{"id":5492,"date":"2026-09-13T09:00:00","date_gmt":"2026-09-13T07:00:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=5492"},"modified":"2026-09-13T22:47:44","modified_gmt":"2026-09-13T20:47:44","slug":"what-does-the-ai-literacy-obligation-require","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/what-does-the-ai-literacy-obligation-require\/","title":{"rendered":"What does the AI literacy obligation require?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for boards, compliance teams and DPOs \u2022 published September 13, 2026 \u2022 8 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

The AI literacy obligation in Article 4 of the AI Act is described through measures, not through a level reached by particular individuals. It binds providers and deployers within the meaning of Article 3(3) and (4) of the Regulation. A deployer is anyone using an AI system under its authority other than in the course of a personal non-professional activity. They are to take measures that support the development of AI literacy among their staff and other persons acting on their behalf. The obligation has applied since 2 February 2025 and was not caught by the July deferral of the requirements for high-risk systems. The provision carries no evidentiary rule of its own, so in my assessment it is demonstrated by describing the measures taken and justifying their selection.<\/p>\n<\/div>\n\n\n\n

Why this question arises at all<\/h2>\n\n\n\n

The AI literacy obligation in Article 4 is short and contains no procedure of its own. It indicates neither a form, nor a frequency, nor a document to prepare. Organisations read it in two opposite ways. Some treat the obligation as a declaration without content, others translate it into recurring training with a final test.<\/p>\n\n\n\n

The second source of confusion is the calendar. The obligation has no transitional period and has applied since February 2025. The July package moved the requirements for high-risk systems and two new prohibitions under Article 5, and did not move the date of this provision.<\/p>\n\n\n\n

The third source is the most recent. The amending regulation of July 2026 rewrote the whole of Article 4. Commentary based on the original wording describes the obligation more strictly than the text in force warrants.<\/p>\n\n\n\n

What has to be established before a decision<\/h2>\n\n\n\n

What changed in July 2026<\/h3>\n\n\n\n

The original wording spoke of measures taken “to ensure, to their best extent, a sufficient level of AI literacy”. The point of reference was the level.<\/p>\n\n\n\n

The wording in force speaks of measures “to support the development of AI literacy”. The point of reference is the action. The AI literacy obligation has therefore stopped being described by a level to be reached in particular individuals. The definition in Article 3(56) itself was left unchanged. The provision adds a decisive sentence, that this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.<\/p>\n\n\n\n

The effect is evidentiary. An organisation does not have to show that a particular person reached a given level. In my assessment it must be able to show what measures it took and why it considered them adequate.<\/p>\n\n\n\n

What AI literacy means under the Regulation<\/h3>\n\n\n\n

The definition sits in Article 3(56) and tends to be overlooked. AI literacy means skills, knowledge and understanding that allow an informed deployment of AI systems. The definition adds awareness of the opportunities and risks of AI and the possible harm it can cause. It covers providers, deployers and affected persons. It ties that literacy to their respective rights and obligations in the context of the Regulation.<\/p>\n\n\n\n

The definition opens with the word “skills” and does not narrow them to operating a tool. In my assessment product training run by the provider does not on its own discharge the obligation, because it answers the question of how to operate the tool.<\/p>\n\n\n\n

Whom the AI literacy obligation covers<\/h3>\n\n\n\n

The provision points to the staff of the provider or deployer and to other persons dealing with the operation and use of AI systems on their behalf. In my assessment the second limb covers contractors and subcontractors as well, because it is wider than an employment relationship.<\/p>\n\n\n\n

Article 4(1) lists the circumstances for selecting measures in three groups. The first is the technical knowledge, experience, education and training of those persons. The second is the context the AI systems are to be used in. The third is the persons or groups of persons on whom the AI systems are to be used.<\/p>\n\n\n\n

The third group tends to be overlooked and carries the most content. The same text assistant calls for different preparation in a marketing team and in a team handling job applicants’ cases. The difference is made by the recipient of the output, not by the tool.<\/p>\n\n\n\n

The starting point is a register of uses, described in What should an AI use register contain?<\/a>.<\/p>\n\n\n\n

The Commission’s practical examples and the limit of a presumption of compliance<\/h3>\n\n\n\n

Article 4(2) requires the Commission and the Member States to support and facilitate the efforts of providers and deployers, in particular SMEs. For that purpose the Commission publishes practical examples on the single information platform.<\/p>\n\n\n\n

The Commission maintains a repository of practices collected in two rounds, more than forty initiatives in all. The first covered AI Pact pledgers, the second was open to any interested organisation. The Commission announces that it will leverage the repository for the publication under Article 4(2).<\/p>\n\n\n\n

The repository has a clear limit, however. Replicating the practices collected in it does not automatically grant a presumption of compliance with Article 4. The document says so expressly, so the Commission’s example is a point of reference rather than a list to tick off.<\/p>\n\n\n\n

Article 4(3) adds recommendations of the Board, that is the European Artificial Intelligence Board, adopted taking into account European competence frameworks. In my assessment neither source creates an obligation, but both set out what the authorities will expect.<\/p>\n\n\n\n

Why the absence of Article 4 from the catalogue of fines settles nothing<\/h3>\n\n\n\n

Article 99(4) lists the obligations covered by an administrative fine. The list covers the obligations of providers, authorised representatives, importers and distributors. It also covers the obligations under Article 25(2) and (4) and the obligations of deployers under Article 26. It covers the requirements and obligations of notified bodies as well as the transparency obligations under Article 50. Article 4 appears in none of the points of that list.<\/p>\n\n\n\n

