no prescribed format. Training can range from e-learning and workshops to informal guidance, depending on the organisation, the type of AI and the target group’s level of knowledge. Different levels of training, or even personalised learning pathways, are permitted and often desirable.
Is it compulsory to document all of this?
No certificate is required, but organisations would be well advised to keep an internal record of the measures taken. These might include a training register, manuals, training materials or support plans. This may prove useful in the event of an inspection or legal disputes.
What about external parties?
External parties that use AI systems on behalf of an organisation must also possess sufficient knowledge. In some cases – for example, in high-risk applications – it is advisable or necessary to stipulate in a contract that a service provider must be AI-literate.
What about simple applications such as ChatGPT?
Even in the case of seemingly simple uses of AI – such as using ChatGPT for writing texts or translating – this obligation applies. Users need to be aware of the risks, such as unreliable or incorrect output (hallucinations), a lack of source references and potential bias. A brief instruction or awareness-raising session may be sufficient here, provided it is effective.
What are the consequences of non-compliance?
From 3 August 2026, national supervisory authorities will monitor compliance with Article 4. Fines or penalties may be imposed in the event of non-compliance, particularly if damage occurs that is (partly) due to a lack of knowledge on the part of users. Penalties must be proportionate, but may be severe in cases of gross negligence or high-risk systems.
Who is responsible for supervision?
Each EU Member State must appoint a national supervisory authority by August 2025. From August 2026, that supervisory authority will be responsible for enforcement. Until then, organisations must already begin preparing and making the necessary arrangements to ensure they are compliant in due course.
Is there also private enforcement?
Yes. If an individual suffers harm as a result of an AI system being misused and claims that this is due to a lack of AI literacy within an organisation, that person may bring a civil action. Article 4 therefore concerns not only public but also private responsibility.
What about organisations outside the EU?
The AI Act also applies to parties outside the EU as soon as their AI systems are deployed on the European market or have an impact on individuals within the Union. This means that companies outside the EU must also ensure their staff are AI-literate if they operate on the European market.
How your organisation can meet the AI literacy requirement
Article 4 of the AI Act requires organisations to take responsibility for the way in which AI is used within their processes. This does not call for a rigid compliance programme, but rather a well-considered, bespoke approach. Not only to comply with the law, but above all to prevent incidents, reputational damage and legal liability.
Julia van Leeuwen, a solicitor specialising in AI, can help your organisation to assess its use of AI, set up AI literacy programmes, draw up internal policies and ensure that agreements with external parties are legally binding.
