AI Literacy: What Article 4 of the AI Act Requires
by Salvatore Croce · Published 30 October 2026 · 3 min read
Article 4 of the AI Act covers AI literacy: providers and deployers of AI systems must take measures to develop the AI skills of their staff and of the people acting on their behalf. It has applied since 2 February 2025. The Digital Omnibus (Regulation (EU) 2026/1744) reworded the duty as taking measures to support these skills, without guaranteeing a specific level.
What AI literacy is
AI literacy means the skills, knowledge and understanding that let people use AI in an informed way: knowing roughly how it works, what it can do, what risks it carries and how to assess its results. It does not mean knowing how to code.
Who it applies to
The duty applies to providers and deployers of AI systems. So it is not only for technology companies: an organisation that uses tools such as ChatGPT or Copilot in daily work is a deployer. The measures must cover employees and other people acting on the organisation's behalf, such as consultants and contractors.
What the Digital Omnibus changed
According to the analyses available, the original wording asked organisations to ensure, to their best extent, a sufficient level of skills. After the Digital Omnibus, in force since 27 July 2026, the text speaks of taking measures to support the development of AI literacy. The duty was not postponed: it was reworded. Check the consolidated text on EUR-Lex.
What it does not require
- No mandatory certification and no standard course.
- No uniform level for everyone: measures must be proportionate to role, knowledge, experience and context of use.
- No guarantee of results on individual competence: what counts is the measures taken.
How to build a programme, in five steps
- Map the uses: which AI tools people use and for which tasks.
- Define levels: basic for everyone, practical for those who use the tools every day, advanced for those who decide, buy or manage risks.
- Train in a targeted way: what AI is, limits and hallucinations, data protection, internal rules of use.
- Write a clear policy: what can go into prompts, which tools are approved, who checks the results.
- Document and update: who followed what and when, with a periodic review.
Why do it even if the duty is softer
The concrete risks do not depend on how the article is worded: undetected errors, confidential data entered into unapproved tools, decisions made on invented answers. People who understand what AI does and where it fails are the first form of governance, and the basis for the rest of the compliance path.
Frequently asked questions
Since when does the AI literacy duty apply?
Since 2 February 2025. The 2026 Digital Omnibus reworded its content but did not move its date of application.
Do I need a certificate to comply?
No. The AI Act sets no mandatory certificate or standard course: measures must be proportionate to roles, skills and context.
What are the penalties for Article 4?
The regulation does not set a specific amount for Article 4: enforcement is up to national authorities and each Member State's rules. Check the situation in your country.
Does it apply if we only use ChatGPT at work?
Yes, because the organisation is a deployer of AI systems. Measures must be proportionate to the use, so for simple use they can be light.
Want to go deeper?
Keep reading
Don't miss the next issues
An occasional email with a selection of the most relevant AI and regulation developments, from my vantage point.