Short answer: Article 4 doesn’t prescribe one course, certificate, or exam. It requires providers and deployers to take measures that support AI literacy among staff and other people who operate or use AI systems on their behalf, tailored to role, systems, risk, and what those people already know. National authorities are now supervising and enforcing it. There’s no single fixed fine attached to Article 4 itself, but that’s not the same as no exposure, and a defensible programme still needs a paper trail.
If your organisation uses AI and can’t currently answer “what have we actually done about this, and can we show it,” that’s the gap this guide is for.
Five things to know before you do anything else
-
- Article 4 has applied since 2 February 2025. It didn’t arrive with the 2026 headlines, it was amended by them.
-
- The July 2026 amendment softened the standard (support development, not guarantee an outcome) without removing the obligation.
-
- There’s no mandated course, certificate, or test. There is an expectation of genuine, documented, role-appropriate effort.
-
- High-risk AI triggers a separate, stricter obligation under Article 26, on top of Article 4.
-
- What a regulator or a court will actually look at is evidence: what you mapped, who you trained, and what you can show for it.
What Article 4 actually requires
Providers and deployers must take measures to support the development of AI literacy among employees and other people who operate or use AI systems on their behalf. The European Commission’s guidance doesn’t prescribe one course, one exam, or one certificate. Instead, organisations are expected to weigh their own role, the systems they use, the risks involved, and the knowledge and experience of the people using them.
That makes the real question less about whether staff completed an AI course, and more about whether the organisation can show a sensible, proportionate, documented approach.
Who is covered
Article 4 places the legal obligation on two roles:
-
- Providers who build or place AI systems on the market
-
- Deployers who use AI systems in their own operations
Their literacy measures then need to reach further than just direct employees. The Commission’s own guidance names contractors, service providers, and clients as examples of “other persons” whose AI literacy a provider or deployer’s measures should support. They’re the intended audience, not separate parties who owe their own Article 4 duty, and how far that extends (clients especially) depends on the system and the organisation’s actual role, not a blanket rule.
It can also reach organisations outside the EU. The Act applies where an AI system is placed on the EU market, where the provider or deployer is located in the EU, or where the system’s output is used in the EU, or has an impact on people in the EU.
That matters for organisations outside the EU serving European clients, including UK and Nigeria-based teams working with EU customers. But “output used in the EU” is not a blanket trigger. A Nigerian company using ChatGPT internally to draft a report for a German client sits in a different position than a Nigerian provider placing an AI system on the EU market, or a vendor acting as a processor for an EU deployer. The legal consequences differ by role and by system, not just by geography. If your work touches EU clients or EU-based data subjects, get advice on where you actually sit before assuming you’re inside or outside scope.
Does Article 4 apply to your organisation?
Work through this in order:
-
- Do you provide or deploy an AI system? If neither, Article 4 likely doesn’t apply directly, though another AI Act obligation might.
- Who operates or uses that system on your behalf? List employees, plus any contractors, service providers, or clients who deal with it.
- What AI systems are actually involved? Confirm each one meets the Act’s definition of an AI system. Ordinary automation and deterministic software often don’t.
- What are the risks, and who’s affected? A drafting assistant and a recruitment-screening tool don’t carry the same weight.
- What does each role need to know? This is where general awareness training and system-specific guidance diverge.
- What evidence will you keep? If you can’t answer this, the programme isn’t finished yet.
What changed in July 2026
The Digital Omnibus on AI, which entered into force in mid-July 2026, amended Article 4 in three ways:
-
- Organisations must now take measures that support the development of AI literacy, rather than “ensure” it, and the Act states explicitly that no specific individual level needs to be guaranteed (Article 4(1))
-
- The Commission and Member States are to keep supporting providers and deployers, including by publishing practical compliance examples on the AI Act Single Information Platform (Article 4(2))
-
- The European AI Board is to adopt recommendations, drawing on existing competence frameworks, to help set common objectives for AI literacy (Article 4(3))
The organisational obligation to take measures wasn’t removed. What changed is that outcome is no longer the test, and organisations should expect more structured guidance, via the AI Board and the Single Information Platform, as the amendment beds in.
What the Commission expects organisations to consider
Rather than a fixed test, the Commission points organisations toward four questions:
-
- General understanding of AI within the organisation. What is AI, how does it work, what’s actually in use, what are the opportunities and dangers?
- The organisation’s role. Are you developing AI systems, or just using systems someone else built?
- The risk of the systems involved. What do people need to know, and what mitigations matter?
- Adapting the response to the people involved. Their existing technical knowledge, experience, education, and training, and the context and people the system is used on.
Everything below is one practical way of answering those four questions. None of it is a legally mandated format.
What should Article 4 training actually include?
