Article 4 of the EU AI Act requires every company that builds or uses AI systems to take measures that develop the AI literacy of its staff and of others who operate those systems on its behalf. The duty has applied since 2 February 2025. Since 27 July 2026 it no longer demands a guaranteed "sufficient level", but you still need training that fits each role and records that show it happened.
Key points
- Article 4 covers providers and deployers. A company whose staff use ChatGPT, Copilot or Gemini for work is a deployer, so the duty reaches almost every employer in the EU.
- "Staff and other persons" includes contractors, freelancers and service providers who use AI systems on your behalf.
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote Article 4 from "ensure a sufficient level" to "support the development" of AI literacy. The obligation itself stayed, with no delay.
- No certificate is required. The European Commission says an internal record of training and other measures is enough as evidence.
- In Norway the AI Act is not yet part of the EEA Agreement or Norwegian law. Norwegian groups with EU entities, or whose AI output is used in the EU, can still be covered.
This article explains the rules as published up to October 2026. It is not legal advice. Check the current text on EUR-Lex and, for your own situation, ask a lawyer.
What does Article 4 of the AI Act actually say?
Article 4 of the AI Act says that providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The measures must take into account those people's technical knowledge, experience, education and training, the context the AI systems are used in, and the people the systems are used on.
The AI Act, Regulation (EU) 2024/1689, defines AI literacy in Article 3(56) as the skills, knowledge and understanding that let providers, deployers and affected persons make an informed deployment of AI systems and gain awareness of the opportunities and risks of AI and the harm it can cause. Put plainly, people who use AI at work should know what the tool does, where it fails, what data they may put into it and when a person has to check the output.
The article has been amended once. The table shows the two versions side by side.
| Element | Original Article 4 (2 Feb 2025 to 26 Jul 2026) | Amended Article 4 (from 27 Jul 2026) |
|---|---|---|
| Core duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Who must act | Providers and deployers | Providers and deployers (unchanged) |
| Whose literacy | Staff and other persons operating or using AI systems on their behalf | Unchanged |
| Factors to consider | Technical knowledge, experience, education, training, context of use, affected persons | Unchanged |
| Level of literacy | "Sufficient level", undefined | No specific level for any individual has to be guaranteed |
| Support from authorities | Not in the article | Commission and Member States support organisations, especially SMEs; the Commission publishes compliance examples; the AI Board adopts recommendations |
Who does the AI literacy duty apply to?
The AI literacy duty applies to providers and deployers of AI systems, whatever their size or sector. A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name. A deployer is any organisation that uses an AI system under its authority in a professional context.
The deployer category is what makes Article 4 an employer issue. The European Commission's Q&A gives the example of a company whose employees use ChatGPT to write advertising copy or translate text: that company is covered, and its staff should at least understand risks such as hallucinated facts. You do not need to have bought an enterprise AI platform. If people use a general-purpose assistant for work tasks with your knowledge, treat yourself as a deployer.
"Other persons" widens the circle. The Commission names contractors, service providers and even clients when they operate AI systems on your behalf. A freelance copywriter producing drafts with an AI tool for your campaigns, or an outsourced support team answering customers through your chatbot, falls inside your Article 4 measures.
Territorial scope follows Article 2 of the AI Act. Deployers established or located in the EU are covered, and providers and deployers outside the EU are covered where the output of their AI system is used in the EU. That second rule matters for Norwegian and other non-EU companies, as the Norway section below explains.
Since when has Article 4 applied, and who enforces it?
Article 4 has applied since 2 February 2025, together with the bans on prohibited AI practices in Article 5. Supervision and enforcement by national market surveillance authorities started in August 2026: the Commission's Q&A gives 2 August 2026 in one answer and 3 August 2026 in another. For eighteen months the duty applied without national supervision.
