EU AI Act Article 4: AI Literacy [Guide]

The EU AI Act is the world's first comprehensive AI regulation. Article 4 is the provision most organisations overlook — and the one that affects the most people. It requires that everyone operating or using AI systems has a "sufficient level of AI literacy." Enforcement began February 2, 2025.

This guide explains what Article 4 actually says, who it applies to, what "sufficient" means in practice, and how to build compliance documentation that holds up.

What Article 4 Actually Says

Here is the full text of Article 4 of the EU AI Act:

"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used."

Three things to notice:

1. "To their best extent" — this is an obligation of effort, not outcome. You must take reasonable measures. You do not need to guarantee every employee reaches a specific score.

2. "Taking into account their technical knowledge, experience, education and training" — the standard is contextual. A data scientist using an AI model in production needs deeper literacy than a marketing manager using ChatGPT for copywriting. The same training programme cannot satisfy both.

3. "Considering the persons or groups of persons on whom the AI systems are to be used" — if your AI system affects customers, patients, or employees, the people operating it need to understand that downstream impact. This is the Safety & Responsibility dimension in practice.

Who Article 4 Applies To

Article 4 applies to two categories:

Providers — organisations that develop or place AI systems on the market. This includes software companies building AI features, startups deploying AI products, and enterprises developing internal AI tools.

Deployers — organisations that use AI systems in their operations. If your company uses AI-powered hiring tools, customer service chatbots, marketing automation, code generation, or any other AI system under your authority, you are a deployer.

The scope is broad. A bank using AI for credit scoring is a deployer. A retailer using AI-powered recommendations is a deployer. A law firm using AI for document review is a deployer. If you operate AI systems, Article 4 applies.

The obligation extends to "staff and other persons dealing with the operation and use" — meaning contractors, consultants, and third-party operators are included if they interact with your AI systems.

When It Came Into Force

Article 4 entered into force on February 2, 2025, as part of the first tranche of the EU AI Act (Article 113(a)). This was deliberately early — before the higher-risk provisions that phase in through 2026 and 2027 — because the EU considered AI literacy a prerequisite for everything else in the regulation.

What "Sufficient AI Literacy" Actually Means

The Act does not define a specific level, test, or certification that constitutes "sufficient." This is deliberate — the standard is contextual, depending on:

• The person's existing technical knowledge
• The complexity of the AI systems they interact with
• The stakes of the decisions those systems influence
• The people affected by those decisions

In practice, this means:

For low-stakes AI use (ChatGPT for drafting, Copilot for code suggestions)

• Understanding what AI hallucinations are and checking output before using it
• Knowing not to input confidential data into public AI tools
• Recognising that AI output can be biased or wrong

For high-stakes AI use (hiring decisions, credit scoring, medical triage)

• Understanding how the specific AI system makes decisions
• Knowing the system's documented limitations and failure modes
• Understanding the downstream impact on affected persons
• Knowing when to override or escalate beyond the AI's recommendation

For AI system operators and administrators

• Technical understanding of the model's architecture and training
• Ability to monitor system performance and detect drift
• Understanding of data governance and privacy requirements

The standard scales with context. This is both the Act's strength (no one-size-fits-all) and its compliance challenge (you must define what "sufficient" means for each role in your organisation).

How to Document Compliance

Article 4 says you must "take measures." A regulator will ask: what measures did you take? You need documentation that answers three questions:

1. What is your organisation's AI literacy standard?

Define what "sufficient" means for each category of AI user in your organisation. Map your roles to the AI systems they interact with and the stakes involved. A competency framework tied to your actual AI usage is stronger evidence than a generic awareness training certificate.

2. How did you assess your staff against that standard?

This is where most organisations fail. They run a training programme and record completion. Completion proves attendance, not literacy. A regulator can reasonably ask: how do you know the training worked?

An AI literacy assessment that scores demonstrated understanding — not self-reported confidence — provides the evidence gap. AISA's assessment covers all 5 dimensions the DOL framework defines and produces per-person, per-dimension scores backed by evidence quotes. That is documentation a regulator can read.

3. How do you maintain AI literacy over time?

AI capabilities change fast. A training programme run once in 2025 does not constitute ongoing compliance in 2027. You need a plan for periodic reassessment — not annual refresher quizzes, but meaningful measurement that reflects the evolving AI landscape.

