What does the AI literacy obligation require?

Why this question arises at all

The AI literacy obligation in Article 4 is short and contains no procedure of its own. It indicates neither a form, nor a frequency, nor a document to prepare. Organisations read it in two opposite ways. Some treat the obligation as a declaration without content, others translate it into recurring training with a final test.

The second source of confusion is the calendar. The obligation has no transitional period and has applied since February 2025. The July package moved the requirements for high-risk AI systems and added two new prohibitions to Article 5, applicable from 2 December 2026. It did not move the date of Article 4.

The third source is the most recent. The amending Regulation of July 2026 rewrote the whole of Article 4. Commentary based on the original wording describes the obligation more strictly than the text in force warrants.

What has to be established before a decision

What changed in July 2026

The original wording spoke of measures taken “to ensure, to their best extent, a sufficient level of AI literacy”. The point of reference was the level.

The wording in force speaks of measures “to support the development of AI literacy”. The point of reference is the action. The AI literacy obligation has therefore stopped being described by a level to be reached in particular individuals. The definition in Article 3(56) itself was left unchanged. The provision adds a decisive sentence, that this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

The effect is evidentiary. An organisation does not have to show that a particular person reached a given level. It is advisable, however, for it to be able to show what measures it took and why it considered them adequate.

What AI literacy means under the Regulation

The definition sits in Article 3(56) and tends to be overlooked. AI literacy means skills, knowledge and understanding that allow an informed deployment of AI systems. The definition adds awareness of the opportunities and risks of AI and the possible harm it can cause. It covers providers, deployers and affected persons. It ties that literacy to their respective rights and obligations in the context of the Regulation.

The definition therefore does not narrow AI literacy to operating a tool. In my assessment product training run by the provider does not on its own discharge the obligation, because it answers the question of how to operate the tool.

Whom the AI literacy obligation covers

The provision points to the staff of the provider or deployer and to other persons dealing with the operation and use of AI systems on their behalf. The second limb goes beyond an employment relationship. It therefore also covers contractors and subcontractors where they deal with the operation and use of AI systems on the organisation’s behalf.

Article 4(1) lists the circumstances for selecting measures in three groups. The first is the technical knowledge, experience, education and training of those persons. The second is the context the AI systems are to be used in. The third is the persons or groups of persons on whom the AI systems are to be used.

The third group tends to be overlooked and carries the most content. The same text assistant calls for different preparation in a marketing team and in a team handling job applicants’ cases. The difference is made by the recipient of the output, not by the tool.

The starting point is a register of uses, described in What should an AI use register contain?.

The Commission’s repository of practices and the limit of a presumption of compliance

Article 4(2) requires the Commission and the Member States to support and facilitate the efforts of providers and deployers, in particular SMEs. For that purpose the Commission is to publish practical examples of how to comply on the single information platform.

The Commission maintains a repository of practices collected in two rounds, more than forty initiatives in all. The first covered AI Pact pledgers, the second was open to any interested organisation. The Commission announces that it will leverage the repository for the publication under Article 4(2).

The repository has a clear limit, however. Replicating the practices collected in it does not automatically grant a presumption of compliance with Article 4. The Commission states this expressly on the repository page. The repository is therefore a point of reference rather than a list to tick off.

Article 4(3) adds recommendations of the Board, that is the European Artificial Intelligence Board, adopted taking into account European competence frameworks. They are to support the Commission and the Member States in promoting AI literacy. None of these sources creates an obligation for organisations.

What an infringement of Article 4 can lead to

Article 99(4) lists the obligations covered by an administrative fine. The list covers the obligations of providers under Article 16 and of authorised representatives under Article 22. It also covers the obligations of importers under Article 23, of distributors under Article 24 and the obligations under Article 25(2) and (4). It goes on to list the obligations of deployers under Article 26, the requirements and obligations of notified bodies and the transparency obligations under Article 50. Article 4 appears in none of the points of that list.

