AI literacy under Article 4 of the EU AI Act

In short

Article 4 of the EU AI Act, Regulation (EU) 2024/1689, is about AI literacy. The AI Act is a regulation, directly applicable in every member state, so the duty is the same wherever in the EU you are. Article 4 has applied since 2 February 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and rewrote it: providers and deployers of AI systems must take measures to support the development of AI literacy among their staff. A specific level of literacy is no longer required.

Much of what is written about Article 4 still quotes the original wording, which required measures to ensure, to the best extent, a sufficient level of AI literacy. That wording no longer applies. The duty remains, but it has moved from an obligation of result to an obligation of effort: you must act, but you do not have to guarantee a level for each employee.

What AI literacy means

Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems, and to gain awareness of the opportunities and risks of AI and the harm it can cause.

At work that is concrete. An employee knows that a language model can invent a source or a figure, knows what information may and may not be pasted into a tool, checks the output before sending it to a customer, and recognises when a use of AI is prohibited or has to be disclosed.

Who Article 4 applies to

Article 4 applies to providers and deployers of AI systems. A deployer is anyone using an AI system under its authority, except for personal, non-professional activity (Article 3(4)). If your staff use ChatGPT, Copilot or customer-service software with AI features at work, your organisation is very likely a deployer.

The measures cover staff and other persons dealing with the operation and use of AI systems on your behalf. Article 4 looks at neither sector nor size, so it reaches a small company that uses AI at work.

What the Digital Omnibus changed

The original Article 4 asked for measures to ensure, to the best extent, a sufficient level of AI literacy. The amended Article 4 asks for measures to support the development of AI literacy, and the sufficient-level requirement is gone. The amended Article also calls on the Commission and the Member States to support providers' and deployers' efforts, for example by publishing practical examples.

The change does not remove the duty. An organisation that has done nothing does not meet the new wording either. What changes is the standard: you must take supporting measures, not guarantee a level for each person. That is our reading: the duty moved from an obligation of result to one of effort.

Supervision and penalties

Supervision and enforcement of Article 4 began in August 2026. Article 99 sets no EU-level fine for Article 4, but it lets Member States lay down penalties for it. An authority fining another breach can take into account the technical and organisational measures an organisation has implemented (Article 99(7)(g)).

Which authority supervises, and whether there is any national penalty, therefore depends on your country. Finland is one example: its national act (1377/2025), in force since 1 January 2026, gives supervision of the Article 5 prohibitions to the Data Protection Ombudsman and of the Article 50 transparency obligations to Traficom. It names no authority and no penalty for Article 4, so Finland has not used that option. AI literacy still matters in practice: staff who do not know the Article 5 prohibitions cannot avoid them.

What to do in practice

The Commission's AI literacy questions and answers say that no certificate is needed; organisations can keep an internal record of training and other guidance. A sensible programme is light but planned.

• Map which AI tools are used and by whom
• Distinguish roles: everyday users, those who buy or deploy AI, and those who build it need different things
• Teach the basics: how language models work, why they get things wrong, how to check output
• Set rules for data: what confidential or personal data must not be entered
• Cover the prohibited practices (Article 5) and transparency duties (Article 50) where they touch your work
• Record what you did, with dates, and update it when tools or rules change

Related AI Act dates

The Article 50 transparency obligations have applied since 2 August 2026, though generative systems already on the market before then have until 2 December 2026 to add the Article 50(2) marking. They include disclosure of deepfakes by deployers (Article 50(4)). After the Omnibus, the high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. An employer putting a high-risk system into use at the workplace must inform workers and their representatives beforehand (Article 26(7)).

How Cyberact helps

Cyberact has its own AI path: how models work, where they fail, how to use them safely and what the AI Act asks in practice, in two-minute lessons in Finnish and English. The manager console records what was done, with dates. Start for free at cyberact.io: your account is ready at once.

Sources

Checked against primary sources on 24 September 2026.

• AI Act, Regulation (EU) 2024/1689, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• Digital Omnibus on AI, Regulation (EU) 2026/1744, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
• Act on the Supervision of Certain AI Systems 1377/2025 (Finnish), Finlex: https://www.finlex.fi/fi/lainsaadanto/2025/1377
• European Commission, AI literacy – questions and answers: https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
• Commission AI Act Service Desk (the Article 4 page still shows the pre-Omnibus text): https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4