AI literacy is a duty, not a nice-to-have
Art. 4 of the AI Act requires providers and deployers to take measures ensuring, to their best extent, a sufficient level of AI literacy among their staff and other persons operating and using AI systems on their behalf. The provision has been applicable since 2 February 2025. What changes on 2 August 2026 is not the duty but the enforcement architecture behind it: from that date national market surveillance authorities are in place for it. This page sets out who is caught, what sufficient is measured against, and a route from an inventory to a record.
- AI Act · Art. 4
- Providers and deployers
- Applicable since 02 Feb 2025
Curated orientation drawn from a corpus anchored to the official EU sources. Not legal advice, not a legal assessment of your case.
Whom the duty catches
Art. 4 addresses providers and deployers alike, and it does so independently of the risk class of the system in question. There is no threshold to clear first: a company that merely uses a commercially available AI tool in its own operations is a deployer within the meaning of Art. 3(4) of the AI Act, and the literacy duty attaches to that role — even where the system is neither high-risk nor subject to the transparency obligations of Art. 50.
Addressees and the persons covered
| Dimension | What the norm provides for |
|---|---|
| Addressees | Providers and deployers of AI systems — the duty falls on both roles, and a company can hold both at once for different systems. |
| Risk class | Irrelevant to whether the duty applies. Risk feeds into how much literacy is sufficient, not into whether Art. 4 fires at all. |
| Persons covered | Staff, and other persons who operate or use the AI systems on the addressee's behalf — contractors and external service staff are therefore within the frame, not outside it. |
| High-risk systems | Where high-risk systems are deployed, the training and instruction requirements of Art. 26 come in addition to Art. 4; the general duty is not displaced by them. |
The table names what the norm provides for. Whether a concrete company is a provider or a deployer for a concrete system, and which of its people fall within the duty, depends on its own facts — that determination is a legal assessment and belongs in a mandate.
What sufficient is measured against
The AI Act does not set a syllabus and does not name a number of training hours. Art. 4 works relationally: literacy is sufficient when it fits the role the person holds, the technical knowledge, experience and training they already bring, the context in which the system is used, and the persons or groups of persons on whom the system is used. The same tool can therefore require a short briefing in one team and a substantially deeper treatment in another.
Reference points named by the European Commission
- A general understanding of AI What the systems in use can do, how they arrive at outputs, and where their limits lie.
- Awareness of one's own role Whether the organisation acts as provider or as deployer for the system concerned — the duties that follow differ.
- The risks of the systems actually deployed Not AI risks in the abstract, but those of the concrete systems in use — including automation bias, that is, the tendency to over-trust a machine output.
- Depth tailored to the audience Graduated by prior knowledge and by exposure, rather than one uniform course rolled out across the whole workforce.
The statute does not require a certificate, and no certification body is designated for the purpose. According to the Commission an internal record is sufficient. That is a relief in form only — the substance still has to exist and still has to be capable of being shown. Anyone who cannot say later who was trained on what, when, and on which systems, has organised the measure but not the evidence of it.
A voluntary repository of AI literacy practices is published by the Commission. It collects self-reported examples; replicating them does not give rise to any presumption of conformity, and the Commission neither endorses nor assesses the entries.
Four steps to a record
-
Clarify the AI inventory and the roles
Which AI systems are actually in use, in which processes, and does the organisation act as provider or as deployer for each of them? Shadow use — tools brought in by individual teams without a central decision — belongs in the inventory, because the duty attaches to the use, not to the procurement record.
-
Define target groups and levels of competence
Group the people covered by their exposure: those who merely receive outputs, those who work with the system daily, those who review or override its decisions, and those who procure or configure it. Each group gets its own required level rather than a shared minimum.
-
Deliver the training and document it
Run the measure and record what makes it verifiable afterwards: content, date, systems covered, participants, and the level of competence aimed at. The record is written while the measure runs — reconstructing it later is where the effort actually lands.
-
Maintain the record and follow changes
A new tool, a materially changed model version, a new team or a changed role shifts the required level. The record is therefore a live document with review dates, not a folder closed once.
What we deliver — and what we do not
Regingada UG (haftungsbeschränkt) builds software and takes on appointed EU-representative functions. Legal assessment of the individual case is provided by the law firm Theo Funk under a separate mandate. That boundary also runs through this subject.
Structured stocktaking in the twin
The suite records the AI systems in use, the role held for each of them and the groups of people affected, in a structured form that stays readable back to the norm. That is the raw material for steps 1 and 2 — self-assessment, not an assessment by us.
Evidence documentation as a draft deliverable
From the stocktaking the suite generates a document draft for the internal record. It is marked as a draft. Whether it holds for a concrete company is a legal question, and it is answered by the law firm under a separate mandate, not by the software.
Training content by arrangement
Content for the individual target groups is worked out in coordination with you and tailored to the systems actually in use. Scope, format and delivery are agreed case by case.
What we do not deliver: no certificate from a certification body, no accredited qualification and no seal. The AI Act does not provide for one for Art. 4. What can be produced is a participation and competence record in documentary form for your own file — no more, and it should not be described as more.
Two dates, two different things
Key dates
| Date | What takes effect | Practical consequence |
|---|---|---|
| 02 Feb 2025 | Art. 4 becomes applicable together with the general provisions and the prohibited practices of Art. 5. | The duty exists now, not from 2026. Anyone who begins in August 2026 is starting late by a year and a half. |
| 02 Aug 2026 | The supervisory and penalty architecture of the AI Act takes hold; national market surveillance authorities become responsible for Art. 4. | From that point a supervisory authority can ask about the measure — and the answer is whatever record exists at that moment. |
A reservation belongs alongside these dates: the Digital Omnibus proposed by the Commission on 19 Nov 2025 could shift the general literacy duty in part to the Member States and the Commission. As at August 2026 it has advanced in the legislative procedure but is not in force; the state of the law described here is the one currently applicable. The training obligations tied to high-risk systems under Art. 26 would remain in any event.
Where to start
The first step costs no decision: find out which role you hold for which system. Everything that follows — level of competence, content, record — depends on that answer.
Orientation, not legal advice
This page and the suite provide orientation and information only. They are not legal advice. Individual-case advice is provided exclusively by the law firm Theo Funk under a separate mandate. Regingada UG (haftungsbeschränkt) — the software company and appointed EU representative — and the law firm are strictly separated.