AI Literacy Under Article 4: What EU Employers Must Now Be Able to Show

AI literacy has been a legal duty under Article 4 of the EU AI Act since 2 February 2025, and national regulators could enforce it from August 2026. Then the rule changed underneath everyone. On 27 July 2026 the Digital Omnibus rewrote Article 4. It replaced a duty to ensure a "sufficient level" of AI literacy with a duty to take measures that support it. Most employer guidance still describes the old text.

What Article 4 AI literacy requires after the July 2026 rewrite

The short answer. Under the amended Article 4, your organisation must take measures that support the AI literacy of staff and others who operate AI systems on its behalf. You do not have to guarantee or test any individual's level. You should be able to show what you did, for whom, and why it fits the systems you use.

That answer is different from the one most compliance decks give. Most of those decks were written against the 2024 text. The original Article 4 told providers and deployers to "ensure, to their best extent, a sufficient level of AI literacy" among their people. The word "sufficient" did a lot of work, and nobody could say where the line sat.

Wording is taken from the article text as consolidated by the AI Act Explorer and the Commission's Q&A. The EUR-Lex text of Regulation (EU) 2026/1744 is the authoritative version and should be checked before any legal filing.

From an obligation of result to an obligation of effort

Lawyers describe the change as a move from a result to an effort. You are no longer on the hook for a state of knowledge inside someone's head. You are on the hook for the measures you took to build it.

I read this as relief on the outcome and no relief at all on the activity. A company that did nothing between February 2025 and July 2026 gains nothing from the rewrite. The effort duty still requires measures to exist. What the rewrite removes is the risk that a regulator second-guesses whether your training was good enough.

The two new paragraphs point obligations at the public sector rather than at you. The Commission must publish practical examples of compliance, and the AI Board will adopt recommendations. In practice this means the guidance will keep arriving after the duty, so your programme needs a review date rather than a finish line.

Who counts as staff under the AI literacy duty

Article 4 names "staff and other persons dealing with the operation and use of AI systems" on the organisation's behalf. The second half of that phrase is the part teams miss when they scope the programme to the HR system.

The Commission's AI literacy Q&A, last updated on 27 July 2026, says these other persons are not employees but people "broadly under the organisational remit". It gives three examples: a contractor, a service provider and a client.

Contractors, service providers and clients

For contractors and service providers, the Commission says they need the AI skills to fulfil the task in question, the same as employees. It allows the measure to sit in the contract rather than in your own training catalogue. Whether a contractual clause is needed depends on the type of AI system and its risk.

My recommendation is to put a one-line AI literacy warranty into every contractor agreement that touches an AI system you deploy. It costs nothing to add at renewal, and it moves the evidence burden to the party that controls the contractor's training.

Clients are in scope "dependent on the specific risk," in the Commission's words. A customer clicking a chatbot on your site is not someone you must train. A client firm whose staff operate a system you configured for them, with your instructions, is closer to the line.

The personal-use exemption does not reach work

Article 3(4) defines a deployer as anyone using an AI system "under its authority," except in a personal non-professional activity. Article 2(10) repeats that carve-out. An employee drafting client emails with a consumer chatbot is acting professionally, so the exemption does not apply to them, even on a personal account.

That is why the unsanctioned tools problem and the literacy problem are the same problem. If you have not mapped which tools staff use outside procurement, start there. The post on personal AI accounts and the security perimeter is the right place to begin the inventory.

Why AI literacy obligations reach US companies with EU staff

A US company often assumes the AI Act binds its EU customers and not itself. For Article 4 that assumption is usually wrong, for two separate reasons written into Article 2 of the Act.

First, Article 2(1)(b) covers deployers "that have their place of establishment or are located within the Union". An EU subsidiary using AI tools is a deployer in its own right. Second, Article 2(1)(c) covers providers and deployers in a third country "where the output produced by the AI system is used in the Union". The Commission's Q&A says this territorial reach is "also valid for Article 4".

In most US groups, the EU employing entity is the natural deployer, because its staff use the tools under its authority. Procurement and policy may sit in the US, but the evidence file should name the EU entity. A regulator in Dublin or Munich will ask about the local employer, not the Delaware parent.

What US companies with EU staff are actually doing

There is no public dataset on how US firms with EU employees are meeting Article 4. I looked for one and found vendor surveys about general AI readiness, none of which isolate this group or this article. Any claim you read about the share of US multinationals that are compliant should be treated as marketing.

What I would do, and what I think is the defensible pattern, is run one global baseline rather than an EU-only module. The output test in Article 2(1)(c) means a US analyst producing work used in the EU can bring the duty with them. Splitting staff by location creates an exceptions list that nobody maintains.

What the Commission's Q&A says AI literacy training must cover

The Commission does not prescribe a syllabus. It describes four steps that together form the minimum, and it expects the content to differ by role, sector and the people the AI system affects.

The four steps start with a general understanding of AI inside the organisation and a view on whether you act as provider or deployer. Then come an assessment of the risks of the systems you use, and measures built on that analysis. Legal and ethical content, including the AI Act itself, is encouraged rather than required.

