Article 4 of the EU AI Act requires organizations to support a sufficient level of AI literacy among staff. It has applied since February 2025. National authorities began enforcing it in August 2026. And it reaches companies with no European entity at all.
Providers and deployers of AI systems must take measures to support a sufficient level of AI literacy among their staff and other people operating AI systems on their behalf, taking into account their technical knowledge, experience, education, training, and the context the systems are used in.
That is close to the whole of it. It is one of the shortest obligations in the regulation and one of the broadest, because it applies regardless of whether the AI you use is high risk, limited risk, or minimal risk. If your finance team uses a copilot to draft analysis, that is in scope. If your recruiters use screening software someone else built, that is in scope.
Two things follow from the wording that most organizations miss. The duty reaches contractors and anyone operating AI on your behalf, not only employees. And it is explicitly proportionate to role and context, which means a single organization-wide briefing is unlikely to satisfy it for staff whose work is materially affected by AI output.
The AI Act does not follow where you are established. It follows where your AI is used and where its output lands. Providers and deployers based outside the EU are bound where the output produced by their AI systems is used within the union.
In practice that catches a lot of American mid-market companies who assume this is somebody else's problem:
| If this is true | Then |
|---|---|
| You have EU customers whose users receive AI-generated output | In scope as a provider or deployer depending on your role |
| You employ anyone based in an EU member state, including remote staff | Those people are staff for the purposes of the obligation |
| A partner embeds your AI output into a service sold in Europe | Reach can be indirect and still count |
| You screen candidates, including EU applicants, with automated tools | In scope, and additional obligations may apply on top |
The corollary matters too. If none of these are true today, Article 4 does not apply to you today. One European client changes that, usually without anyone noticing.
This is the part that makes Article 4 genuinely awkward rather than merely administrative. The regulation mandates no curriculum, no certificate, and no examination. There is no approved course, no accreditation body, and no score to hit.
That flexibility is a gift and a trap. You get to design an approach that fits your organization. You also have to decide what sufficient means, and be able to show your reasoning if anyone asks. Nobody is coming to validate your answer in advance.
It is also worth being precise about what is not required, because vendors in this space are not always careful about the distinction. There is no legal obligation to measure your employees' AI literacy. Recording what training has been undertaken carries clearer expectations. Measurement is not the requirement. It is the strongest evidence available that the level you chose was in fact sufficient, and that it improved.
Since the standard is yours to define, the question is not whether you did enough. It is whether you can show what you did, why you judged it sufficient, and what it achieved. Most organizations have the first, sometimes. Very few have the third.
| Weak position | Defensible position |
|---|---|
| Training was made available to anyone who wanted it | Training assigned by role, based on how each team actually uses AI |
| Completion records scattered across an LMS, Slack, and inboxes | One record: who, what, when, mapped to role |
| Completion rates reported as the outcome | A measured baseline showing what people understood before and after |
| Nobody named as accountable | A named owner, with the reasoning behind the chosen standard written down |
| Done once, at rollout | Re-measured as AI use in the organization changes |
The gap between the two columns is not usually effort. It is that most organizations bought training and assumed the evidence came with it.
Find out whether Article 4 applies to your organization and what your current evidence position would look like if someone asked. Takes about three minutes.