The opening words of paragraph 4 lead after a colon into points (a) to (g) and do not contain the words “in particular”. The English version refers expressly to “any of the following provisions”, that is the provisions listed in the points that follow. The list is therefore closed. Article 75c(4), added in July 2026, indirectly confirms this. It allows the AI Office to impose fines under Article 99(4) also for infringements of provisions not listed in that paragraph. This applies only to systems under the exclusive supervision of the AI Office under Article 75(1). These include, as a rule, systems based on a general-purpose AI model of the same provider or of providers within the same undertaking and systems of very large online platforms and search engines. The AI Office’s exclusive competence covers the providers of those systems. A deployer falls under it only where it is also the provider or forms part of the same undertaking as the provider (Article 75(1), second subparagraph).

Article 99(1) requires Member States to lay down rules on penalties and other enforcement measures applicable to any infringement of the Regulation by operators. It names among them administrative fines, warnings and non-monetary measures. Polish law adds supervisory tools, but with a deferred start. Article 104(1) of the Polish Act on Artificial Intelligence Systems does not extend the basis for a fine to Article 4, it carries over the catalogue from Chapter XII of the Regulation. Chapter XII sets the amounts of fines imposed by a national authority only for the infringements in Article 99(3) to (5), and Article 4 falls under none of those paragraphs. The Act therefore provides no administrative fine for an infringement of Article 4 alone. It does provide for inspection, a warning and a decision ordering the effects of the infringement to be removed.

Poland’s market surveillance authority for AI systems is the Commission for the Development and Security of Artificial Intelligence (the AI Commission). Article 48(1) allows it to carry out an inspection of compliance with the Regulation and with the Act, subject to Article 2(2) of the Act. Article 61(1) allows the AI Commission to issue a warning to a party by way of a procedural decision, where there is a reasonable suspicion of an infringement and in the course of proceedings.

Article 62(1) requires a decision to be issued where the AI Commission finds an infringement of obligations under the Regulation or the Act by an entity referred to in Article 2(1), points (a) to (f), of the Regulation. The second condition is that no settlement under Chapter 5 of the Act has been concluded. Paragraph 2 requires the decision to contain measures ordering the effects of the infringement to be removed within 14 days of its service.

Article 48 of the Act sits in Chapter 3, Articles 61 and 62 in Chapter 4 and Article 104 in Chapter 8. Those chapters enter into force three months after publication (Article 127, point 2). The Act was published on 27 July 2026, so the calculation gives 28 October 2026. Article 5(1) and Article 6 sit in Chapter 2 and have applied since 11 August 2026. Inspection, proceedings, a warning and a decision ordering the effects of the infringement to be removed apply only from 28 October 2026.

Article 26(2) of the Regulation works separately and is addressed to the deployer of a high-risk AI system. It requires human oversight to be assigned to natural persons who have the necessary competence, training and authority, as well as the necessary support. Article 26(3) reserves the deployer’s freedom to organise its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider. It also states that the obligations under paragraphs 1 and 2 are without prejudice to other deployer obligations under Union or national law. Competence ceases there to be an obligation of due care and becomes a condition for entrusting a person with oversight. The provision applies from 2 December 2027 to systems under Annex III and from 2 August 2028 to systems under Annex I (Article 113, third paragraph, point (c)).

An obligation of means against an obligation of result

Neighbouring regimes show why a ready-made training programme does not carry over directly.

Provision	What it requires	Exceptions and limits	Applicable from
Article 4 AI Act	from providers and deployers — measures supporting the development of AI literacy	the provision expressly excludes guaranteeing any specific level in particular individuals; it binds providers and deployers within the meaning of Article 3(3) and (4), and a deployer is anyone using an AI system under its authority other than in a personal non-professional activity	obligation from 2 February 2025, this wording from 27 July 2026
Article 32(1)(d) GDPR	a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing	the list in points (a) to (d) is open (“including inter alia”) and applies “as appropriate”; measures are selected taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons	25 May 2018
Article 8d, point 4, of the Polish Act on the National Cybersecurity System (KSC)	from the head of the entity — ensuring that the entity’s personnel are aware of cybersecurity obligations and know the entity’s internal rules in that area	the addressee is the head of an essential or important entity, who is responsible for the entity’s performance of the obligation (Article 8c(1))	3 April 2026, with a 12-month deadline for implementation for entities meeting the criteria on that day

Article 4 and Article 32(1) call for measures to be weighed. Article 8d, point 4, states its requirement categorically. They also differ in what demonstrates compliance. Article 4 is demonstrated by a description of measures. Article 32(1)(d) is demonstrated by the result of testing and assessment. Article 8d, point 4, is demonstrated by the state of awareness among personnel. An organisation caught by all three regimes may combine the measures, but in my assessment it will not combine the evidence.

