AI literacy

Article 4 is the broadest obligation in the Act and the one most companies have already breached without noticing: it is not limited to high-risk systems, it applies to every provider and deployer, and it has been enforceable since February 2025 — nearly three years before the high-risk regime. It is also the cheapest to fix, which makes it the natural first deliverable of any compliance programme and a strong early signal to a regulator or an enterprise buyer that the programme is real.

A 60-person consultancy uses generative AI across delivery. Article 4 does not mean one generic all-hands: consultants need to understand hallucination, confidentiality and when output must be checked; the engineers integrating models need to understand limitations and evaluation; leadership needs to understand which obligations attach to which systems. Three role-based modules with attendance records, refreshed as the toolset changes, is a defensible programme.

Assuming AI literacy only applies to companies with high-risk systems. It applies to all providers and deployers regardless of risk tier — a company whose entire AI footprint is minimal-risk still owes Article 4, and unlike most of the Act it is already overdue rather than upcoming.

When did the AI literacy obligation start?

2 February 2025, alongside the Article 5 prohibitions. It was one of the first two provisions of the EU AI Act to become applicable.

Does AI literacy require formal certified training?

No. Article 4 requires measures taken to the best extent possible, proportionate to people's existing knowledge and the context of use. Internal role-based training with records of who completed what is generally sufficient; no certification scheme is mandated.

Does it apply to contractors and third parties?

Yes. The duty covers staff and other persons dealing with the operation and use of AI systems on the organisation's behalf, which includes contractors and outsourced teams operating your systems.