Article 4 reaches beyond your own staff, and the national supervisor enforces it

The Commission Q&A on AI literacy states that Article 4 applies to providers and deployers of AI systems and in addition to other persons dealing with the operation and use of AI systems on their behalf, covering persons broadly within the organisational remit, with a contractor, a service provider and a client given as examples. On clients, the Q&A states that they may need AI literacy depending on the specific risk, reasoning that affected persons should understand how decisions taken with the assistance of AI will have an impact on them. On geographic scope, the Q&A states that the AI Act's legal framework applies to both public and private actors inside and outside the EU as long as the AI system is placed on the Union market, used in the Union, or its use has an impact on people located in the EU. On supervision, the Q&A states that the supervision and enforcement of Article 4 is not with the AI Office but under the remit of national market surveillance authorities, and that supervision and enforcement began on 2 August 2026, while Article 4 itself entered into application on 2 February 2025. On sanctions, the Q&A states that national market surveillance authorities could impose penalties and other enforcement measures for infringements of Article 4, that this will be based on national laws that Member States were due to adopt by 2 August 2025, that any sanction must be proportionate and based on the individual case taking into account factors such as the nature and gravity of the infringement and its intentional or negligent character, and that sanctions are more likely if there is proof of an incident due to a lack of appropriate training and guidance. Article 4 is not listed in the enumeration in Article 99(4) of the AI Act, which covers only Articles 16, 22, 23, 24, 26, 31, 33(1), (3) and (4), 34 and 50, so the level of any penalty for Article 4 follows from national law rather than from the Regulation's own ceilings. The Q&A further states that Article 4 reinforces the transparency provisions of Article 13 and the human oversight provisions of Article 14 and indirectly contributes to the protection of affected persons, and that for deployers of high-risk systems the Article 26 obligation to ensure staff are trained to ensure human oversight is a distinct requirement; that requirement becomes applicable on 2 December 2027 for standalone Annex III systems and on 2 August 2028 for Annex I systems.

• Locator: Commission Q&A on AI literacy, sections on target groups, geographic scope, supervision and enforcement, and sanctions (consulted 9 August 2026)praxikon:eu:ai-act:source:commission-ai-literacy-qaOpen official source

Two things are consistently underestimated here. The first is the circle of people. Many organisations translate Article 4 into a staff programme and forget the seconded workers, the call centre, the implementation agency and the freelancers who use the same systems daily. The Q&A expressly widens that circle to everyone within the organisational remit, and even leaves the door open to clients where the risk calls for it. The second is who will come knocking. Because the AI Office gets all the attention, organisations assume Article 4 is a Brussels file. It is not: this runs through the national market surveillance authority. The most useful sentence for your own prioritisation is that a sanction is more likely where there is proof of an incident caused by a lack of appropriate training and guidance. Enforcement will therefore rarely start with a spot check on your training plan, and far more often with an incident after which the question becomes whether the person involved was prepared. That makes the file reactively useful, and therefore worth having in order now.

• Locator: Commission Q&A on AI literacy, sections on target groups, geographic scope, supervision and enforcement, and sanctions (consulted 9 August 2026)praxikon:eu:ai-act:source:commission-ai-literacy-qaOpen official source

Extend your target list from permanent staff to everyone working with your AI systems under your direction, including contingent workers, contractors and implementation partners, and write that expectation into your procurement and hiring terms. Assess per system whether clients or affected persons also need an explanation of how AI-assisted decisions affect them. Structure your records so that after an incident you can show within a day which measures the person involved had received and when. Finally, establish which national market surveillance authority is competent for you, because that is your counterpart, not the AI Office.

• Locator: Commission Q&A on AI literacy, sections on target groups, geographic scope, supervision and enforcement, and sanctions (consulted 9 August 2026)praxikon:eu:ai-act:source:commission-ai-literacy-qaOpen official source