01. What Article 4 says
Article 4 of the EU AI Act establishes a single, deceptively simple obligation: providers and deployers of AI systems must ensure that staff who use those systems have a "sufficient level of AI literacy."
"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf." — EU AI Act, Article 4
The phrasing is permissive on form ("to their best extent") but absolute on outcome (staff must have sufficient AI literacy). There is no exemption for company size, sector, or AI usage volume.
02. Who it applies to
Almost every European company. Article 4 applies to two categories: providers (companies that build or distribute AI systems) and deployers (companies that use AI systems in their operations, regardless of whether they built them).
In practice, "deployer" includes any company whose employees use ChatGPT, Microsoft Copilot, Google Gemini, GitHub Copilot, Claude, or any other commercially available AI system as part of their work, even casually.
There is no SME exemption. A 5-person startup using ChatGPT has the same obligation as a 5,000-person enterprise. The bar for what counts as "sufficient" scales with company size, but the obligation itself does not.
03. When it took effect
2 February 2025. Unlike most provisions of the AI Act (which have phased rollouts through 2027), Article 4 came into force on this single date with no transition period.
That means companies with employees using AI on 2 February 2025 became non-compliant immediately if they couldn't demonstrate AI literacy measures. Most still cannot.
04. What "AI literacy" means
The Act defines AI literacy as: "the skills, knowledge and understanding that allow providers, deployers and affected persons... to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause."
In practice, regulators expect employees to understand:
- What AI systems can and cannot do reliably
- The risks of inputting confidential or personal data
- How to recognise and handle hallucinated or biased outputs
- When human judgement should override AI recommendations
- The company's specific policies for AI use
Generic ChatGPT productivity courses do not meet this standard. Neither do legal lectures on the AI Act itself. The literacy must be practical and applicable to the actual work the employee does.
05. What you need to document
The Act doesn't specify a documentation format, but enforcement guidance from member states points to four expected artefacts:
- Attendance records showing which employees received training and when.
- Content documentation describing what was covered.
- Internal AI policy communicated to and acknowledged by staff.
- Refresh evidence showing the literacy is maintained as tools and risks evolve.
Article Four engagements produce all four artefacts as standard. If you ever face a regulator inquiry, you hand them a folder.
06. Penalties for non-compliance
Article 4 itself does not carry a fixed penalty. However, non-compliance feeds into broader enforcement actions under the AI Act, which can reach €15 million or 3% of global annual turnover, whichever is higher, for general violations.
More practically, Article 4 non-compliance becomes evidence of negligence in any AI-related incident such as data leak, biased decision, contractual dispute. Companies that cannot demonstrate AI literacy training are in a significantly weaker legal position when something goes wrong.
07. What to do next
Three concrete steps:
- Survey your employees. Ask which AI tools they use, in which workflows, and with what data. You'll be surprised.
- Draft a basic AI policy. What's allowed, what's not, what data must never be entered into public AI tools.
- Run literacy training. Whether through us or someone else, ensure staff understand the policy and the principles behind it. Document attendance.
The bar for "sufficient" is not perfection. It's evidence of reasonable effort. Most companies haven't taken even the first step.