AI literacy is a duty, not a nice-to-have
Art. 4 of the AI Act requires providers and deployers to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. Regulation (EU) 2026/1744, in force since 27 July 2026, replaced the earlier wording: the duty is one of effort, and it expressly does not require anyone to guarantee a specific level of AI literacy of any individual. Art. 4 itself has been applicable since 2 February 2025, and since 2 August 2026 national market surveillance authorities are in place for it. This page sets out who is caught, what the measures have to fit, and a route from an inventory to a record.
- AI Act · Art. 4
- Providers and deployers
- Since 02 Feb 2025 · amended 2026
Curated orientation drawn from a corpus anchored to the official EU sources. Not legal advice, not a legal assessment of your case.
Whom the duty catches
Art. 4 addresses providers and deployers alike, and it does so independently of the risk class of the system in question. There is no threshold to clear first: a company that merely uses a commercially available AI tool in its own operations is a deployer within the meaning of Art. 3(4) of the AI Act, and the literacy duty attaches to that role — even where the system is neither high-risk nor subject to the transparency obligations of Art. 50.
Addressees and the persons covered
| Dimension | What the norm provides for |
|---|---|
| Addressees | Providers and deployers of AI systems — the duty falls on both roles, and a company can hold both at once for different systems. |
| Risk class | Irrelevant to whether the duty applies. Risk and the context of use feed into which measures are appropriate, not into whether Art. 4 fires at all. |
| Persons covered | Staff, and other persons who operate or use the AI systems on the addressee's behalf — contractors and external service staff are therefore within the frame, not outside it. |
| High-risk systems | Where high-risk systems are deployed, the training and instruction requirements of Art. 26 come in addition to Art. 4; the general duty is not displaced by them. |
The table names what the norm provides for. Whether a concrete company is a provider or a deployer for a concrete system, and which of its people fall within the duty, depends on its own facts — that determination is a legal assessment and belongs in a mandate.
What the measures have to fit
The AI Act does not set a syllabus, does not name a number of training hours and, since 27 July 2026, no longer asks for a sufficient level at all. Art. 4 works relationally: the measures have to take into account the technical knowledge, experience, education and training the people concerned already bring, the context the AI systems are to be used in, and the persons or groups of persons on whom they are to be used. The same tool can therefore call for a short briefing in one team and a substantially deeper treatment in another — but no outcome has to be guaranteed for any individual.
Reference points named by the European Commission
- A general understanding of AI What the systems in use can do, how they arrive at outputs, and where their limits lie.
- Awareness of one's own role Whether the organisation acts as provider or as deployer for the system concerned — the duties that follow differ.
- The risks of the systems actually deployed Not AI risks in the abstract, but those of the concrete systems in use — including automation bias, that is, the tendency to over-trust a machine output.
- Depth tailored to the audience Graduated by prior knowledge and by exposure, rather than one uniform course rolled out across the whole workforce.
The statute does not require a certificate, and no certification body is designated for the purpose. According to the Commission an internal record is sufficient. That is a relief in form only — the substance still has to exist and still has to be capable of being shown. Anyone who cannot say later who was trained on what, when, and on which systems, has organised the measure but not the evidence of it.
A voluntary repository of AI literacy practices is published by the Commission. It collects self-reported examples; replicating them does not give rise to any presumption of conformity, and the Commission neither endorses nor assesses the entries.
Four steps to a record
-
Clarify the AI inventory and the roles
Which AI systems are actually in use, in which processes, and does the organisation act as provider or as deployer for each of them? Shadow use — tools brought in by individual teams without a central decision — belongs in the inventory, because the duty attaches to the use, not to the procurement record.
-
Define target groups and levels of competence
Group the people covered by their exposure: those who merely receive outputs, those who work with the system daily, those who review or override its decisions, and those who procure or configure it. Each group gets its own required level rather than a shared minimum.
-
Deliver the training and document it
Run the measure and record what makes it verifiable afterwards: content, date, systems covered, participants, and the level of competence aimed at. The record is written while the measure runs — reconstructing it later is where the effort actually lands.
-
Maintain the record and follow changes
A new tool, a materially changed model version, a new team or a changed role shifts the required level. The record is therefore a live document with review dates, not a folder closed once.
What we deliver — and what we do not
Regingada UG (haftungsbeschränkt) builds software and takes on appointed EU-representative functions. Legal assessment of the individual case is provided by the law firm Theo Funk under a separate mandate. That boundary also runs through this subject.
Structured stocktaking in the twin
The suite records the AI systems in use, the role held for each of them and the groups of people affected, in a structured form that stays readable back to the norm. That is the raw material for steps 1 and 2 — self-assessment, not an assessment by us.
Evidence documentation as a draft deliverable
From the stocktaking the suite generates a document draft for the internal record. It is marked as a draft. Whether it holds for a concrete company is a legal question, and it is answered by the law firm under a separate mandate, not by the software.
Training content by arrangement
Content for the individual target groups is worked out in coordination with you and tailored to the systems actually in use. Scope, format and delivery are agreed case by case.
What we do not deliver: no certificate from a certification body, no accredited qualification and no seal. The AI Act does not provide for one for Art. 4. What can be produced is a participation and competence record in documentary form for your own file — no more, and it should not be described as more.
Three dates, three different things
Key dates
| Date | What takes effect | Practical consequence |
|---|---|---|
| 02 Feb 2025 | Art. 4 becomes applicable together with the general provisions and the prohibited practices of Art. 5. | The duty has run since then, not only since 2026. Anyone who begins now is starting late by more than a year and a half. |
| 27 Jul 2026 | Regulation (EU) 2026/1744 (OJ 24 July 2026) replaces Art. 4: providers and deployers take measures to support the development of AI literacy, and no specific level has to be guaranteed for any individual. The Commission and the Member States have to support that effort (Art. 4(2)); the AI Board adopts recommendations (Art. 4(3)). | The duty stays, its yardstick drops. Measures and a record remain the task — an outcome owed per person does not. |
| 02 Aug 2026 | The market-surveillance architecture of the AI Act takes hold; national market surveillance authorities become responsible for Art. 4. The penalties of Art. 99 have applied since 2 August 2025; only the Commission's GPAI fines under Art. 101 start on this date. | From that point a supervisory authority can ask about the measure — and the answer is whatever record exists at that moment. |
The reservation that used to stand here has been overtaken by events: the Digital Omnibus was adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. It did not move the general literacy duty away from providers and deployers. It lowered its yardstick to an obligation of effort and added a support duty for the Commission and the Member States, including practical compliance examples on the single information platform under Art. 62(3)(b). The training and instruction obligations tied to high-risk systems under Art. 26 are untouched.
Where to start
The first step costs no decision: find out which role you hold for which system. Everything that follows — level of competence, content, record — depends on that answer.
Orientation, not legal advice
This page and the suite provide orientation and information only. They are not legal advice. Individual-case advice is provided exclusively by the law firm Theo Funk under a separate mandate. Regingada UG (haftungsbeschränkt) — the software company and appointed EU representative — and the law firm are strictly separated.