The AI Literacy Obligation

The legal framework

Article 4 of the AI Act (Regulation (EU) 2024/1689) has applied since 2 February 2025. Unlike most of the Act, it is not limited to high-risk systems. It applies to every provider and deployer of an AI system, including a company that only uses a generative AI tool in its daily work.

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of the opportunities and risks of AI and the possible harm it can cause.

What the text now says

As originally adopted, Article 4 required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with AI systems on their behalf. They had to take into account the technical knowledge, experience, education and training of these persons, the context in which the systems are used, and the persons on whom they are used.

Regulation (EU) 2026/1744, in force since 27 July 2026, replaced this wording. Providers and deployers must now take measures to promote AI literacy, and the Commission and the Member States have to support them, in particular SMEs. The amendment no longer requires that a specific level of literacy is guaranteed for each individual. Check the consolidated text on EUR-Lex before you rely on the exact wording.

Enforcement

Article 4 itself has no dedicated fine in the AI Act. Member States set penalties for infringements of the Act, and the way a company handled literacy can be relevant if something goes wrong: a failure caused by untrained staff will be viewed differently from one that happened despite documented training. National rules on liability, employment and data protection continue to apply alongside it.

In practice

A Bruges accounting firm lets its staff use a generative AI assistant to draft client letters. There is no high-risk system, but staff must understand that outputs can be wrong or invented, what client data may not be entered, and when output must be checked. A short training, a written usage policy and an attendance record meet the expectation. A staff member who pastes a client's file into a public tool without knowing the risk is the situation the rule is meant to prevent.

A manufacturer uses AI for quality inspection on the production line. The operators who act on its alerts need to know what the system does, how reliable it is and when to override it. This training differs from that for the office staff and should be proportionate to the role.

A scale-up in Leuven that provides an AI-based HR tool also owes literacy measures for its own developers and support staff, and has to supply deployers with the information they need to train their users.

A reasonable programme has these elements:

• an inventory of who uses which AI systems;
• role-based training content, for example basics for all staff and deeper content for those who oversee high-risk systems;
• a usage policy for generative AI tools;
• records of training and updates when tools or rules change.

Our AI Act register lists the systems and their users, which is the starting point for deciding who needs which training. Where tools process personal data, the records of processing show what staff may enter.

In a company that has no written policy on generative AI at all, the first practical step is usually modest: a one-page usage policy, a one-hour session for everyone, and an owner who keeps the inventory up to date. That is far better than a long programme that nobody follows, and it gives you something to show if a customer or authority asks.

Frequently asked questions

Do we have to certify our staff?

No. The AI Act does not prescribe a certificate or a fixed curriculum. What counts is that your measures are appropriate and documented.

Does the obligation apply to a one-person company?

Yes, for professional use, though the measures can be very light.

Does it also cover contractors?

Article 4 refers to staff and other persons dealing with AI systems on your behalf, which can include contractors and temporary workers.

Does the 2026 amendment mean we can stop?

No. The duty to take measures remains. What changed is how strictly the result is defined.

How this connects

Literacy is part of a wider AI governance framework, and our AI Act compliance service includes a literacy plan. For the overall dates, see the timeline.