AI literacy and EU AI Act Article 4: what SMEs must do

Article 4 of the EU AI Act requires every provider and deployer of AI systems to take measures to support the AI literacy of their staff and of other people using AI on their behalf. Since the Digital Omnibus on AI, you no longer have to reach a "sufficient" level, but the duty to act remains and has been enforceable by national authorities since 2 August 2026. For most SMEs that means a short, role-based programme and a written record.

Key takeaways

• Article 4 of the EU AI Act requires every provider and deployer of AI systems, including SMEs whose staff use ChatGPT, to take measures to support the AI literacy of staff and others using AI on their behalf.
• The Digital Omnibus kept the obligation but removed the requirement to reach a "sufficient" level, so you must act but need not guarantee any individual's competence.
• National market surveillance authorities have been able to supervise and enforce Article 4 since 2 August 2026.
• No certificate is needed: an internal record of training and guidance is what the Commission suggests keeping.
• Deployers of high-risk systems still need properly trained human oversight staff, a separate and stricter duty.

What does AI literacy under EU AI Act Article 4 actually say now?

The amended Article 4 has three parts. Providers and deployers of AI systems "shall take measures to support the development of AI literacy of their staff" and other persons dealing with AI on their behalf; this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The Commission publishes practical examples, particularly for SMEs, and the AI Board adopts recommendations. That is the text in Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

The original 2024 text required measures to ensure "a sufficient level of AI literacy". Recital 8 of the Omnibus explains the change: a strict obligation created an additional compliance burden, particularly for smaller enterprises. The Commission's AI talent and literacy page summarises the result plainly: "AI literacy remains an obligation for providers and deployers of AI systems," but no specific or sufficient level is mandated.

Article 3(56) of the consolidated text defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make informed use of AI systems and to be aware of their opportunities, risks and possible harms.

Who has to comply?

Every organisation that provides or deploys an AI system in a professional context. The Commission's AI literacy Q&A gives a direct example: a company whose employees use ChatGPT to write advertising copy or translate text must comply, and should tell staff about specific risks such as hallucination. If you are not sure whether your business is in scope at all, see does the EU AI Act apply to my small business.

"Other persons" is wider than employees. The Commission says it can include contractors, service providers and, depending on the risk, clients who operate AI systems under your remit.

When did it start, and who enforces it?

Article 4 has applied since 2 February 2025, and the Omnibus did not change that date in the consolidated Article 113. National market surveillance authorities started supervising and enforcing it on 2 August 2026, according to the Commission. In Ireland, the AI Office of Ireland coordinates the sectoral regulators that act as competent authorities. The full sequence of dates is in our EU AI Act timeline.

How do I build an AI literacy programme in seven steps?

The Commission's Q&A suggests that organisations cover four things: a general understanding of AI in the organisation, whether the organisation is a provider or deployer, the risks of the AI systems in use, and measures tailored to staff knowledge and the context of use. These steps turn that into a plan.

1. List the AI in use. Include approved tools, AI features inside software you already pay for (CRM, helpdesk, office suites) and anything you build. Ask teams what they use without approval.
2. Note your role for each system. Provider if you build or brand it, deployer if you use it. Providers need deeper technical literacy among the people building the system.
3. Group people by exposure. For example: everyone who uses general AI assistants; people making decisions with AI output (hiring, pricing, credit, customer complaints); people building or configuring AI; and management.
4. Set what each group needs to know. Baseline for all: what the tool does, its known failure modes (invented facts, bias, outdated information), what data must never be pasted in, and when a human must check output. Add role-specific content on top.
5. Choose light formats. A 45 to 90 minute session, a one-page acceptable-use policy and a short refresher when tools change will cover most small teams. Legal and ethical points, including the AI Act itself, are encouraged by the Commission but need not dominate.
6. Keep a record. Note who received what and when, plus the policy version. The Commission confirms no certificate is needed; an internal record of training and guidance is sufficient evidence of the measures you took.
7. Review twice a year. New tools, new uses and new staff are the usual triggers.

What extra applies if we use high-risk AI?

A stricter, separate duty. The Commission notes that deployers of high-risk systems must still ensure staff are trained for human oversight, and Article 26 of the AI Act requires deployers to assign oversight to people with the necessary competence, training and authority. For Annex III systems such as recruitment screening, that obligation applies from 2 December 2027. If you are designing AI features that hand decisions back to people, our piece on human-in-the-loop AI covers the design side.

Why is AI literacy worth doing well, beyond compliance?

Because lack of skills is the main brake on AI adoption. Eurostat found that among EU enterprises that had considered AI but not used it, 70.89% cited a lack of relevant expertise and 52.52% cited uncertainty about legal consequences. A practical programme answers both: staff learn what the tools can safely do and what the rules ask.

AI literacy checklist you can use today

• [ ] Inventory of AI tools and features in use, with an owner for each
• [ ] Role recorded per system: provider or deployer
• [ ] Staff grouped by exposure level
• [ ] Baseline session delivered to everyone using AI at work
• [ ] Extra material for decision-makers and builders
• [ ] Acceptable-use policy covering data input and human checking
• [ ] Contractors who use AI on your behalf briefed
• [ ] Training record kept (names, dates, content, policy version)
• [ ] Human oversight training planned for any high-risk system
• [ ] Review date set for six months' time

Frequently asked questions

Is AI literacy training mandatory under the AI Act?

Taking measures is mandatory; a specific training course is not. The Commission's Q&A says there is no one-size-fits-all approach and no mandatory training format, but relying only on a tool's instructions for use is often insufficient. Most SMEs meet the duty with short, role-based sessions and written guidance.

Does Article 4 apply to contractors and freelancers?

It can. The obligation covers staff and other persons dealing with the operation and use of AI systems on your behalf. The Commission says these may include contractors, service providers or even clients, depending on the context.

What is the fine for not complying with Article 4?

The AI Act does not set a specific fine for Article 4. Penalties and other enforcement measures are set by Member States under national law and must be proportionate. In practice, weak AI literacy is most likely to surface alongside another problem, such as a transparency failure or a harmful incident.

Did the Digital Omnibus remove the AI literacy obligation?

No. An earlier proposal would have shifted the duty to Member States and the Commission, but the adopted Regulation (EU) 2026/1744 keeps it as an obligation on providers and deployers. What changed is that no specific or sufficient level of literacy is mandated.

Do I need a certificate to prove AI literacy?

No. The Commission states that no certificate is needed and suggests keeping an internal record of trainings or other guidance initiatives. Following examples from the Commission's repository of AI literacy practices does not automatically give a presumption of compliance.

If you want help scoping AI literacy around the specific tools and products your team uses, book a free 30-minute call.

Cover photo by Matheus Bertelli on Pexels.