Article 4 is not on the list of infringements with fixed maximum fines in Article 99 of the AI Act. Each Member State sets its own penalties, which must be effective, proportionate and dissuasive, and the Commission notes that authorities weigh the nature, gravity and intent or negligence of an infringement. In practice the bigger exposure is indirect: if an employee misuses an AI tool and harm follows, a missing training record makes it hard to show that you took any measures at all. The Commission says enforcement is more likely where there is proof of an incident caused by a lack of appropriate training.
What did the Digital Omnibus change in Article 4?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced the "sufficient level" wording with a duty to support the development of AI literacy and added that no specific level has to be guaranteed for any individual. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, with no transition period for Article 4.
The Commission's proposal of 19 November 2025 (COM(2025) 836) would have turned Article 4 into a duty on the Commission and Member States to encourage providers and deployers to act. The final text kept the duty with providers and deployers. Three things changed:
- The benchmark of a "sufficient level" is gone, and the article now states that companies do not have to guarantee a specific level of AI literacy for any individual.
- A new paragraph asks the Commission and Member States to support providers and deployers, with SMEs singled out, and has the Commission publish practical compliance examples on the AI Act Single Information Platform.
- The European AI Board must adopt recommendations on AI literacy that take European competence frameworks into account and set common objectives. Recital 8 of the amending regulation names the Digital Competence Framework for Citizens (DigComp) as an example.
Several things did not change. You still have to take measures, they must still fit people's knowledge and the context of use, and deployers of high-risk AI systems still have a separate, stricter duty in Article 26(2) to assign human oversight to people with the necessary competence, training and authority. The Omnibus moved the start of most high-risk obligations to 2 December 2027 for Annex III systems (which include AI used in recruitment and staff management) and 2 August 2028 for AI built into products under Annex I.
The NicFab blog on AI and data protection law argues the change makes compliance harder to prove, not easier. With no target level to point to, the evidence becomes the measures themselves and your reasons for choosing them.
What does an appropriate level of AI literacy look like in practice?
An appropriate level of AI literacy means each person knows enough about the specific AI systems they touch to use them safely in their own job. The Commission's Q&A suggests four steps: map which AI systems the organisation uses, establish whether you are a provider or a deployer, assess the risks of those systems, and tailor the measures to people's existing knowledge and context.
That points to tiers. A receptionist who uses an AI meeting summariser twice a week needs a different programme from an HR officer screening applicants with an AI ranking tool. The table is a starting point you can adjust; it is an interpretation of the Commission's guidance, not a legal standard.
| Tier | Who | Typical AI use | What they need to understand | Evidence to keep |
|---|---|---|---|---|
| 1. Everyone | All staff, including those who rarely use AI | Occasional assistant use, AI features in office software | What AI is and is not, the company AI policy, which tools are approved, what data must never go in, how to report a problem | Attendance or completion record, signed policy acknowledgement |
| 2. Regular users | Marketing, sales, support, finance, analysts | Drafting, summarising, translating, analysis with ChatGPT, Copilot, Gemini or Claude | Prompting for their tasks, checking facts and sources, hallucination, bias, copyright and personal data in their own work | Role-based training plan, practical assignments, assessment or feedback, refresher dates |
| 3. Decision-adjacent users | HR, credit, customer eligibility, anyone whose AI output affects individuals | Scoring, ranking or recommending about people | System limits, error rates the vendor documents, human oversight duties, GDPR Article 22, when to override | Vendor instructions read and signed, oversight procedure, named responsible person |
| 4. Builders and owners | Developers, data and IT staff, system owners, managers who buy AI | Integrating models via API, configuring agents and chatbots | Provider vs deployer status, transparency duties, testing, logging, security, prompt injection | Technical training records, risk assessments, system register |
Two points shape the content. First, training has to be about the tools people actually use, so a generic video course on "what is machine learning" rarely does the job alone. Our guide to choosing AI tools for business helps you build the inventory that the training then covers. Second, practical skill counts. Writing a clear instruction, checking the answer and knowing when to stop are the skills that prevent most incidents, which is why a solid grounding in prompt engineering belongs in tier 2.
What documentation counts as evidence of AI literacy?