Penalties for Non-Compliance

The EU AI Act establishes a tiered penalty structure:

Article 4 violations would likely fall under the operator obligations tier — up to €15 million or 3% of annual worldwide turnover, whichever is higher. For SMEs and startups, the Act specifies that fines are capped at the lower of the percentage or the fixed amount.

Enforcement authorities must consider proportionality, including the gravity of the violation, prior compliance efforts, cooperation, and whether the non-compliance was intentional.

ISO/IEC 42001 and How It Connects

Organisations pursuing broader AI governance may encounter ISO/IEC 42001:2023 — the international standard for AI management systems. Published in 2023, it provides a structured framework for governing AI risks, controls, and accountability across the AI lifecycle.

ISO 42001 is an organisational standard (like ISO 27001 for information security). It certifies that your organisation has AI governance processes in place. Article 4 of the EU AI Act is a people requirement — it certifies that your staff have sufficient AI literacy.

The two are complementary:

• ISO 42001 documents that your organisation has an AI governance system
• Article 4 compliance documents that your people understand AI sufficiently to operate within that system

An organisation with ISO 42001 certification but no evidence of staff AI literacy has a process without the people to execute it. An organisation with assessed staff but no governance framework has capable people without guardrails. Both are needed for genuine AI readiness.

What AISA Provides for Article 4 Compliance

AISA is not a training provider — it is a measurement instrument. The AI fluency assessment evaluates demonstrated AI literacy through a 20-minute conversation, scoring 11 specific skills across 5 dimensions against a published rubric.

For Article 4 compliance, AISA provides:

• Baseline assessment — measure where your staff actually stand before investing in training. Data from 1,200+ assessments shows professionals overestimate their AI skills by 18.5 points on average.

• Contextual scoring — the assessment adapts to the person's role and skill level. The same rubric applies, but the questions match their context — satisfying Article 4's "taking into account their technical knowledge, experience, education and training" requirement.

• Evidence-based documentation — every score is tied to a specific quote from the conversation. This is the documented evidence a regulator needs — not "completed a 2-hour course" but "demonstrated understanding of AI limitations with specific examples."

• DOL framework coverage — AISA covers 100% of the U.S. Department of Labor's 25 AI literacy sub-competencies and is validated against Anthropic's AI Fluency Index (93% criteria overlap).

• Pre/post measurement — run the same assessment before and after training to prove that your AI literacy programme worked. Same rubric, same scoring — apples-to-apples comparison.

For teams, the AI readiness assessment provides aggregate data by role, department, and seniority — showing where training budget should go and, after intervention, whether it moved the needle.

---

Related reading: AI Literacy vs Proficiency vs Fluency — how the three terms differ and where Article 4's "AI literacy" sits on the spectrum.

Related reading: AI Fluency vs AI Literacy: The DOL Standard — how the U.S. DOL framework maps to AISA's assessment.

Related reading: AI Skills Gap Analysis: Real Data — the actual gaps in workforce AI skills, measured across 1,200+ professionals.

Frequently Asked Questions

Does the EU AI Act require AI literacy training?

Article 4 requires that providers and deployers "take measures to ensure a sufficient level of AI literacy" for their staff. It does not prescribe a specific training format, duration, or provider. The obligation is to ensure literacy, not to deliver a particular type of training — which means measurement of outcomes matters as much as the training itself.

When does Article 4 enforcement begin?

Article 4 entered into force on February 2, 2025, as part of the first tranche of the EU AI Act. It was deliberately phased in early because AI literacy is considered a prerequisite for compliance with the higher-risk provisions that follow in 2026 and 2027.

What documentation do I need for Article 4 compliance?

You need three things: (1) a defined AI literacy standard for each category of AI user in your organisation, (2) evidence that staff meet that standard — ideally through assessed demonstration, not just course completion, and (3) a plan for maintaining literacy over time as AI capabilities evolve.

Does ISO 42001 satisfy Article 4?

No. ISO/IEC 42001 certifies your organisation's AI management system — governance processes, risk controls, accountability. Article 4 requires that your people have sufficient AI literacy. They address different layers: ISO 42001 is the organisational framework, Article 4 is the individual competency. You need both.