EU AI Act guide
EU AI Act AI literacy: what employers must put in place under Article 4
What Article 4 asks of providers and deployers since February 2025 and after the July 2026 rewording, who counts as staff and other persons, the literacy each role needs, a six-step programme and the records that show your measures work.
Key points
- Article 4 of the EU AI Act has applied since 2 February 2025. It places the AI literacy duty on providers and deployers, which means almost every employer that uses AI tools at work.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, reworded the duty in July 2026: organisations now take measures to support the AI literacy of their staff and of others who operate or use AI on their behalf. The duty remains.
- Article 4 names no course, examination or certificate. What it needs is a sensible, role-based set of measures and records that show those measures are working.
- Literacy also carries the weight of other duties, above all the competence of the people who oversee high-risk systems under Article 26.
What does EU AI Act AI literacy require of employers?
The short answer: if your organisation provides or deploys AI systems, the Act expects you to take measures that support the AI literacy of your staff and of other people who operate or use those systems on your behalf. The duty sits in Article 4, in the Act's general provisions, and it has applied since 2 February 2025, the same day as the prohibited practices in Article 5.
It is not limited to high-risk AI. A finance team using a drafting assistant, a recruiter using a screening tool and a service desk running a chatbot all fall within it, because in each case the employer is using an AI system under its authority, which makes it a deployer under Article 3(4).
The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, recast the article. Commentators have summarised the change as a move from "ensure" to "take measures to support". Two further paragraphs now require the Commission and the Member States to support and facilitate these efforts, particularly for small and medium-sized enterprises, and the European AI Board to adopt recommendations. The softer verb does not remove the need to act and to show what you did.
This guide is practical guidance, not legal advice.
Who counts as staff and "other persons"?
The wording reaches beyond your payroll. It covers your own employees and also the other persons dealing with the operation and use of AI systems on your behalf. In practice that brings in contractors, agency workers, outsourced teams running a process for you and, in many cases, the staff of a business process outsourcing partner who operate your tools.
Start from the AI inventory rather than the organisation chart. For each system, list who configures it, who operates it day to day, who relies on its output to make a decision and who explains that decision to a customer or employee. Those people are your literacy population.
Your role for each system shapes the content; the guide Provider or deployer: obligations by role explains how to decide it.
AI literacy by role: who needs what
One module for everyone is a weak end point. The table shows the role-based pattern we use. The groupings are Sterling's recommended structure, not categories taken from the Act.
| Group | What they need to understand | Evidence that the measures are in place |
|---|---|---|
| Everyone using AI tools at work | What the approved tools are, what data may and may not go into them, that outputs can be wrong or biased, when to check and when to escalate | Acceptable-use rules acknowledged, short awareness session completed, tool list published |
| Decision makers relying on AI output | How the output is produced at a practical level, its known limits, automation bias, when to set the output aside, how to record the decision | Role briefing tied to the system's instructions for use, sampled decision records |
| People assigned to human oversight | The system's capacities and limitations, how to interpret output, how to override, reverse or stop it, how to report an incident | Named assignment, competence record, authority to intervene written into the role, oversight drill results |
| Engineers, data and product teams | Risk, data quality and bias, logging, testing, documentation, and the Act's tiers as they apply to what they build or change | Technical training records, design reviews showing the knowledge applied |
| HR, procurement and legal | Which uses are prohibited or high-risk, what to ask suppliers, worker information duties, links to the GDPR | Supplier questionnaire in use, briefing records, updated procurement procedure |
| Senior management | The organisation's AI exposure, its role for each system, the dates that bind it and the decisions only they can take | Board or management briefing minutes, approved AI policy |
Depth follows exposure, and the record should show it.
Building an AI literacy programme in six steps
1. Know what AI you use
List every AI system in use, including features inside existing software and tools brought in by teams.
2. Map people to systems
Record the groups from the table for each system, contractors included.
3. Set the content by role
Allow for what people already know, their experience and the setting in which they use each system. Build from the provider's instructions for use and your acceptable-use rules.
4. Deliver in formats that fit the work
Short e-learning for the workforce; workshops on the actual system for decision makers; a failure drill for overseers.
5. Keep records
Record who received what, when, for which system, and how you checked it worked.
6. Refresh on change
Trigger new measures when a new system arrives, when a system changes materially, when someone moves into an oversight role and when an incident reveals a gap.
What records show the measures are in place?
