EU AI Act Article 4: AI Literacy Training by Role

Article 4 of the EU AI Act has applied since 2 February 2025, and since 2 August 2026 national market surveillance authorities can supervise and enforce it. In between, the Digital Omnibus on AI rewrote the article. Providers and deployers no longer have to "ensure, to their best extent, a sufficient level of AI literacy"; they now have to "take measures to support the development of AI literacy", and the new text adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

On a quick skim, that looks like the end of the duty. The omnibus kept one clause word for word, though, and it decides what an adequate measure is: the measures still have to take into account each person's "technical knowledge, experience, education and training and the context the AI systems are to be used in", as well as the people on whom the systems are used. An authority will judge an AI literacy program against that clause, most likely after something has gone wrong, and a single course for the whole company rarely holds up when the person involved was approving credit decisions, buying a model or publishing synthetic video.

What does Article 4 require after the AI omnibus?

The omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) replaced Article 4 in full. Set side by side, the two versions differ in the duty and the target, while the people covered and the factors the measures must reflect are unchanged.

	Original Article 4 (2024)	Article 4 after the omnibus (2026)
The duty	"take measures to ensure, to their best extent, a sufficient level of AI literacy"	"take measures to support the development of AI literacy"
Who must be covered	"their staff and other persons dealing with the operation and use of AI systems on their behalf"	Unchanged
What the measures must take into account	"their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used"	Unchanged
Required level	A "sufficient level"	"This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual"
Support from the EU	None in Article 4	The Commission and Member States support providers and deployers, and the Commission publishes practical examples (Article 4(2)); the AI Board adopts recommendations (Article 4(3))

Recital 8 of the omnibus gives the reason. Stakeholders reported that "stringent obligations to ensure a sufficient level of AI literacy" did not suit every provider and deployer and weighed on smaller companies, "whereas AI literacy should be a strategic priority, regardless of regulatory obligations and potential sanctions." The definition of AI literacy in Article 3(56) was not amended. The practical examples and the Board recommendations are still to come: the Commission's AI literacy Q&A, last updated on 20 October 2026, describes both as forthcoming.

Is AI literacy training mandatory? What the Commission and regulators say

No specific training is mandatory, but the guidance makes clear that the measures have to fit the people receiving them. The Commission's Q&A is direct on the formal points: "There is no need for a certificate," Article 4 "does not entail an obligation to measure the knowledge of AI of employees," and "no specific governance structure is mandated." Organizations "can keep an internal record of trainings and/or other guiding initiatives."

The same Q&A then describes what it expects in place of a fixed format. "There is no one size fit all when it comes to AI literacy and no strict requirements or mandatory trainings are imposed," it says, and "simply relying on the AI systems' instructions for use or asking the staff to read them might be ineffective." Organizations should consider their role as provider or deployer and the risk of the systems involved, and "if the AI systems of the organisation are high-risk... additional measures might be relevant." Training may differ by audience, because "having different levels of training or learning approaches could be appropriate." Even the lightest case gets a concrete answer: staff who use a general-purpose chatbot to write advertising copy "should be informed about the specific risks, for example hallucination."

Germany's Bundesnetzagentur, which has already updated its guidance to the amended text, puts it in one sentence: "the organisation's role as a provider or deployer developing or using AI systems, together with the associated risk, and the staff's previous knowledge and experience are decisive factors." It adds that measures "should be documented" and warns: "A lack of AI literacy can be seen as non-compliance with a duty of care, in particular if this results in any harm."

Enforcement runs through national law. The AI Office does not enforce Article 4; national market surveillance authorities do, using the penalties each Member State sets under the general clause of Article 99(1). Article 4 is not in any of the fixed fine tiers of Article 99(3) to (5), so no euro or turnover cap is written into the Act for it. The Commission stresses proportionality, but it also says when a sanction becomes likely: it "might, however, be more likely if there is proof of an incident due to lack of appropriate training and guidance of employees or other persons."

Taken together, the regulators describe a duty to make an effort that is judged by fit. Article 4 asks for no certificate, but the Commission links sanctions to proof that an incident followed from a lack of appropriate training, so the question after an incident is what the person involved was taught about the system they used, and "the same video as everyone else" is a weak answer when that person was deciding about people.

Why one all-staff course falls short: AI literacy by role

Every factor in Article 4(1) varies with the job. Technical knowledge, the context of use and the people affected are different for a marketing manager generating campaign images and for a credit officer reviewing an automated score, so a single course either stays general enough to say little to either of them or goes deep on topics most staff never touch. A baseline for everyone is the right start, and the roles below need more than the baseline.

Role	What the role decides with AI	What goes wrong without role training	Where the law points
Everyone using AI assistants	What to paste in and what to trust	Invented facts in documents, personal data in prompts	Article 4; the Commission's hallucination example
People managers and team leads	Which work goes to AI and how output is reviewed	Unapproved tools, output nobody checked	Article 4; managers set the rules their team follows
Marketing and communications	Publishing AI-generated images, video and text	Undisclosed deepfakes and unlabeled synthetic media	Article 50 transparency duties, in application since 2 August 2026
Procurement, legal and IT buyers	Which AI to buy and how it gets changed	Becoming the provider of a high-risk system by rebranding or substantially modifying it	Article 25(1)
Board members and executives	Risk appetite and oversight of AI use	Approving AI risk the board cannot assess	Article 4 is the organization's duty and names no separate board duty
People who oversee a high-risk system	Whether to accept, override or stop an output	Automation bias, reviews that only confirm the score	Article 26(2): "the necessary competence, training and authority"
Developers using coding agents	Permissions, dependencies and what gets merged	Leaked secrets, hostile instructions hidden in repositories	Article 4
Compliance, risk and audit teams	Which systems are in the inventory and how they are classified	High-risk systems nobody has identified	Article 4, and the classification rules in Article 6

