AI literacy at work: rules, training and records

What Article 4 says today

Article 4 of the AI Act, Regulation (EU) 2024/1689, is about AI literacy. Since 27 July 2026 it reads: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. They take into account the technical knowledge, experience, education and training of these persons, the context in which the AI systems are used and the persons on whom they are used. The duty does not require any specific level of AI literacy for any individual (Article 4(1)).

The new wording comes from Regulation (EU) 2026/1744. It was published on 24 July 2026 and entered into force on the third day after that. Before, Article 4 asked for measures to ensure, to their best extent, a sufficient level of AI literacy. Recital 8 of the amending regulation gives the reason: such strict duties did not suit all providers and deployers and created extra work, particularly for smaller enterprises. The duty to take measures remains.

Who is covered and since when

Chapter I of the AI Act, which contains Article 4, applies from 2 February 2025 (Article 113(a)). A deployer is anyone who uses an AI system under their authority, except for personal non-professional use (Article 3(4)). A shop whose team writes product texts with an AI tool, or an agency whose staff translate with one, is a deployer in this sense. A provider develops an AI system or has it developed and places it on the market under its own name.

AI literacy means the skills, knowledge and understanding that allow an informed use of AI systems and awareness of the opportunities and risks of AI and the harm it can cause (Article 3(56)). The ‘other persons’ are people who work on your behalf without being employees. The European Commission’s page ‘AI Literacy – Questions & Answers’ (last updated 20 October 2026) names contractors, service providers and clients as examples.

What a small company can do

The AI Act does not prescribe a format. The Commission’s questions and answers suggest four considerations: a general understanding of AI in the organisation, your role as provider or deployer, the risks of the systems you use, and the knowledge and context of the people. From this, a small company can work in five steps:

A written rule helps everybody to know the same thing. One or two pages are often enough. Typical points:

• Which AI tools may be used, and for which tasks.
• Which data must not be entered, such as customer data, health data or trade secrets.
• That people check AI results for facts, numbers and quotes before they use them.
• When content needs an AI notice. The guide ‘Labelling AI content: chatbots, images and texts’ explains Article 50.
• Who answers questions and who decides about new tools.

Training by role

Article 4 asks you to take into account what people already know and how they use AI. Training can therefore differ by role. According to the Commission’s questions and answers, different levels of training are possible, and only asking staff to read the instructions for use may not be enough. One of its examples: staff who write advertising texts or translate with a chat AI tool should be informed about specific risks such as hallucinations, that is, invented facts.

Records: what to keep

According to the Commission’s questions and answers, no certificate is needed. Organisations can keep an internal record of trainings and other initiatives. Article 4 does not require you to measure the knowledge of your staff, and no AI officer or special governance body is prescribed. A short document and a list show what you did. A template:

AI use and training policy – [company]
Version [number], valid from [date], next review [date]

1. AI tools and allowed uses
2. Data that must not be entered
3. Checking results before use
4. AI notices (Article 50)
5. Contact person: [name]

Training record
Name | Role | Topic | Date | Duration | Confirmed

Supervision

According to the Commission’s questions and answers, national market surveillance authorities supervise Article 4 from 2 August 2026. Member States lay down the rules on penalties and take into account the interests of small and medium-sized enterprises (Article 99(1)). The fine ranges in Article 99(3) to (5) do not name Article 4. Which authority is responsible in Germany or Poland is not covered here. Stricter duties apply to high-risk AI systems, for example under Article 26; they are not covered here either.

Work with Do4U

For the AI literacy policy you describe in a few sentences how your team uses AI and tick your company size, sector, uses, roles and data. The AI then writes the draft of an internal AI use and training policy in the language you choose: purpose, allowed and prohibited uses, data rules, labelling, responsibilities, a training plan by role, records and the review. The code checks that all nine sections are there, allows only references to Articles 4 and 50 of the AI Act, removes made-up numbers and verdicts and adds the participation list. You copy the result as Markdown or plain text.

Do4U builds a draft. You check it, fill in the placeholders and decide what applies in your company.