The opening words of the paragraph describe the listed provisions in general terms, as provisions related to operators or notified bodies other than those laid down in Article 5. They close the list, however, with the words “any of the following provisions”. Article 99(1) is stronger still, requiring Member States to lay down rules on penalties and other enforcement measures applicable to any infringement of the Regulation by operators. In my assessment the mere absence of Article 4 from the list therefore does not settle that this obligation falls outside any penalty.<\/p>\n\n\n\n

Polish law adds supervisory tools, but with a deferred start. Article 104(1) of the Polish Act on Artificial Intelligence Systems does not extend the basis for a fine to Article 4, it carries over the catalogue from Chapter XII of the Regulation. Its own domestic tools sit elsewhere.<\/p>\n\n\n\n

Poland’s national supervisor is the Commission for the Development and Security of Artificial Intelligence, the AI Commission. Article 48(1) allows it to carry out an inspection of compliance with the Regulation and with the Act, subject to Article 2(2) of the Act. Article 61(1) allows the AI Commission to issue a warning to a party by way of a procedural decision, where there is a reasonable suspicion of an infringement and in the course of proceedings.<\/p>\n\n\n\n

Article 62(1) requires a decision to be issued where the AI Commission finds an infringement of obligations under the Regulation or the Act by an entity referred to in Article 2(1), points (a) to (f), of the Regulation. The second condition is that no settlement under Chapter 5 of the Act has been concluded. Paragraph 2 requires the decision to contain measures ordering the effects of the infringement to be removed within 14 days of its service.<\/p>\n\n\n\n

All four provisions sit in Chapters 3, 4 and 8 of the Act, and those enter into force three months after publication (Article 127, point 2). The Act was published on 27 July 2026, so the calculation gives 28 October 2026. Until that day the Act gives the AI Commission only its institutional basis. Article 5(1) and Article 6 sit in Chapter 2 and have applied since 11 August 2026. What is deferred are the procedural tools, from inspection and proceedings through to a warning and a decision with a fine.<\/p>\n\n\n\n

Article 26(2) of the Regulation works separately and is addressed to the deployer of a high-risk AI system. It requires human oversight to be assigned to natural persons who have the necessary competence, training and authority, as well as the necessary support. Article 26(3) reserves the deployer’s freedom to organise its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider. It also states that the obligations under paragraphs 1 and 2 are without prejudice to other deployer obligations under Union or national law. In my assessment competence ceases there to be an obligation of due care and becomes a condition for admitting a person to the role. The provision applies from 2 December 2027 or from 2 August 2028. Article 113, third paragraph, point (c) separates systems under Annex III from those under Annex I.<\/p>\n\n\n\n

An obligation of means against an obligation of result<\/h3>\n\n\n\n

Setting this against neighbouring regimes shows why a ready-made training programme does not carry over directly.<\/p>\n\n\n\n

Provision<\/th>What it requires<\/th>Exceptions and limits<\/th>Applicable from<\/th><\/tr><\/thead>
Article 4 AI Act<\/td>from providers and deployers \u2014 measures supporting the development of AI literacy<\/td>the provision expressly excludes guaranteeing any specific level in particular individuals; it binds providers and deployers within the meaning of Article 3(3) and (4), and a deployer is anyone using an AI system under its authority other than in a personal non-professional activity<\/td>obligation from 2 February 2025, this wording from 27 July 2026<\/td><\/tr>
Article 32(1)(d) GDPR<\/td>a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing<\/td>the list in points (a) to (d) is open (“including inter alia”) and applies “as appropriate”; measures are selected taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons<\/td>25 May 2018<\/td><\/tr>
Article 8d, point 4, of the Polish Act on the National Cybersecurity System (KSC)<\/td>from the head of the entity \u2014 ensuring that the entity’s personnel are aware of cybersecurity obligations and know the entity’s internal rules in that area<\/td>the addressee is the head of an essential or important entity, not the entity itself<\/td>3 April 2026, with a 12-month deadline for implementation for entities meeting the criteria on that day<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Article 4 and Article 32(1) call for measures to be weighed. Article 8d, point 4, states its requirement categorically. In my assessment they also differ in what demonstrates compliance. Article 4 is demonstrated by a description of measures. Article 32(1)(d) is demonstrated by the result of testing and assessment. Article 8d, point 4, is demonstrated by the state of awareness among personnel. An organisation caught by all three regimes may combine the measures, but in my assessment it will not combine the evidence.<\/p>\n\n\n\n

What the AI literacy obligation requires you to document<\/h3>\n\n\n\n

The provision carries no evidentiary rule of its own. In my assessment compliance is demonstrated by describing the measures rather than by measuring knowledge. Three elements make that up.<\/p>\n\n\n\n

    \n
  1. A register of roles that come into contact with AI systems, with a description of what those systems affect.<\/li>\n\n\n\n
  2. A description of the measures assigned to each role, from induction at deployment through to rules of use and consultation.<\/li>\n\n\n\n
  3. The reasoning behind the selection, that is the answer to why those particular measures were considered adequate.<\/li>\n<\/ol>\n\n\n\n

    The third element tends to be omitted, and it is the one that distinguishes documentation from an attendance sheet. The scope and the form are matched to roles, which also covers training matched to roles and processes<\/a>.<\/p>\n\n\n\n

    \n\n

    Remember<\/p>\n\n\n\n

    Training is one of the measures, not the content of the obligation.<\/p>\n\n<\/div>\n\n\n\n

    Common mistakes<\/h2>\n\n\n\n