The ability to understand, critically evaluate, and responsibly deploy AI
Article 4 of the EU AI Act has applied since 2 February 2025. Since 27 July 2026, providers and deployers must take measures to support the development of AI literacy. Those measures should reflect technical knowledge, experience, education, the context of use and affected persons. The law does not require a specific individual level, standard course or certificate.
In short: Article 4 has applied since 2 February 2025 and since 27 July 2026 it is a duty to take measures. Providers and deployers take measures that support the development of AI literacy among their staff and other persons working with AI systems on their behalf. They do not have to guarantee any specific level per person. There is no mandatory course, no minimum number of hours, no certificate and no mandatory AI officer. What counts is that the measures fit the role, context and risk, and that you can explain what you did.
By Zahed Ashkara, lawyer, AI and privacy consultant. Legally reviewed on 30 July 2026. Content updated on 10 October 2026.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, rewrote Article 4. The original text asked organisations to ensure, to their best extent, that their staff were AI literate to a level that was sufficient. That placed a result on the organisation, while nobody could say what sufficient means for a recruiter, a lawyer or a data engineer. The current text focuses on what you do.
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
| Element | Text of 2 February 2025 | Text since 27 July 2026 |
|---|---|---|
| Type of duty | Ensure that the level of staff is sufficient | Take measures that support the development of AI literacy |
| What you are judged on | The outcome: the level of knowledge | What you did and whether it fitted role, context and risk |
| Level per person | Implicitly expected | Expressly not required |
| Who | Providers and deployers | Unchanged: providers and deployers |
The duty still exists and still rests directly on providers and deployers. Article 4 has not been repealed and has not been postponed. What disappeared is the expectation of a guaranteed level per person. Two public tasks are new: the Commission publishes practical examples of compliance (paragraph 2) and the AI Board adopts recommendations based on European competence frameworks (paragraph 3). Those tasks come on top of the organisation's duty and do not replace it.
There is no specific, automatic Article 4 fine. National supervisors can apply proportionate measures or sanctions within their own legal framework. So do not treat Article 4 as a fine question, but as part of responsible AI use, risk management and, for high-risk systems, human oversight (Article 14).
According to the AI Act Service Desk timeline, supervision of Article 4 by national authorities started on 2 August 2026. AI Act Service Desk
The European Commission's questions and answers on AI literacy are the safe basis for implementation. They show what is not mandatory:
Training and guidance can be organised flexibly: per role, per context, per tool and by risk. Work instructions, practical exercises and an internal help desk also count when they fit the role. An internal record of training and guidance can serve as evidence.
Article 4 can also apply when staff only use a general AI assistant such as ChatGPT or Copilot. The Commission notes that staff should then be informed about specific risks, such as hallucinations.
Sources for this part: European Commission, AI Literacy Questions & Answers
The Dutch Data Protection Authority describes an ongoing cycle: identify, set goals, implement and evaluate. With one extra step, recording, it becomes an approach you can also show.
Which AI systems and AI tools are in use, for what purpose, with which data and by whom? Start from the work and the decisions, not from a course catalogue. Include suppliers, contractors and partners who work with AI on your behalf.
A recruiter using AI in selection must recognise different risks than a marketer generating copy. Record per role which knowledge is appropriate and explain that choice. That reasoning is what a supervisor can assess.
Combine short, role-based training with work instructions, practical cases, a help desk and AI in onboarding. One e-learning for everyone changes little behaviour.
Keep track of which measure was taken for which role, when, and what happened with those who fell behind. Recording is the way to make it demonstrable, not a form prescribed by law.
Discuss progress with management periodically and look again when a new system, a new role or an incident appears. AI literacy is not a one-off project.
These steps are a practical elaboration, not a legal sequence. The law asks for appropriate measures; you choose the form. Dutch Data Protection Authority, Getting started with AI literacy
Policy becomes testable when it links three things. That follows directly from the factors Article 4 names.
Who uses, manages, develops, reviews or decides with AI? Take account of their technical knowledge, experience and education.
What is the system used for, with which data and how autonomously does it work?
Who is affected by the outcome? A role that decides about people in HR, healthcare, education or public services needs more depth than a role using AI for drafting.
| Role | Responsibility |
|---|---|
| Board | Sets direction, frees up resources and reviews progress periodically. |
| AI governance group | Translates the direction into roles and arrangements (legal, privacy, security, data, HR and the business). |
| Team leads | Make it concrete in processes and on-the-job learning. |
| HR and L&D | Keep learning paths current and track participation and effect. |
Article 4 also covers other persons who operate and use AI systems on behalf of the organisation. Whether a measure is appropriate for a supplier, contractor or partner depends on the task, the system and the risk. Arrange it in onboarding and contracts.