Training is not mandatory in any fixed form. The Q&A says that "no strict requirements or mandatory trainings are imposed," and that Article 4 does not entail an obligation to measure the AI knowledge of employees. That does not mean anything goes: the same page warns that relying only on a vendor's instructions for use "might be ineffective".

The Commission's own example is useful because it is so ordinary. For staff who use a general chatbot to write advertising copy or translate text, it says they "should be informed about the specific risks, for example hallucination". That is the floor for the most common deployment in any company.

High-risk systems carry a separate, harder duty

Deployers of high-risk systems have a second obligation under Article 26. It requires the people assigned to human oversight to have the necessary competence, training and authority. Article 26 sits in a higher penalty tier, and the Omnibus pushed Annex III high-risk obligations to 2 December 2027. Do not let the softer Article 4 text lull you on systems that will fall under Article 26.

This grouping is Zan Digital's framework, built on the Commission's four steps. The Commission does not publish a tiered model and does not require one.

The size of the first row depends on how widely AI is already used. Eurostat found that 20.0% of EU enterprises with 10 or more employees used AI technologies in 2025, up from 13.5% in 2024. The spread between countries is wide, which matters if your EU headcount is concentrated in one market.

The AI literacy evidence file: what records to keep

The Commission is direct on proof: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives." It also confirms that no AI officer or governance board is mandated by Article 4.

That leaves you to decide what the internal record contains. The test I would apply is simple. Could someone outside your company read the file and reconstruct what you knew about your AI use, and what you did about it, on any given date?

Why a certificate is the wrong thing to buy

A market has grown up selling AI literacy certificates for Article 4. I think most of that spend is wasted. The Commission has said no certificate is required. A generic certificate proves the least useful thing on the list: that a person passed a course that knows nothing about your systems.

The records that carry weight are the inventory and the risk notes, because they show the measures were chosen for a reason. If you already hold evidence for other frameworks, the same discipline applies as in the guide to AI evidence for SOC 2 auditors. Produce the record at the time of the action, not when someone asks.

Every record should carry a date and a version. Tools change monthly, and a risk note written for one model version can be wrong for the next. A file with no dates proves only that someone wrote a document once.

The Commission also runs a living repository of AI literacy practices contributed by organisations. It is useful for ideas. The Commission states that copying a practice from it does not create a presumption of compliance. Treat it as a library and not as a safe harbour.

How enforcement of Article 4 AI literacy works from August 2026

Supervision belongs to national market surveillance authorities, not to the AI Office in Brussels. Their powers began in August 2026. The penalties they can apply come from national laws that Member States were due to adopt by 2 August 2025.

Article 99 of the Act sets three fine tiers, and Article 4 is not named in any of them. That is the single most misreported fact about AI literacy. A post claiming a fine of up to 3% of turnover for missing training has confused Article 4 with the provisions listed in Article 99(4).

Where literacy records actually bite

The Commission's Q&A says enforcement "might be more likely" where an incident is linked to a lack of training. Article 99(7) tells authorities to weigh the degree of responsibility, including technical and organisational measures, and any action taken to mitigate harm. A literacy file is one of those organisational measures.

So the realistic scenario is not a regulator auditing your training in isolation. It is an incident involving an Article 26 or Article 50 obligation, followed by a question about what your staff were told. For the disclosure side of that pairing, the EU AI Act transparency checklist covers Article 50 in detail.

The Q&A also states that the AI Act does not create criminal offences or a right to compensation. Employees and customers cannot sue you under Article 4 itself. On timing, the same page gives 3 August 2026 in one answer and 2 August 2026 in another. That small inconsistency tells you the guidance is still being edited.

Where this argument is weakest

I have argued that you should build a real evidence file. Here is the honest case against spending much on it.

The rewrite may make the file matter less than I suggest

An effort duty with no standalone fine is a weak lever. A regulator with limited staff will spend its time on prohibited practices and high-risk systems. If your company deploys only general-purpose assistants, the probability that anyone ever reads your AI literacy file may be close to zero. A light record could then be the rational choice.

The national layer adds a second unknown. Penalties for Article 4 depend on 27 national regimes. I have not surveyed them, and I have not found a reliable public comparison. A Member State could treat literacy failures more strictly than the EU text implies, and this post cannot tell you which ones do.

Training may not change how people use AI

Compliance training has a long record of producing completion logs rather than behaviour. The evidence that a course changes what people do with AI tools is thin, as the analysis of AI fluency training and behaviour change sets out. A perfect file can sit on top of staff who still paste client data into unapproved tools. That is the risk measured in the post on what shadow AI breaches cost.

My position survives these objections, but narrowly. The file is cheap if you build it while you roll tools out, and expensive if you reconstruct it after an incident. That asymmetry, not the fine, is the reason to do it.

Frequently asked questions

Where to start this week

Open a single document and write today's date at the top. List every AI tool your EU staff use, including the ones nobody approved, and mark your role for each as provider or deployer. That list is the spine of the evidence file and nothing else in it is credible without it.

Then pull your three largest contractor agreements that involve AI systems and check whether any mentions AI literacy. If none does, draft one sentence for the next renewal. Those two actions take an afternoon, and they cover the parts of Article 4 that most programmes skip.

Related reading