AI literacy: the Article 4 obligation everyone forgets
In short
Article 4 is the broadest-reaching obligation in the entire Act, and the one most often overlooked, because it is not tied to a single document, a specific system, or a defined risk tier. It has applied since 2 February 2025, alongside the Article 5 prohibitions, well before most of the Act’s other obligations take effect.
What it requires
Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training, and the context the AI systems are used in.
Applies regardless of risk tier or company size
Unlike most of the Act’s substantive obligations, Article 4 is not conditioned on a system being high-risk, limited-risk, or any particular size of organisation. A company using only minimal-risk internal tools still carries this duty for the staff operating those tools, it is a baseline organisational obligation, not a system-specific one.
'Best extent' means role-appropriate, not one-size-fits-all
The Act explicitly ties the required level of literacy to each group’s existing technical knowledge and the specific context of use, a single generic training module delivered to the whole company does not reflect what “to their best extent” is asking for. A team operating a high-risk hiring tool needs materially different training from a general staff population using an AI writing assistant.
Who counts as 'staff'
This extends beyond direct employees to contractors and vendor staff who operate or rely on the AI system on the organisation’s behalf. A company that outsources the operation of an AI system to a third-party team still carries responsibility for that team’s AI literacy under this article.
Evidence, not intent
Because there is no dedicated document Article 4 requires, the practical evidence of compliance is a training record: who was trained, on what, and when. “To their best extent” is the Act’s own standard, a record is what lets an organisation actually demonstrate it met that standard, rather than asserting it did.
Training also needs to be refreshed when a system changes materially, or when new staff take on a role involving it, this is a standing obligation, not a one-time induction session completed once and never revisited.
Frequently asked questions
- When did the AI literacy obligation take effect?
- Article 4 has applied since 2 February 2025, alongside the Article 5 prohibitions, well before most of the Act's other obligations take effect.
- Does AI literacy apply to minimal-risk AI or small companies?
- Yes. Article 4 is not conditioned on a system being high-risk or on company size, a company using only minimal-risk internal tools still carries the duty for the staff operating them. It is a baseline organisational obligation.
- Who counts as staff for the AI literacy obligation?
- It extends beyond direct employees to contractors and vendor staff who operate or rely on the AI system on the organisation's behalf. Outsourcing operation to a third-party team does not remove responsibility for that team's AI literacy.
- How do you demonstrate AI literacy compliance?
- Because Article 4 requires no dedicated document, the practical evidence is a training record (who was trained, on what, and when) refreshed when a system changes materially or new staff take on a role involving it.
Related guides
Not sure where your company stands?
Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.
Start the free check