Guide

EU AI Act: the AI literacy obligation under Art. 4 — what companies must do now

The EU AI Act applies in stages. One obligation, however, already affects practically every company that uses AI: AI literacy. This guide explains what it requires, how to implement it and where the Act’s other obligations come in.

Last updated: 28 October 2026

In short

What does Art. 4 of the EU AI Act require? Since 2 February 2025, companies that provide or deploy AI systems must take measures to ensure, to their best extent, that their staff and other persons working with AI on their behalf have a sufficient level of AI literacy. This applies regardless of the risk category — including ChatGPT, Copilot or an internal assistant. In practice: take stock of the AI systems in use, train by role, issue an AI policy and document everything.

What Art. 4 requires

Under Art. 4, providers and deployers of AI systems take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. Technical knowledge, experience, education and training, the context of use and the persons on whom the AI is used are to be taken into account.

A deployer is any organisation using an AI system under its authority in a professional capacity (Art. 3(4)). A company that provides employees with a chat assistant is therefore a deployer. The obligation has applied since 2 February 2025, with no exemption for small companies and regardless of whether the system is considered high-risk.

The Act itself does not provide a specific fine for breaching Art. 4. A lack of training can, however, play a role in damage cases, liability questions and the assessment of other violations. In November 2025 the European Commission proposed changes to the AI Act in the “Digital Omnibus”, which also concern Art. 4 and certain deadlines — the text in force at the time is what counts.

What “sufficient AI literacy” means

The Act defines AI literacy as the skills, knowledge and understanding that allow people to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and possible harm it can cause (Art. 3(56)). There is no fixed curriculum and no mandatory certificate. What is sufficient depends on role and use.

Basics: how generative AI produces answers and why it can be convincingly wrong
Limits: invented facts (hallucinations), outdated knowledge, bias
Law: data protection, trade secrets, copyright, labelling
By role: those who pass on results need a review routine; those who configure systems need more depth

Practical measures

Inventory: which AI systems are in use — including tools obtained privately?
Define target groups: all employees, departments with particular risk, administrators
Training: a basic module for everyone, deeper modules by role, refreshers for new tools
AI policy: approved tools, prohibited inputs, review obligation, contact person
Documentation: who attended what and when, with content and materials
Name a contact person for questions and incidents

The risk categories at a glance

The Act’s other obligations depend on the risk of the use and apply in stages:

Prohibited practices (Art. 5), since 2 February 2025: for example social scoring, manipulative techniques, emotion recognition in the workplace and in education (with exceptions for medical or safety reasons) and untargeted scraping of facial images
General-purpose AI models (GPAI, Art. 51 et seq.), since 2 August 2025: obligations for the providers of such models, such as technical documentation and a copyright policy
High-risk AI under Annex III, from 2 August 2026 according to the Act’s timetable: areas such as employment and HR management, education, access to essential services such as creditworthiness, critical infrastructure, law enforcement, migration and justice
Transparency obligations (Art. 50), from 2 August 2026: notice that one is interacting with an AI, machine-readable marking of synthetic content, disclosure of deepfakes and of AI texts published to inform the public
Minimal risk: no specific obligations — apart from AI literacy under Art. 4

Obligations as a deployer

Art. 4 applies to all deployers. In addition, there are the transparency obligations under Art. 50(3) and (4): anyone who generates deepfakes or publishes AI texts to inform the public must disclose this, unless there is human editorial control.

Deployers of high-risk systems have considerably more to do under Art. 26: use in accordance with the instructions, human oversight by competent persons, control of input data, monitoring of operation, keeping logs for at least six months and informing employees and their representatives before use in the workplace. Anyone who substantially modifies a system or repurposes it for a high-risk purpose can become a provider themselves (Art. 25).

How an assistance or RAG system is usually classified

An internal assistance system that answers questions about company documents, drafts texts or does research usually does not fall under Annex III and is therefore not a high-risk system. What remains is AI literacy under Art. 4 and, depending on use, the transparency obligations under Art. 50 — for example when customers talk to the system directly.

The purpose decides, not the technology: if the same system is used to screen applications, assess employees or decide on loans, the use can fall into a high-risk area. Classifying the specific use is the deployer’s responsibility.

Vryne is such an assistance system for knowledge and research. Answers are recognisable as AI answers and backed by sources; usage is recorded in the activity log.

Downloads

No sign-up and no email address: as a PDF to print and tick off, as Markdown to keep editing in any editor, in Word or in your wiki. The documents are in German.

Template: AI policy for employees

Ten sections from scope to entry into force, with placeholders such as [Company] to adapt.

Frequently asked questions

Does the AI literacy obligation also apply to small companies?

Yes. Art. 4 AI Act has no exemption based on company size. It applies to every company that uses AI systems professionally. How extensive the measures must be depends on the context and risk of the use — a small office with a chat assistant needs less than a group with its own AI development.

Do you need a certificate to prove AI literacy?

No. The Act prescribes neither a certificate nor a specific course. It makes sense to document who was trained with what content and when, so you can demonstrate the measures taken if needed.

What happens if a company breaches Art. 4 AI Act?

The Act does not provide a specific fine for Art. 4. A lack of AI literacy can, however, count against the deployer in damage cases, liability questions and the assessment of other violations.

Is ChatGPT a high-risk AI system?

Usually not. The underlying model is a general-purpose AI model with its own obligations for its provider. Whether a use is high-risk depends on its purpose: using a chat assistant to select applicants can fall into the high-risk area under Annex III.

When do the transparency obligations under Art. 50 AI Act apply?

According to the Act’s timetable from 2 August 2026. From then on it must be recognisable, for example, that one is interacting with an AI, and deepfakes as well as AI texts informing the public must be disclosed unless there is editorial control.

Not legal advice: this guide gives a general overview as of the date stated and does not replace a review of your individual case by your data protection officer or a lawyer.

Introduce AI without handing over your data

Vryne answers questions from your own documents, backs every statement with its source and runs application, data and language models in Germany. Getting started is free.