The Commission’s four considerations translate into a working curriculum. This isn’t a mandated syllabus, it’s a practical one built from the risk-, role-, and context-based approach the Commission itself describes.
| Training area | What people should learn |
|---|---|
| AI fundamentals | What the AI systems in use actually are, how they work, and their limits |
| The organisation’s AI landscape | Which AI systems are in use across the business, and why |
| Approved use | Which tools are approved, and for what tasks |
| Data handling | What information must never go into an AI system |
| Reliability | Hallucinations, fabricated sources, and how to verify output |
| Human judgement | When AI output needs a human review before it’s acted on |
| Bias and fairness | How AI outputs can produce unfair or discriminatory results |
| Confidentiality | Handling personal, commercial, and sensitive information |
| Legal and ethical use | Relevant AI Act, privacy, and internal policy obligations |
| Escalation | What to do when an output looks wrong, harmful, or suspicious |
| Role-specific risk | What changes for HR, finance, sales, legal, or customer service |
Who needs what
A single course can cover fundamentals. It can’t cover risk.
| Audience | Focus | Depth |
|---|---|---|
| General staff | Confidentiality, hallucination risk, verification, approved tools | Baseline, org-wide |
| Customer-facing teams | Review and escalation of AI-assisted outputs before they reach a customer | Moderate, role-specific |
| HR and recruitment | Bias, sensitive personal data, keeping a human in the decision | Elevated, tied to consequence of error |
| Managers of high-risk systems | Human oversight, override authority, monitoring, incident reporting | Highest, Article 26-aligned |
| Contractors and suppliers | Onboarding and supplier-terms coverage for any AI tools they touch | Matched to their access, not their headcount |
Does Article 4 require a certificate or a test?
No. There’s no external certificate, no mandated format, and no requirement to formally test what people learned.
That doesn’t mean training is optional in practice. The Commission’s own guidance warns that simply relying on a system’s instructions for use, or asking staff to read them, is often not enough. In most organisations, some form of training or structured guidance will still be the appropriate measure. What’s flexible is the format, not whether you do anything at all. Reproducing a generic module, even one drawn from the Commission’s own repository of literacy practices, also doesn’t create an automatic presumption of compliance.
Certificate versus compliance
A completion certificate shows an individual finished a course. It doesn’t show that the organisation mapped its AI use, considered role and risk, chose appropriate measures, or reached the right people. Those are two different claims, and only the second one is what Article 4 is actually asking for.
What counts as evidence?
Evidence quality runs on a scale.
-
- Weak: “We sent everyone a PDF.”
-
- Better: A training presentation plus an attendance record.
-
- Stronger: Role-specific training, attendance, learning materials, policy acknowledgement, and a light knowledge check.
-
- Strongest: An AI-system inventory, a role-and-risk assessment, a training matrix, learning materials, completion records, tool-specific guidance, an escalation process, and a documented review schedule.
Not every item at the strongest end is legally mandatory. Think of the scale as what a reasonable organisation would be able to produce if asked what it had actually done, and how far up that scale you can currently climb.
How to build a programme
-
- Inventory the AI systems and embedded AI features actually in use, approved or not.
- Map roles: who uses each system, who’s affected by it, and who’s responsible for it.
- Classify risk for each system and use case.
- Build learning: baseline awareness, role-specific modules, and system-specific guidance.
- Deploy training alongside escalation routes and, for high-risk systems, human-oversight controls.
- Review after incidents, material tool changes, new use cases, new regulatory guidance, or on a periodic schedule.
When should training be refreshed?
Article 4 doesn’t set an annual cycle. It does make sense to refresh or extend literacy measures when:
-
- A new AI system is introduced
-
- An existing system changes materially
-
- Someone moves into a different AI-related role
-
- A new risk is identified
-
- An incident occurs
-
- Internal policy changes
-
- High-risk AI is introduced
-
- New regulatory guidance shifts expectations
Enforcement: what actually happens if you get it wrong
Supervision and enforcement sit with national market surveillance authorities in each EU member state, not the AI Office, and are now active. Worth flagging: the Commission’s own Article 4 Q&A gives two different enforcement dates in different answers, 2 August 2026 in one place and 3 August 2026 in another, without reconciling them. Its dedicated AI-literacy webpage currently points to 2 August 2026. Either way, enforcement has started.
Sanctions are set under national law rather than a single EU-wide fine, and they must be proportionate to the violation. Enforcement runs through two channels: public enforcement, where a national authority can impose penalties, and private enforcement, where a person who suffers harm can sue under national law. The AI Act itself doesn’t create a criminal offence or a standalone right to compensation, that comes from national law, but inadequate training can still be the fact pattern that supports a claim.
That means Article 4 doesn’t carry a headline fine figure the way some of the Act’s other provisions do. But “no single fine” is not the same as “no exposure.” Training and governance records are the kind of evidence that becomes relevant if a broader AI-related incident is under investigation.
Article 4 is not the whole programme
| Provision | What it concerns | Who it affects |
|---|---|---|
| Article 4 | AI literacy | Providers, deployers, and relevant people acting on their behalf |
| Article 13 | Transparency | Providers of certain AI systems |
| Article 14 | Human oversight design | High-risk AI |
| Article 26 | Deployer obligations | Deployers of high-risk AI |
| Article 50 | Transparency obligations | Certain AI interactions and AI-generated content |
If you deploy a high-risk AI system, Article 26 sits alongside Article 4 and requires trained human oversight specifically. In practice, that can mean additional controls covering:
-
- Human oversight responsibilities and override authority
-
- How to interpret system outputs
-
- Intervention and stop procedures
-
- Monitoring and log retention
-
- Risk management and incident reporting
-
- Data protection and employment-law considerations tied to the specific system
-
- System-specific instructions and limitations
An Article 4 awareness course supports these controls. It does not, on its own, satisfy them. Completing Article 4 training is not the same as being AI Act compliant.
What if you already have AI training?
Ask honestly:
-
- Does it cover the AI systems your organisation actually uses?
- Is it tailored by role?
- Does it address the relevant risks for each system?
- Does it reflect the context those systems are used in?
- Does it reach contractors and service providers where relevant?
- Can you show, on paper, what measures were taken and for whom?
- Has it been updated since your last material change in AI use?
A “yes” to all seven is rare on a first pass. That’s the normal starting point, not a failure.
Article 4 readiness checklist
-
- ☐ We know which AI systems our organisation uses
-
- ☐ We’ve identified whether we’re a provider, deployer, or both
-
- ☐ We know who operates or uses those systems on our behalf
-
- ☐ We’ve assessed the risk of each system
-
- ☐ We’ve identified what each role needs to know
-
- ☐ Training and guidance are tailored to those roles and risks
-
- ☐ Staff know which AI tools are approved
-
- ☐ Staff know what information they may and may not enter
-
- ☐ Staff know when human review is required
-
- ☐ Staff know how to escalate a suspicious or harmful output
-
- ☐ We keep records of the measures taken
-
- ☐ We review the programme when our AI use changes
If several of these are unchecked, the programme has real work ahead of it. That’s the normal starting point for most organisations right now.
A worked example
A company uses a generative AI assistant to draft customer-service replies and a separate tool to shortlist job applicants. General staff get training on confidentiality, hallucinations, verification, and which tools are approved. Customer-service managers get additional training on reviewing and escalating AI-drafted replies before they go out. HR staff get role-specific training on bias, sensitive personal data, and keeping a human in the loop on hiring decisions. Because the consequences of an error in recruitment are more serious, that team gets stronger controls than the general baseline. Contractors using either system are brought in through onboarding and supplier terms, not left out because they’re not on payroll.
One generic training module can’t cover all of that. Role and risk decide what each group actually needs.
Article 4 FAQ
Is AI literacy training mandatory under Article 4?
The obligation to take measures is mandatory. A specific course, format, or number of hours is not prescribed.
Does Article 4 require a certificate?
No. An internal record of training and guidance is what the Commission points to instead.
Does every employee need the same training?
No. Measures should reflect each person’s existing knowledge, experience, education, and training, along with the context they’re using AI in.
Does Article 4 apply to everyday tools like ChatGPT?
Yes, where the use falls within an organisation’s role as a provider or deployer. The Commission specifically gives workplace ChatGPT use as an example where staff should understand risks like hallucination.
Does Article 4 apply to high-risk AI?
Yes, and high-risk systems also trigger the separate human-oversight training obligation under Article 26.
Does Article 4 apply to contractors?
Potentially, where they deal with an AI system on behalf of the provider or deployer. It depends on the system and the arrangement.
Does Article 4 apply outside the EU?
It can, where an AI system is placed on the EU market, used in the EU, or has an impact on people in the EU. The specifics depend on role and system, not geography alone.
Do we need to test employees on what they learned?
No formal knowledge measurement is required, though a light, proportionate check can strengthen your internal record.
Do we need to appoint an AI officer?
No. Article 4 doesn’t mandate a specific governance structure. Some organisations are building that capability anyway as AI governance matures, and Coursus’s Certified Chief AI Officer programme is built for leaders taking on that mandate. It’s a separate, executive-level credential aimed at the individual, not a substitute for the organisational measures covered above.
How Coursus helps
Coursus builds this into a documented, role-based programme: mapping the AI systems actually in use, building baseline and role-specific training around them, and leaving the organisation with the evidence trail above rather than a single completion badge.
-
- Starting from zero? Take the Article 4 readiness assessment.
-
- Already running training? Request a programme review against the checklist above.
-
- Need a full rollout? Talk to Coursus about a role-based AI literacy programme.
-
- Leading the AI mandate personally? Explore the Certified Chief AI Officer programme.
Last reviewed 13 September 2026 against the European Commission’s AI Literacy Q&A (last updated 27 July 2026). Next review trigger: a Q&A update, AI Board recommendations under Article 4(3), or new national enforcement guidance. This article supports AI-literacy planning and isn’t legal advice. Cross-border organisations, and anyone deploying high-risk AI systems, should get advice specific to their facts.
Sources
-
- European Commission, AI Office — AI Literacy: Questions & Answers
-
- European Commission — AI talent, skills and literacy (Shaping Europe’s Digital Future)
-
- Regulation (EU) 2024/1689 (EU AI Act), Articles 4, 13, 14, 26, and 50
-
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Article 4
