AI Literacy · Regulation
EU AI Act Article 4.
The AI literacy obligation that already applies, and carries no fine.
Most AI Act planning is organised around 2026 and 2027. Article 4 is not on that timeline. It has bound both providers and deployers since 2 February 2025, which means it covers organisations that only use AI tools they bought from someone else. It is also absent from every penalty tier in Article 99. Those two facts together explain why the article is simultaneously ignored by the people it binds and oversold by the people selling training for it.
30-SECOND READ
- It applies to you if you use AI at work. The text binds providers and deployers. A deployer is anyone using an AI system under their own authority in a professional capacity, which includes the team using a chatbot, a coding assistant or an AI feature inside bought software.
- It has been in force since 2 February 2025. Article 4 sits in Chapter I, and Article 113(a) applies Chapters I and II from that date. It is the part of the Act that already applies, not the part still coming.
- It has no fine of its own. Article 99 attaches EUR 35M / 7% to Article 5 and EUR 15M / 3% to a named list. Article 4 is in neither. It is binding and unfined, which is an unusual combination and changes how you should budget for it.
The sentence itself
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
Read it twice, because almost every summary of it drops something load-bearing. It is an obligation to take measures, not to achieve a certified standard. The measures must account for the technical knowledge of the people involved, the context the systems are used in, and the people the systems are used on. That last clause is the one nobody quotes, and it is the one that makes a generic all-staff module insufficient: a system used to screen job applicants and a system used to draft internal meeting notes do not warrant the same measures, because the people affected are not in the same position.
There is no curriculum, no hour count, no certificate and no accredited provider. That is deliberate, and it is why a compliance industry has assembled around the gap. The absence of a specified standard does not mean anything counts; it means proportionality is the standard, and proportionality is something you have to be able to explain.
FOUR MISREADINGS
What people get wrong about Article 4
Each of these is common, each is checkable against the text, and each leads somewhere expensive: either doing nothing when the obligation already applies, or buying a package priced against a fine that does not exist.
It binds AI companies, not us
The obligation names providers AND deployers. If your staff use a bought AI tool in a professional capacity, you are a deployer. Most organisations reading the Act as a vendor problem are already in scope.
It is a future deadline
In force since 2 February 2025, via Article 113(a). It is the part of the Act that already applies, not the part still coming.
It carries a 7% fine
Article 99 attaches that to Article 5, prohibited practices. Article 4 is named in none of the fine tiers. Vendors quoting 7% at you for literacy training are quoting a different article.
A completed course discharges it
The text asks for measures proportionate to technical knowledge, context and affected persons. A single generic module for everyone is the opposite of proportionate, and it is what most programmes buy.
Binding and unfined is not the same as optional
Article 99 is where the Act puts its teeth. Prohibited practices under Article 5 carry up to EUR 35 million or 7% of worldwide turnover. A named list of provider and deployer duties, Articles 16, 22, 23, 24, 25, 26, 31, 33, 34 and 50, carries up to EUR 15 million or 3%. Article 4 appears in none of them. Any vendor quoting 7% at you to sell literacy training is quoting the penalty for deploying a prohibited system, which is a different article about a different thing, and you should treat the rest of their material with the same suspicion.
The obligation is still real. It is supervised by national market surveillance authorities, and it is the kind of duty that gets read alongside everything else when a regulator is already looking at you for another reason. Nobody gets fined for Article 4 in isolation. The realistic exposure is that a company under scrutiny for an incident cannot show that the people operating the system understood it, and that failure colours every other finding.
The practical consequence is a budgeting one. This is not a provision that justifies emergency spend, and it is also not one you can leave at zero. It belongs in the category of operating hygiene you can evidence, which is a smaller and more durable investment than the compliance package the fine number is used to sell.
What meeting it actually looks like
Three artefacts, and none of them is a certificate. First, a record of which AI systems are actually in use and by whom, which most organisations do not have and cannot produce on request. Second, measures matched to those systems and those roles, with the reasoning written down, because proportionality that is not explained is proportionality you cannot demonstrate. Third, evidence the measures happened and reached the people who use the systems.
The failure mode here is the one this cluster already documents at length: a workforce that completed a course and changed nothing. That state satisfies a "take measures" reading on paper while missing the entire purpose, and it is what most AI training spend buys. If you want the argument for why courses do not build capability and what does, it is on compliant but not capable. Article 4 does not require capability in so many words. It requires measures proportionate to context, and a programme that produced no behaviour change is difficult to defend as proportionate to anything.
For the wider governance frame this sits inside, see the AI governance cluster and the AI usage policy, which is where most organisations should record what systems are sanctioned and for whom.
EU AI Act Article 4: common questions
What does Article 4 of the EU AI Act actually require?
Does Article 4 apply to companies that only use AI, not build it?
When did the AI literacy obligation come into force?
What is the penalty for failing to meet Article 4?
How do you demonstrate compliance with Article 4?
Sources
- Regulation (EU) 2024/1689, Article 4 — AI literacy
- Regulation (EU) 2024/1689, Article 113 — entry into application (Chapters I and II from 2 February 2025)
- Regulation (EU) 2024/1689, Article 99 — penalties
This page describes what the Regulation says and is not legal advice. Where a summary and the text disagree, the text governs, which is why Article 4 is quoted here in full rather than paraphrased.