Article 4 prescribes no format. An authority, a customer's due-diligence team or your own internal auditor will look for a clear line from the AI inventory, to the people who use each system, to the measures they received and to proof that the measures made a difference.
- An AI literacy policy or a section of your AI policy that states the approach, the groups and the refresh triggers.
- A role-to-system matrix kept current with the inventory.
- Completion and attendance records, with content versions, so you can show what a person was taught at the time.
- Short knowledge checks or practical assessments for decision makers and overseers, rather than completion alone.
- Records of briefings given to contractors and outsourced partners, or contract clauses that require the partner to provide them.
The Commission publishes an AI literacy questions-and-answers page and a living repository of AI literacy practices from organisations across the EU, and the AI Act Service Desk carries a page on Article 4. Check them for updates after the July 2026 rewording.
Where AI literacy meets other duties in the Act
Several other obligations assume that the right people already understand the systems in front of them.
| Provision | What it adds to literacy | Applies from |
|---|---|---|
| Article 5(1)(f) | Emotion recognition in the workplace and in education is prohibited, except for medical or safety reasons; HR and managers must recognise such features in tools they are offered | 2 February 2025 |
| Article 14 | High-risk systems must be designed so that overseers can understand capacities and limitations, stay aware of automation bias, interpret output and override, reverse or stop the system | With the high-risk rules: 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| Article 26 | Deployers of high-risk systems assign human oversight to people with the necessary competence, training and authority, and inform workers' representatives and affected workers before putting such a system into use at work | With the high-risk rules, as above |
| Article 50 | Staff who publish or run AI-generated content or chatbots need to know the transparency duties that attach to them | 2 August 2026 |
For employers, the recruitment and workforce-management uses listed in Annex III point 4 are the ones to watch. If you are unsure whether a tool falls there, the guide Is it high-risk? Article 6 and Annex III works through the test, and The AI Act timeline after the Digital Omnibus explains why the high-risk dates moved. For an ISO/IEC 42001 system, the ISO/IEC 42001 training guide covers competence evidence; one set of records can serve both.
Where AI literacy programmes fall short
- A generic video and nothing else. It shows effort but not that overseers can actually intervene in a specific system.
- No link to the inventory. Training records exist, but nobody can say which systems they relate to, so new tools arrive with no measures at all.
- Contractors left out. Outsourced teams operate the tools, yet only employees appear in the records.
- No refresh trigger. The programme was built once, before the organisation adopted half the tools it now uses.
How Sterling builds AI literacy
Role-based measures, tied to your real systems, with records that stand up
Our expert and experienced consultants start from your AI inventory, map each group of people to the systems they use, and set content and depth by role. Sterling Academy access for your people is included in the engagement, with users, courses and access period confirmed in the proposal, and Effivity holds the role matrix, records and refresh triggers from day one. Sterling prepares the measures and the evidence; how the Act is applied to you is a matter for the authorities and your legal advisers.
Book a free discovery callEU AI Act AI literacy: questions buyers ask
Is AI literacy training mandatory under the EU AI Act?
Providers and deployers must take measures to support the AI literacy of their staff and others using AI on their behalf; training is the usual measure, but Article 4 does not prescribe a specific course.
Did the Digital Omnibus remove the AI literacy obligation?
No, Regulation (EU) 2026/1744 reworded Article 4 rather than deleting it. The duty moved from ensuring literacy to taking measures that support it, and new paragraphs require the Commission and Member States to help, especially smaller businesses.
Do employees need an AI literacy certificate?
No certificate is named in Article 4. Internal records of the measures taken, who received them and how you checked understanding are what an employer needs; an external course certificate can form part of that record but is not required by the text.
Does AI literacy cover contractors and agency workers?
Yes, where they operate or use AI systems on your behalf, because the article reaches other persons as well as staff. Brief them directly or make the supplying company responsible for it by contract, and keep the evidence either way.
How often should AI literacy measures be refreshed?
The Act sets no interval, so refresh on change: a new system, a material change to an existing one, a new oversight role or an incident. Many organisations add an annual refresh on top, which is a sensible default rather than a legal requirement.
More EU AI Act guides
Every guide in the EU AI Act series is written for one question and links back to the hub for the whole picture.
Keep exploring
Explore more about EU AI Act
Watch a video on how to comply with EU AI Act here.
Watch a video on EU AI Act requirements here.
Talk to a consultant
Put role-based AI literacy in place, with records that show it works.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice