EU AI Act Article 4 AI Literacy: What Employers Must Have in Place (Enforcement Now Active)

The EU AI Act has been in the news for two years. Most of those conversations focused on high-risk AI systems, foundation model providers, and large enterprise compliance frameworks.

Article 4 is different. It covers providers and deployers of AI systems, and the European Commission's AI literacy FAQ says this obligation has applied since February 2, 2025. After Regulation (EU) 2026/1744 entered into force on July 27, 2026, Article 4 still applies, but it no longer mandates a specific "sufficient" level for each individual. What changes next is supervision: Commission guidance says national market surveillance authorities "start supervising and enforcing the rules as of 2 August 2026".

If your organization deploys AI systems in EU operations, or through staff acting on your behalf there, Article 4 is part of your compliance picture.

What Article 4 Actually Requires

The current language in Article 4 is straightforward. As amended by Regulation (EU) 2026/1744, deployers and providers of AI systems must take measures to support the development of AI literacy among their staff and other people using AI systems on their behalf, taking into account role, context, training, and risk.

The same Commission FAQ also makes the practical limit explicit: Article 4 does not require providers or deployers to guarantee a specific level of AI literacy for any individual. A warehouse operations manager needs a different training package than a customer service representative or a finance analyst. The obligation is to run a role-appropriate process and keep evidence of the measures you took.

What matters operationally is whether an organization can demonstrate it took active steps, not passive ones.

That distinction matters more than anything else in the text.

For marketing and e-commerce roles already using AI-assisted discovery tools, a role-appropriate generative engine optimization course is one concrete example of the kind of skill development Article 4 points toward.

What the Digital Omnibus Changed (July 2026)

The Digital Omnibus on AI did not create Article 4. It changed the operative wording in late July 2026.

• Article 4 remains a legal duty on providers and deployers of AI systems.
• Regulation (EU) 2026/1744 reframed the duty around supporting the development of AI literacy, not proving a guaranteed "sufficient" level for each person.
• The amended article now says explicitly that providers and deployers do not have to guarantee any specific level of AI literacy for any individual.

Passive Steps vs. Defensible Compliance

Many organizations have already taken passive steps: they made AI tools available, sent a welcome email from IT when ChatGPT Team or Microsoft Copilot rolled out, maybe shared a vendor-provided demo video.

None of that constitutes defensible compliance under Article 4. Here is why.

In practice, employers need to show they assessed workforce needs, delivered appropriate guidance or training matched to job roles and risk, and kept an internal record of what they did. The burden is on the employer to demonstrate this happened, not on the employee to claim they learned something.

The three-part framework that creates a defensible compliance record is:

1. Assess — run a structured skills baseline before training. This gives you a documented starting point: which roles had which gaps, on what date. Without a baseline, you cannot demonstrate that training addressed a known need.

2. Train — deliver role-appropriate AI literacy training or guidance, matched to the specific AI systems your organization uses and the roles that interact with them. Generic "here's what AI can do" awareness content is unlikely to be persuasive under Article 4 scrutiny. Specificity matters.

3. Document — maintain records of who completed training, when, and what the training covered. Completion records, assessment scores, and role-to-training mapping are the artifacts that regulators can actually review.

That sequence — Assess, Train, Document — is the difference between a paper trail that holds up and a company that is hoping the enforcement notice goes to someone else.

Why Individual Badges Are Not Organizational Evidence

The most common misread of Article 4 we are seeing in marketing and HR circles is that an individual LinkedIn learning badge or a completed Coursera course satisfies the requirement.

It does not.

An employee completing an AI certification on their own time through a public learning platform is evidence that the employee chose to learn about AI. It is not evidence that the employer assessed the organization's literacy gaps, designed a training program appropriate to the role, or tracked who completed what.

Article 4 puts the obligation on the deployer — the organization — not the individual. An employer who responds to an Article 4 inquiry with "our employees all have LinkedIn AI badges" is describing individual opt-in activity. That is not the same as a structured, employer-managed, role-specific training program with documented completion records.

The legal distinction is between individual learning and organizational evidence of workforce AI literacy.

Why the August 2026 Date Matters

The key date for operators is not when Article 4 first appeared in the law. It is when national supervision starts to become real in day-to-day operations.

The Commission's public guidance states:

• the AI literacy obligation in Article 4 has applied since February 2, 2025
• the Digital Omnibus on AI amended Article 4 in July 2026 so employers must support AI literacy development rather than guarantee a specific level for each individual
• the broader AI Act applies from August 2, 2026
• national market surveillance authorities begin supervising and enforcing Article 4 from August 2, 2026

That means late July 2026 is the last practical window to make sure your organization can show a real internal AI literacy process instead of a loose collection of vendor badges, PDFs, and Slack messages.

What to Do Now: Article 4 Is in Effect

Organizations with EU exposure have a short window to get a credible process in place. You may not finish a mature organization-wide program now that supervision is active. You can stand up the core record: what systems you use, which roles interact with them, what guidance or training those roles received, and when.

The immediate priority order:

1. Inventory your AI deployments. List every AI tool your organization uses that interacts with your workforce or customers. This includes Microsoft Copilot, ChatGPT Team, AI-powered CRM features, customer service bots, and AI-assisted analytics tools.

2. Run an AI literacy baseline for the roles that interact with those tools. A structured assessment that maps roles to AI tools to current literacy levels gives you a defensible starting point. This is the Assess step — and it is the step most organizations skip.

3. Map training to roles, not to tools. Generic AI awareness training is not enough for a defensible record. A finance role using AI for forecasting needs different training than an operations role using AI for scheduling. The mapping has to be explicit.

4. Document completion. Assign training to specific employees in specific roles. Track completion dates. Record what the training covered. Keep the records — these are what enforcement inquiries ask for.

5. Establish a review cadence. Article 4 is not a one-time check. As AI deployments change and employees change roles, the literacy baseline should update. Build the review process into your HR or L&D calendar.

Article 4 supervision is now active. It is still possible to establish a process, create a baseline, and put documentation infrastructure in place.

The AI literacy obligation is not complicated. Assess what your team knows, train them on what they need to know for their specific roles, and document that you did both. The same three-step framework that protects you under Article 4 is the same one that creates measurable AI ROI for the organization.

Related reading: - How OpenSkills Delivers Defensible EU AI Act Article 4 Compliance - EU AI Act Article 4: What SMBs Need in Place — Enforcement Now Active - AI Training for Finance Teams: What NCUA and FINRA Require - AI Training for Education Staff: FERPA and Student Data Privacy - How to Close Your Team's AI Skills Gap (Without a Big L&D Budget) - Role-Based AI Training for Small Business Teams

This post is operational guidance, not legal advice. For legal interpretation of Article 4 in your specific circumstances, consult qualified EU counsel.

Run your team's AI literacy baseline — free, 15 minutes →