How to show compliance with the AI literacy obligation

The provision carries no evidentiary rule of its own. I therefore recommend demonstrating compliance by describing the measures that support AI literacy rather than by measuring knowledge. Such a description is made up of three elements.

1. A register of roles that come into contact with AI systems, with a description of what those systems affect.
2. A description of the measures assigned to each role, from induction at deployment through to rules of use and consultation.
3. The reasoning behind the selection, that is the answer to why those particular measures were considered adequate.

The third element tends to be omitted, and it is the one that distinguishes documentation from an attendance sheet. The scope and the form are matched to roles, which also covers training matched to roles and processes.

Common mistakes

• Assuming the AI literacy obligation requires a specific level of literacy. The provision states expressly that it does not.

• Quoting the original wording of Article 4. A different wording has applied since July 2026, and commentary based on the 2024 text describes the obligation more strictly.

• Narrowing the circle to employees. The provision also covers other persons dealing with the operation and use of AI systems on the organisation’s behalf.

• Treating the provider’s product training as the whole of the measures. It usually teaches how to operate the tool, while under Article 3(56) AI literacy also covers awareness of opportunities, risks and possible harm.

• Treating the Commission’s repository as a list to tick off. Replicating a practice does not automatically grant a presumption of compliance.

• Postponing the subject to 2027. The obligation has applied since February 2025. The July deferral covered the requirements for high-risk AI systems, not Article 4.

Conclusions and next steps

The AI literacy obligation is short, but it is sometimes misread. It calls for no certification programme and no measurement of knowledge. It calls for a deliberate matching of measures to roles and to the people whom the systems’ outputs affect. A deployer of a high-risk AI system thereby also prepares for the requirement under Article 26(2).

Five steps that set this area up in an organisation.

1. Establish in which roles people come into contact with AI systems today.
2. Add to each role what the system in question affects and whom its outputs concern.
3. Check whether those persons include contractors from outside an employment relationship.
4. Match the measures to the roles, separating tool induction from awareness of risks and limits.
5. Record the reasoning behind the selection, because it is that reasoning which explains why the measures were considered adequate.

Return to the register of roles at every new deployment. A new use changes the context and the circle of recipients, and literacy ages together with the tools.

Related materials

• Who is responsible for AI Act transparency obligations? — the transparency obligation applicable from 2 August 2026, with 2 December 2026 as the deadline for bringing older generative systems into line with Article 50(2).
• When does an organisation using AI become the provider of a system? — the role that settles the remaining obligations.
• What should an AI use register contain? — the register from which the selection of measures starts.
• Who else needs NIS2 training besides the management board? — the same question about the circle of persons in the cybersecurity regime.

Sources

• Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), consolidated version as at 27 July 2026 — Article 2(1), points (a) to (f), Article 2(10), Article 3(3), (4) and (56), Article 4, Article 26(2) and (3), Article 75(1), Article 75c(4), Article 99(1) and (3) to (5), Article 111(4) and Article 113 — eur-lex.europa.eu.
• Regulation (EU) 2024/1689, version as published — original wording of Article 4 — eur-lex.europa.eu.
• Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 — new wording of Article 4 — eur-lex.europa.eu.
• Regulation (EU) 2016/679 (GDPR), consolidated version — Article 32(1)(d) — eur-lex.europa.eu.
• Act of 5 July 2018 on the National Cybersecurity System, consolidated text — Article 8c(1) and Article 8d, point 4 (in Polish) — isap.sejm.gov.pl.
• Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) — Article 33(1) and Article 49 (in Polish) — isap.sejm.gov.pl.
• Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003) — Article 2(2), Article 5(1), Article 6, Article 48(1), Article 61(1), Article 62(1) and (2), Article 104(1) and Article 127 (in Polish) — isap.sejm.gov.pl.
• European Commission, Repository of AI literacy practices — digital-strategy.ec.europa.eu.