Article 4 is the AI Act obligation almost every company in the Union already has, and the one whose text changed this summer. It applies to providers and deployers of AI systems, which means any company that uses an AI system in its operations, since 2 February 2025, and Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced its wording with effect from 27 July 2026. This article is the rewritten text, what it asks and does not ask, how the record is produced, and a programme that fits on a page, read from the two Regulations on CELLAR on 12 September 2026. It is not legal advice.
The text, before and after
The original Article 4 required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff and other persons dealing with the operation and use of AI systems on their behalf. The rewritten Article 4(1) requires them to "take measures to support the development of AI literacy" of the same people, "taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used", and then adds the sentence that changes the conversation: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
Two new paragraphs follow. Article 4(2): the Commission and the member states support and facilitate the efforts of providers and deployers, "in particular SMEs", and the Commission publishes "practical examples of how to comply with that obligation" on the single information platform of Article 62(3). Article 4(3): the AI Board adopts recommendations, taking account of European competence frameworks, to support the promotion of AI literacy, "including by setting out common objectives".
The definition did not move. Article 3(56): AI literacy is the skills, knowledge and understanding that allow providers, deployers and affected persons "to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause".
What it asks, and of whom
The duty is on the organisation, not the individual, and it is a duty of means: to take measures, proportionate to the people and the context. Three things follow from the text.
First, who is covered: staff, and "other persons dealing with the operation and use of AI systems" on the organisation's behalf, which reaches contractors and agency staff who operate a system for you. Not customers, and not the public, although the measures are to consider "the persons or groups of persons on whom the AI systems are to be used".
Second, what "measures" are: the article does not say training, courses or certificates. It says measures that take account of technical knowledge, experience, education and training, and of the context of use. A developer who builds models, a recruiter who reads a ranking a system produced, and an assistant who drafts with a general-purpose model need different things, and the measure for each is the one that fits.
Third, what it does not require: a guaranteed level of literacy of any individual, a test, a certificate, or a named course. A company can meet the article with an internal briefing, a written guide per system, a policy on use, and a record of who received what and when, as long as the measures fit the people and the context.
The enforcement
Article 4 sits in Chapter I, in application since 2 February 2025. It is not among the provisions Article 99(4) attaches the fines of up to 15 000 000 euros or 3% of turnover to; those are Articles 16, 22 to 26 and 50, the operator duties for high-risk and transparency. Under Article 99(1), as amended, member states lay down penalties for any infringement of the Regulation, which may include administrative fines, warnings and non-monetary measures, proportionate and with the interests of SMEs, start-ups and SMCs taken into account. So the practical consequence of Article 4 is elsewhere: a deployer of a high-risk system has to assign human oversight to people with the necessary competence, training and authority (Article 26(2)), and a provider's instructions for use assume a reader who can use them; a company that cannot show what it did under Article 4 will find the question asked under those articles, and by its customers.
The record, from ISO 42001
For a company that runs a management system, Article 4 is already a set of records it keeps. ISO/IEC 42001:2023 requires, in clause 7.2, that the organisation determine the competence needed by the people whose work affects its AI performance, ensure they have it, take actions where they do not, and retain evidence; in clause 7.3, that people be aware of the AI policy and of their contribution to the management system; and in Annex A, control A.4.6 covers the people and skills an AI system depends on, and the A.9 controls cover the organisation's own use of AI: rules for use (A.9.2), the objectives for responsible use (A.9.3), and using a system for what it was built for (A.9.4). The competence record of 7.2 is the Article 4 record: who operates which system, what they needed to know, what measure they received, when, and the evidence.
The same clauses exist in ISO 27001, 7.2 and 7.3, and a company that holds that certificate can put the AI measures into the competence and awareness records it already keeps rather than build a parallel file. What ISO 42001 asks for, and where the AI Act's other obligations land on it, is in the mapping; the standard's 38 controls in plain English are the companion.
A programme that fits on a page
Our example, in our own words; the measures that fit a company are the ones that fit its systems and its people, and the text does not prescribe these.
- An inventory: the AI systems the company provides or uses, each with its intended purpose, who operates it, and on whom it is used. Without this there is nothing to take measures about.
- Three tiers of people: those who build or configure systems, those who operate them and act on their output, and everyone else who uses a general-purpose tool. The measures differ by tier.
- For the first tier, the system's technical documentation and the provider's instructions for use, read and acknowledged, and the risk assessment they contributed to.
- For the second tier, a one-page guide per system: what it does, what it does not do, its known limitations and accuracy, the automation-bias warning of Article 14(4)(b) in the company's own words, when to override it, and whom to ask.
- For the third tier, the policy on use: which tools are approved, what may not be entered into them, how outputs are checked, and the Article 50 disclosure duties where they apply.
- A briefing on the risks and opportunities of AI, once at joining and once a year, which is the "awareness" half of the definition in Article 3(56).
- A record per person: tier, systems, measures received, dates. This is the 7.2 competence record, and the thing to show when asked.
- A review when a system is added, changed or retired, and when the Commission's practical examples or the Board's common objectives are published.
That is Article 4. The fine print is that it is proportionate: an eight-person consultancy using two general-purpose tools meets it with items 1, 5, 6 and 7; a provider of a high-risk recruitment system does not.
Sources
- Regulation (EU) 2024/1689 (the AI Act), Article 3(56), Article 4 as originally adopted, Article 14(4), Article 26(2), Article 50, Article 62(3), Article 99(1) and (4), Article 113.
- Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI), Article 1, points (5) and (38); Official Journal of 24 July 2026, in force 27 July 2026. Both read on CELLAR on 12 September 2026.
- ISO/IEC 42001:2023, clauses 7.2 and 7.3 and Annex A controls A.4.6, A.9.2, A.9.3 and A.9.4, cited by number; the text is ISO's and is not reproduced.
This is not legal advice. The measures that satisfy Article 4 for a given company depend on its systems and its people; the text is the Regulation's, and the practical examples will be the Commission's.