One row differs from the others in legal weight. For people who oversee a high-risk system, role-specific training is a hard requirement of a separate provision: Article 26(2) obliges deployers to assign human oversight to people "who have the necessary competence, training and authority, as well as the necessary support." The omnibus left Article 26 untouched, and for Annex III systems it applies from 2 December 2027. The Commission connects the two provisions itself, noting that Article 26 requires staff "sufficiently trained to handle the system and ensure human oversight" and concluding: "Relying on the instructions of use is therefore not sufficient, further measures are necessary."

How to build an Article 4 program that holds up

A defensible program starts from the AI the organization uses, so the AI inventory is the first input, and the steps follow from the text of Article 4(1).

1. Map who uses which AI system, and for what. An AI register records the context of use and the affected people that Article 4(1) names, so pair each system in it with the roles that operate it.
2. Give everyone a baseline. All staff who use AI need to know how it fails, what data may go into it and when to escalate.
3. Add role-specific measures where the consequences are highest. Start with people who oversee high-risk systems, staff who use AI in decisions about individuals, teams that publish AI-generated content, and the people who buy and configure AI tools.
4. Keep a simple record. The Commission says organizations can keep an internal record of trainings, with no certificate needed, and the Bundesnetzagentur recommends documenting the measures so that the organization can show what it did.
5. Refresh when systems or roles change. A new tool, a new use case or a substantial change to a system is the trigger to check whether the people using it were trained for it.

The same program also serves the AI governance frameworks that many enterprises run alongside the Act, because the other major AI governance frameworks contain related training and competence requirements:

Framework	Provision	What it asks
EU AI Act	Article 4	Measures to support AI literacy that take into account knowledge, experience, context of use and the people affected
ISO/IEC 42001	Clause 7.2 (competence) and 7.3 (awareness)	Determine the competence needed by people whose work affects AI performance, ensure it through education, training or experience, and make staff aware of the AI policy
NIST AI RMF	GOVERN 2.2	"The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities"
EN 18286	Clause 7.2 (competence) and 7.4 (awareness)	For providers of high-risk AI, ensure and maintain the competence of personnel whose work affects the QMS, in light of each system's intended purpose, foreseeable misuse, risks and intended users, and make staff aware of the quality policy and their part in it

A role-based training record supports all four at once. For how ISO/IEC 42001 works from scope to certificate and where it overlaps with the AI Act, see our ISO/IEC 42001 guide.

Free role-based AI literacy courses from Modulos

Modulos has launched Modulos Learn with twelve free video courses in three families, built around the roles above:

• AI Literacy for everyone: Foundations, Fraud and deepfakes, Personal data at work, and the in-depth Practitioner course.
• AI at Work for people who use AI in their job: Agents, Leading a team that uses AI, Marketing and communications, and Coding agents.
• AI Governance for the people who answer for AI: Overseeing high-risk AI, Buying AI tools and services, Boards and executives, and Running an AI register.

Each course ends with a short quiz, and passing it produces a certificate of completion that your organization can keep with its training records. The courses can serve as one of the measures Article 4 asks organizations to take, and the record works best next to an AI register that shows which people use which systems. The Modulos platform keeps that register; request a demo and we will walk you through it.

Frequently asked questions about Article 4 AI literacy

Does the AI omnibus remove the AI literacy obligation? No. Regulation (EU) 2026/1744 replaced Article 4, and providers and deployers must still "take measures to support the development of AI literacy" of their staff and others operating AI on their behalf. The amended text drops the "sufficient level" target and says that no specific level has to be guaranteed.

Does Article 4 require a certificate or an exam? No. In the Commission's words, "There is no need for a certificate," and Article 4 does not require measuring employees' AI knowledge. Organizations can keep an internal record of the training, and the Bundesnetzagentur recommends documenting the measures taken.

When did enforcement of Article 4 start, and what are the penalties? The obligation has applied since 2 February 2025, and national market surveillance authorities can supervise and enforce it from 2 August 2026. Penalties come from national law under Article 99(1); Article 4 is not in the Act's fixed fine tiers. The Commission says a sanction "might, however, be more likely if there is proof of an incident due to lack of appropriate training and guidance of employees or other persons."

Does Article 4 apply if employees only use ChatGPT or Copilot? Yes. Organizations that deploy such tools are deployers, and the Commission's example is staff using a chatbot for advertising copy, who "should be informed about the specific risks, for example hallucination."

Who needs role-specific AI literacy training under the EU AI Act? Article 4 requires measures that take each person's knowledge and context of use into account, which points to role-specific training wherever the consequences of AI use differ. The Act makes it a hard requirement for people who oversee high-risk systems, whom Article 26(2) requires to have "the necessary competence, training and authority."

Is a single company-wide AI training enough for Article 4? It is a sound baseline. The Commission's answer begins "There is no one size fit all" and says that different levels of training "could be appropriate", so a program that stops at one course for everyone will be hard to defend for roles such as high-risk system overseers, buyers of AI and teams publishing AI-generated content.