Documentation of AI literacy is an internal record showing which measures you took, for whom, when and why they suit each group. The Commission's Q&A says no certificate is needed and Article 4 does not require you to measure employees' knowledge, but it expects organisations to be able to show what they did.
A record that will hold up usually contains:
- An AI system register: tool name, vendor, purpose, which teams use it, whether you are provider or deployer, and a short risk note.
- An AI use policy with approved tools, banned data categories (customer personal data, health data, unpublished financials) and a reporting route.
- A training matrix linking each role to its tier, the content covered and the dates of first training and refreshers.
- Completion records, including for contractors and temporary staff.
- Results of practical tasks or assessments where you run them. Not required by the text, but the clearest proof that the measures worked.
- A short rationale for why you chose these measures, written with the factors in Article 4 in mind.
The Commission also keeps a living repository of AI literacy practices, collected first from AI Pact pledgers and later from other organisations. It is useful for ideas, but the Commission states that copying a practice does not automatically give a presumption of compliance.
Example
A fictional 60-person distribution company has its head office in Oslo and a sales subsidiary in Gothenburg. Forty-five employees use an AI assistant for e-mails, offers and translations. Four people in HR trial a CV-screening tool, and three developers have built a customer chatbot on a model API. The Swedish subsidiary is an EU deployer, so Article 4 applies to it directly.
The company maps eight AI tools in a register. All 60 people get a 90-minute introduction and sign the AI policy (tier 1). The 45 regular users follow a six-week programme with one assignment a week built on their own tasks (tier 2). The four HR users read the vendor's instructions, write an override procedure and pause the trial until they have checked it against the high-risk rules that apply from 2 December 2027 (tier 3). The three developers cover chatbot disclosure, logging and prompt injection (tier 4). Each completion goes into the training matrix with a refresher date twelve months later.
Does Article 4 apply to companies in Norway?
As of October 2026 the AI Act, including Article 4, is not yet incorporated into the EEA Agreement or implemented in Norwegian law, so it does not apply generally to Norwegian companies. It can still apply where a Norwegian group has an entity in the EU or where the output of its AI system is used in the EU.
The Norwegian government sent a draft AI act (KI-loven) on consultation on 30 June 2025, with Nkom designated as the coordinating AI supervisory authority and a planned start in late summer 2026. That plan slipped. On 4 August 2026 the government said it would send a revised draft, reflecting the Digital Omnibus changes, on a new consultation in the autumn, and Karianne Tung, then minister of digitalisation and public governance, said her ambition was to present the bill to the Storting in spring 2027. Torgeir Micaelsen took over the ministry on 11 September 2026. No date for entry into force has been set.
Watch out
Do not read "not yet in force in Norway" as "nothing to do". Nkom points out that Norwegian rules on privacy, marketing and criminal law already apply to AI use, and GDPR, supervised by Datatilsynet, governs any personal data staff put into AI tools. Datatilsynet itself says AI is regulated by both the GDPR and the AI Act. Training people now is easier than retrofitting a programme once the Norwegian act applies, and it covers any EU entities straight away. Check regjeringen.no and nkom.no for the current status before relying on any date here.
What should employers do now? A checklist
Employers should map their AI systems, set a policy, train by role and keep records, then review the programme at least once a year. The steps below follow that order and fit a company of 10 or 1 000 people; only the depth changes.
- Name an owner. One person, often in operations, HR or legal, owns the AI literacy programme and the register.
- Build the AI system register. Ask every team which AI tools they use, including free assistants and AI features switched on inside existing software. Note the vendor, purpose and users.
- Decide provider or deployer for each system. Most companies are deployers. If you build an AI product or chatbot and offer it under your own name, you may also be a provider, with more duties.
- Write or update the AI use policy. Approved tools, banned data, when output must be checked by a person, how to disclose AI use to customers, and who to ask. Keep it to two pages.
- Assign each role to a tier. Use the table above. Flag anyone whose AI output affects decisions about people.
- Train with real tasks. Short introductions for everyone, then practical, role-based sessions where people work on their own tasks. Our guide to AI automation shows which workflows are worth teaching first.