Only counting tools
A list of systems without purpose, data and roles involved is too thin to base measures on.
Training as a one-off event
One session does not change behaviour. Combine short modules with practice and fixed arrangements.
No board-level embedding
If management does not follow it, attention fades. Plan a fixed rhythm.
Forgetting external links
Contractors and suppliers working with AI on your behalf belong in the plan.
Sources for this part: Regulation (EU) 2024/1689, Article 4 · Dutch Data Protection Authority, Getting started with AI literacy
What is appropriate differs per sector and per role. A few examples of what people need to understand:
Doctors and nurses working with diagnostic AI or decision support understand how the system reaches an output, on which data it was validated and for which patient groups it may be less reliable.
Credit assessors recognise when an application differs from the data the model was trained on, understand proxy discrimination (a postcode acting as a stand-in for origin) and record a deviating assessment properly.
A civil servant who turns AI advice into a decision assesses that advice independently and gives their own reasons for the decision, so that it does not rest on 'the system says so'.
Lawyers using AI for contract review or research check sources, know the limits of the model and record in a decision note whether and how AI was used.
AI for recruitment and selection is listed in Annex III, point 4(a). HR teams understand how screening tools can carry bias, what candidates are told and how they keep the decision themselves.
People who know the limits of a system recognise sooner a deviation that has to be reported. For high-risk systems that is part of human oversight (Article 14) and of the deployer's reporting duties in Article 26(5). Read Article 26
Because the duty is now about measures, there is no knowledge test that ticks it off. You show what you did: which roles work with which systems, which measure belongs to that and why, what was carried out and how you follow up. A certificate can be one piece of evidence, but it is not mandatory and not enough on its own.
Choose your route
Start with the current text, what changed and what is not required.
Put your case to the case check and see which duties apply, with the source.
Use the evidence approach for role mapping, records and management reporting.
See where online training, assessment and role-based paths fit.
For events, internal sessions and leadership on Article 4 and AI risk.
Define scope, role matrix, learning goals, policy and evidence file.
Start with the Article 4 evidence dossier checklist.
LearnWize fits when you want to centralise assessment, role-based learning paths, certificates, training records and progress reporting.
Behind this page
Freelance AI and privacy legal adviser
Zahed Ashkara is a freelance AI and privacy legal adviser for the GDPR and the EU AI Act. Organisations hire him as privacy counsel, external DPO or AI governance lead, or have him carry out a DPIA, FRIA or AI Act classification. He works exclusively as a freelancer, through Embed AI (trade name Praxikon). He is a Certified AI Compliance Officer (CAICO) and has been a member of the NEN standards committee Artificial Intelligence & Big Data since July 2026.
Expert guidance
Zahed Ashkara is a lawyer and freelance AI and privacy consultant. He connects Article 4 with the rest of the AI Act and the GDPR: AI governance, the AI register, training records and practical evidence for leadership, teams and supervisors.
A practical framework, not a legal classification
An AI-literate professional masters four core competencies: 1) UNDERSTAND - Fundamental understanding of how AI works: difference between AI/ML/generative AI, how training data affects output, what AI can and cannot do, basics of LLMs. 2) EVALUATE - Critical assessment: recognizing hallucinations and errors, identifying bias, assessing reliability, understanding risks and limitations. 3) APPLY - Responsible deployment: effective prompting, privacy-conscious use, compliance with regulations, making ethical considerations. 4) COMMUNICATE - Effectively convey: making AI use transparent, explaining to colleagues, informing stakeholders, documenting AI decisions.
How AI works
Critically assess output
Responsible deployment
Convey transparently
Check your Article 4 score in 8 questions
Check whether your organization organizes AI literacy in a demonstrable way. You get an immediate score, weak domains and a next step to discuss Article 4 evidence.
Answers to the most common questions about the EU AI Act
Discover which EU AI Act gap your organization should solve first.
Providers
AI literacy under Article 4 requires demonstrably appropriate measures per role, not a mandatory standard certificate. Two services connect directly to this page.
LearnWize
LearnWize is the platform that makes AI literacy demonstrable per role with assessments, role-based learning paths, training records, certificates and an Article 4 evidence file. learnwize.ai
Identify team gaps per rolePraxikon
€3,950 for up to ten AI applications · fixed price per item, excluding VAT · 1 to 4 weeks
AI literacy is one part of the AI Act. In a signed assessment I put your AI applications in a register, with the classification and your role per system and a plan for the first 90 days. For boards or lawyers there are board sessions and half days, on request.
Signed assessment: what you getCarried out by Zahed Ashkara, the legal adviser behind this explanation.