Art. 4 AI Act: The AI Literacy Obligation Is Already in Force

Art. 4 of EU Regulation 2024/1689 (AI Act) requires all organisations that use AI systems to take measures supporting artificial intelligence literacy among their staff. The obligation has been applicable since 2 February 2025, applies to businesses of all sizes and professional firms alike, and was reformulated by EU Regulation 2026/1744 (Digital Omnibus on AI) with effect from 27 July 2026.

This is not a formal box-ticking exercise: without a baseline of literacy, using AI exposes an organisation to liability and concrete operational risks.

What Art. 4 says exactly

This is the text in force since 27 July 2026, as replaced by EU Regulation 2026/1744:

Providers and deployers of AI systems shall take measures aimed at supporting the development of AI literacy of their staff and of any other person dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training, the context in which the AI systems are to be used, and the persons or groups of persons on whom the AI systems are to be used. That obligation does not require providers or deployers to ensure a specific level of AI literacy for any person.

The previous wording spoke of measures "to ensure, to their best extent, a sufficient level" of literacy. The 2026 reformulation makes clear that this is an obligation of means: you must take proportionate measures, not certify that every person has reached a level.

In short: those who use AI must understand what they are using. The depth of those measures must be proportionate to the role and the risk.

Who is obligated

The obligation applies to both providers (those who develop AI) and deployers (those who use it). For businesses and professional firms, the relevant category is that of deployer.

If even a single person in your business or firm uses ChatGPT, Microsoft Copilot, management software with AI features or any other AI-based tool, the obligation applies.

There are no exemptions based on size: an organisation with 2 people has the same obligation as one with 200.

What "sufficient level" means

The AI Act does not prescribe a specific training programme, but it indicates the criteria for assessing sufficiency:

1. Basic technical knowledge: how AI works (without needing deep technical detail)
2. Awareness of limitations: hallucinations, bias, systematic errors
3. Context of use: specific risks of using AI in your profession
4. Impact on users: awareness of the effect that AI decisions have on clients and third parties

For an accountant, "sufficient level" means knowing why you cannot blindly trust an opinion generated by ChatGPT, which data is safe to enter into an AI tool and which is not, and how to document the use of AI in professional activities. The same principle applies to anyone in a business who prepares offers, analyses data or answers clients with the support of AI.

The penalties

Art. 99 of the AI Act provides for penalties for non-compliance. For violation of Art. 4, penalties fall under the second tier: up to €15 million or 3% of global turnover (for companies). The third tier — up to €7.5 million or 1% of turnover — applies to supplying inaccurate information to authorities.

Art. 99(6) provides an SME carve-out: for SMEs and start-ups, the applicable fine is the lower of the fixed amount or the percentage of turnover. Recital 168 clarifies that authorities must take into account the size of the organisation and apply proportionate penalties.

Beyond direct fines, inadequate AI literacy exposes a firm to:

• Professional liability: an error caused by incompetent use of AI can constitute negligence
• Collateral GDPR violations: those who do not understand how AI works cannot correctly manage personal data
• Reputational damage: a client who discovers the incompetent use of AI loses trust

How to comply: a 4-phase path

Phase 1: Competence assessment (1 week)

Assess the current level of AI knowledge across all staff:

• Who uses AI tools? Which ones? For what purpose?
• What is the level of awareness of the risks?
• Do any internal procedures or policies already exist?

Phase 2: Training programme (2-4 weeks)

Design a proportionate training path:

• Foundation level: for all staff (what AI is, how it works, limitations, risks, responsible use)
• Intermediate level: for those who use AI daily (prompt engineering, fact-checking, data management)
• Advanced level: for managers and partners (governance, compliance, strategic planning)

Phase 3: Delivery and documentation (1-2 days)

Deliver the training and document:

• Date, duration, topics covered
• Participants and their roles
• Materials used
• Verification test (recommended but not mandatory)

Phase 4: Continuous updating

AI evolves rapidly. Plan for updates:

• Quarterly: new tools, new features
• Semi-annually: regulatory changes
• Annually: full programme review

Our approach

We help businesses and professional firms build an AI literacy programme proportionate to their real context of use. In our experience, an effective programme includes:

• An interactive session calibrated to the team's daily work
• Content proportionate to the role and the risk level of the systems in use
• Practical exercises with the AI tools actually adopted
• Documentation of the training delivered, usable for compliance purposes
• Reference materials and operational checklists

Our AI Act guide covers all the requirements of Art. 4 in depth; to design the training for your team, talk to us.

The obligation is already in force

The AI literacy obligation under Art. 4 has been in force since 2 February 2025. Enforcement and the full sanctions regime apply from 2 August 2025; Art. 50 transparency follows on 2 August 2026, and high-risk system obligations were postponed to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). If you have not yet taken any AI literacy measures, your organisation is behind.

The AI Office Q&A published on 7 May 2025 clarified that there are no mandatory hours of training and no required certifications — and since 27 July 2026 the rule itself states that no specific level of literacy has to be guaranteed for any person. What remains due are the measures, proportionate to the role, the risk and the context of use. That gives firms flexibility in how they comply, but it does not remove the obligation to act.

Start by assessing where you stand with the free AI Readiness Assessment, or contact us to plan the training for your organisation. For a broader understanding of the regulation that makes this obligation mandatory, visit our AI Act guide.