- Include contractors. Add AI literacy to supplier and freelance contracts, or give them access to the same training.
- Record everything. Training matrix, completion dates, materials, assessment results and your rationale. Store it where an auditor or a new manager can find it.
- Review on change. Revisit the programme when you add a tool, change a vendor or a model changes behaviour, and at least once a year.
If you are comparing assistants before rolling one out, our comparison of ChatGPT, Claude and Gemini covers data handling and business plans, which feed straight into your policy. To put numbers on the value of the programme, use the method in our AI ROI calculation guide.
For teams that want structured help, LeapJet's AI training for teams runs as a multi-week programme, typically six to eight weeks, with one live session and one assignment a week built from each participant's real work. Each assignment is scored on whether the result is correct, whether the right tool was used, whether sensitive information was handled properly and whether the method can be reused, and the manager receives a team-level report at the end. That gives you training and a record in one; whether it meets your legal obligations is still a question for your own legal assessment.
Frequently asked questions
Is AI literacy training mandatory under the EU AI Act?
Article 4 requires providers and deployers to take measures that support the AI literacy of staff and others using AI on their behalf. Training is the most common measure, but the law does not prescribe a format. Guidance, mentoring and practical exercises can count if they fit the role and are recorded.
Do we need an AI literacy certificate?
No. The European Commission states that no certificate is required. An internal record of the training and other measures you took, and for whom, is what you should be able to show.
Does using ChatGPT at work make us subject to Article 4?
Yes, if your company is established in the EU or the output is used in the EU. Using an AI system for work under your authority makes you a deployer. The Commission's own example is a company whose staff use ChatGPT to write advertising copy.
What are the fines for breaching Article 4?
The AI Act sets no fixed fine for Article 4. Member States decide penalties in national law, and national market surveillance authorities enforce from August 2026. Authorities must consider the nature, gravity and intent or negligence of an infringement.
Did the Digital Omnibus remove the AI literacy obligation?
No. Regulation (EU) 2026/1744 softened the wording from ensuring "a sufficient level" to supporting the development of AI literacy, and removed any guaranteed individual level. Providers and deployers must still take measures, from 27 July 2026 onwards as before.
When will the AI Act apply in Norway?
No date is set. The government plans a new consultation on the Norwegian AI act in autumn 2026 and aims to present a bill to the Storting in spring 2027. The regulation also has to be incorporated into the EEA Agreement first.
Sources
- EUR-Lex: Regulation (EU) 2024/1689, the Artificial Intelligence Act (2024)
- EUR-Lex: Regulation (EU) 2026/1744, Digital Omnibus on AI (OJ L, 24 July 2026)
- EUR-Lex: Commission proposal COM(2025) 836, Digital Omnibus on AI (19 November 2025)
- European Commission: AI literacy, questions and answers (updated 27 July 2026)
- European Commission: Living repository of AI literacy practices (updated 10 August 2026)
- Regjeringen: Lov om kunstig intelligens i Norge sendes nå på høring (30 June 2025)
- Regjeringen: Tung vil sende KI-loven med endringer på høring (4 August 2026)
- Regjeringen: Digitaliserings- og forvaltningsminister Torgeir Micaelsen (took office 11 September 2026)
- Nkom: Nkom får hovedansvar for nye lover om digitale tjenester og KI (4 July 2025)
- Nkom: Nye krav til KI-merking i EU, hva betyr dette for Norge? (10 August 2026)
- Datatilsynet: Bruk og håndheving av kunstig intelligens (21 March 2025)
- AI Act Explorer: Article 4, AI literacy, amended text
- Lewis Silkin: The Digital Omnibus on AI enters into force today (27 July 2026)
- NicFab: Article 4 of the AI Act has lost its benchmark (7 September 2026)
- KI-Campus: AI Omnibus recalibrates Article 4, AI literacy remains mandatory (28 July 2026)
- Digi.no / NTB: Nye EU-regler for KI, Norge og EØS henger ennå langt etter (2 August 2026)
