The Obligation Everyone Skipped Past
The EU AI Act's headline dates are about high-risk systems and general-purpose AI. But the very first substantive obligations bit on 2 February 2025 — and while the prohibited-practices ban got the attention, it arrived alongside a duty that applies to vastly more organisations: Article 4, AI literacy. It is not coming. It is already law, and most companies have not addressed it.
Article 4 is short, which is part of why it is underestimated. It requires providers and deployers of AI systems to 'take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf' — taking into account their technical knowledge, experience, education and training, the context in which the systems are used, and the people the systems affect. Before Regulation (EU) 2026/1744 came into force on 27 July 2026, the wording read 'take measures to ensure, to their best extent, a sufficient level of AI literacy'. That regulation (the Digital Omnibus on AI) reworded it and added that the obligation 'does not require providers or deployers to guarantee any specific level of AI literacy of any individual'. The duty itself has applied since 2 February 2025.
- In force since 2 February 2025 — one of the earliest binding duties in the Act.
- Applies to providers AND deployers of AI systems.
- No risk-tier threshold: it is not limited to high-risk systems.
- No headcount exemption: a five-person team is as much in scope as a multinational.
Who It Applies To (Almost Everyone)
This is the part that surprises people. Article 4 has none of the gating that limits most of the Act. It does not wait for a system to be high-risk. It does not exempt small companies. If your organisation develops AI (provider) or uses AI in a professional capacity (deployer) — and in 2026 that is almost every organisation — you owe an AI-literacy duty for the people building, operating and relying on those systems.
'Staff and other persons dealing with the operation and use of AI systems on your behalf' is deliberately broad. It reaches employees, but also contractors, agency staff and outsourced operators who touch your AI on your behalf. The scope follows the people, not the org chart.
The obligation is proportionate, not uniform
- A data scientist building a model needs deep technical and legal literacy about its limitations and risks.
- A recruiter using an AI CV-screening tool needs to understand what it does, how it can go wrong, when to override it, and how to interpret its output.
- An executive or board member needs enough literacy to make informed governance decisions and set policy.
- A customer-support agent using an AI assistant needs to know it is AI, its limits, and when to escalate to a human.
What AI Literacy Means in Practice
There is no certificate you can buy to close Article 4, and that is by design. The Act defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems, to gain awareness of the opportunities and risks of AI, and of the possible harm it can cause. What fits is measured against the specific role, the specific systems, and the specific people affected — so a one-size training video does not discharge it.
In practice, the measures for a given person tend to cover three things: a general understanding of how AI works and where it fails; the specific risks and limitations of the systems they actually use; and the relevant legal and ethical guardrails — including when a human must stay in the loop. Article 4(2) asks the Commission and the Member States to support providers and deployers, in particular SMEs, and to publish practical examples of how to comply. The measure is contextual rather than a fixed syllabus.
- General AI understanding: how the systems work, and how they fail (bias, drift, hallucination, over-reliance).
- System-specific risk: the concrete limitations of the tools each person uses.
- Legal and ethical context: the guardrails, the oversight duties, and when to escalate to a human.
- Calibrated to the person: role, prior knowledge, and who the AI affects all change what fits.
Does It Carry a Fine?
Article 4 is not listed among the provisions in the Article 99 fine tiers, so no dedicated EU-level fine ceiling attaches to it. That does not make it optional. It is a binding obligation, penalties for infringements of the Regulation are set by Member States under Article 99(1), and they must be effective, proportionate and dissuasive.
Literacy also shows up elsewhere in the Act. Article 26(2) requires deployers to assign human oversight of a high-risk system to natural persons who have the necessary competence, training and authority, as well as the necessary support, and deployer obligations under Article 26 do sit in the Article 99(4) fine tier. An organisation that can produce role-specific, timestamped training records can show the measures it took; one that cannot has little to point to when asked.
How to Comply — and Show It
Compliance with Article 4 is less about volume of training and more about fit and evidence. The defensible posture is training that is mapped to roles, tied to the specific systems people use, refreshed as those systems change, and — critically — logged. If you cannot show who was trained, on what, and when, you cannot prove the measure was taken.
A practical Article 4 checklist
- Inventory who operates or relies on AI in your organisation — including contractors and outsourced staff.
- Map roles to literacy needs: general awareness for everyone, deeper technical and legal literacy for builders and overseers.
- Deliver training that covers general AI understanding, the specific risks of the systems in use, and the legal and ethical guardrails.
- Record it: log completion with timestamps, link records to individuals, and retain them as evidence.
- Refresh on change: when you adopt a new system or a system materially changes, update the training and the records.
- Keep a short written AI-literacy policy that states the programme, its scope, its owner, and its review cadence.
This is the rare EU AI Act obligation that is fully in your control, low-cost, and immediately actionable. It is also the one most companies have quietly missed. Closing it now — with auditable records rather than good intentions — gives you a record of the measures you took before anyone asks for it.