When the EU AI Act entered into force in August 2024, most compliance attention immediately gravitated toward its high-risk provisions: the risk classifications, the conformity assessments, the technical documentation requirements. Article 4, tucked near the beginning of the regulation, attracted far less scrutiny. It is, after all, just one sentence long.
That sentence, however, has generated a disproportionate amount of confusion, overinterpretation, and — now — legislative backtracking. Understanding what Article 4 actually requires, where it has been misread, and what companies can realistically do to comply tells us something important not just about AI literacy as a concept, but about how the EU is recalibrating its approach to AI regulation more broadly.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
What Article 4 Actually Says
The full text of Article 4 reads: “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”
Several features of this text deserve attention before moving to interpretation.
First, the obligation is explicitly softened by the phrase “to their best extent.” This is not an absolute duty. It is a proportionate, effort-based obligation — meaning good-faith measures that reflect the scale and nature of the organisation’s AI use will satisfy it, even without perfect outcomes.
Second, it applies to both providers and deployers. The former develop or place AI systems on the market; the latter use them in a professional capacity. This means the obligation is not confined to AI companies. Any business using an AI-powered tool — a recruitment platform, a customer service chatbot, an accounting assistant — is a deployer and is therefore subject to Article 4.
Third, and critically, the obligation applies to all AI systems regardless of risk level. There is no threshold below which Article 4 becomes irrelevant. The café using an AI scheduling tool and the hospital using an AI diagnostic system are both covered, albeit with vastly different practical expectations.
Where Article 4 Sits in the Broader Act
Article 4 does not operate in isolation. It draws its definition of AI literacy from Article 3(56), which describes literacy as “skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.” This definition is intentionally broad — encompassing not just technical understanding but also ethical, legal, and social dimensions of AI use.
Recital 20 elaborates further, framing AI literacy as the capacity to make informed decisions about AI systems at every stage of their lifecycle, from development through deployment and oversight. Importantly, it explicitly names affected persons — those subject to AI-assisted decisions — as also deserving of literacy, though this does not translate into a direct obligation for companies to educate their customers.
The article also reinforces two other key provisions: Article 13 (transparency and information to deployers) and Article 14 (human oversight). Both of those articles require people interacting with AI systems to actually understand what they are doing. Article 4 is, in this sense, the enabling condition for meaningful compliance with the rest of the Act.
The Scope Question: How Far Does “On Their Behalf” Reach?
The most contested interpretive question around Article 4 concerns its scope. The provision covers not just staff but “other persons dealing with the operation and use of AI systems on their behalf.” Lawyers and commentators have debated intensely who falls within this perimeter.
The Commission’s own FAQ document, published in May 2025, offered an expansive reading, citing contractors, service providers — and clients — as examples of people who might fall within the scope of “on their behalf.” The client example in particular attracted immediate pushback from legal practitioners.
Travers Smith, a UK law firm that published one of the more rigorous analyses of the Q&A, put it diplomatically but plainly: “the notion that clients use AI systems on their supplier’s behalf is perhaps a surprising interpretation of the wording.” The phrase “on their behalf” implies acting as an extension of the company’s own operations — a contractor running your AI system, an outsourced team operating your AI-powered process. It does not naturally extend to a client who has purchased a product or service and is using it for their own purposes.
Notably, most serious legal commentary sidesteps the client question entirely, framing the scope as employees and contractors. The Commission’s FAQ is not legally binding. Article 4 is. When the two diverge, the text of the regulation controls. Companies should read the scope of Article 4 accordingly: their own staff, and third parties who genuinely operate their AI systems on their behalf — not their customer base.
The Commission Reconsiders: The Digital Omnibus Proposal
Article 4 came into application on 2 February 2025, but its trajectory was already shifting. In November 2025, the European Commission published its Digital Omnibus on AI — a package of simplification amendments to the AI Act — and Article 4 was squarely in its sights.
The proposal is direct: remove the binding obligation from companies entirely, and replace it with a duty on the Commission and Member States to *encourage* AI literacy initiatives through non-binding measures such as training resources, information campaigns, and the exchange of good practices. In the Commission’s framing, the original obligation proved “challenging to implement in practice, especially for smaller companies,” despite being considered a “strategic priority.”
The European Data Protection Board and European Data Protection Supervisor weighed in with a joint opinion expressing concern. Transforming a directly applicable legal duty into non-binding encouragement, they argued, risks undermining consistent implementation and weakens a safeguard designed to operate preventively — before harm occurs — rather than only through after-the-fact enforcement.
The proposal is currently moving through the ordinary legislative procedure and is unlikely to become law before mid-2026. Until then, the original Article 4 remains in force. But the direction of travel is clear: the Commission itself regards the current formulation as too burdensome and too vague to enforce meaningfully.
The Enforcement Picture
Even setting aside the proposed amendments, the enforcement landscape for Article 4 is notably soft.
There is no specific fine attached to Article 4 breaches. The AI Act contains no standalone penalty provision for non-compliance with the literacy requirement. Where Article 4 matters most in enforcement terms is as an aggravating factor: if a company’s high-risk AI system causes harm and an investigation follows, documented evidence that no literacy measures were ever in place will make the regulatory picture worse. Conversely, documented evidence of proactive training will provide meaningful mitigation.
Supervision and enforcement of the literacy obligation do not realistically begin until August 2026, when broader AI Act enforcement structures become operational.
For the vast majority of companies — those using AI tools that fall below the high-risk threshold — the practical exposure from Article 4 is genuinely limited.
High-Risk Systems: Where Literacy Has Real Teeth
The picture changes substantially for companies deploying high-risk AI systems. Here, AI literacy is not a stand-alone aspiration — it is embedded in concrete obligations.
Article 14 requires that high-risk AI systems be deployed with appropriate human oversight, and that persons responsible for oversight have the competence to understand the system’s behaviour, identify anomalies, and intervene when necessary. Article 26 imposes specific obligations on deployers of high-risk systems, including ensuring that designated staff are trained to operate them correctly.
A person mechanically interacting with a high-risk AI system every day without understanding its decision logic, its failure modes, or its limitations is not exercising meaningful oversight — regardless of how much hands-on experience they accumulate. For high-risk contexts, the Act clearly contemplates something more deliberate than organic familiarity: structured, role-specific training with documentation to match.
This is also where the documentation case becomes compelling independently of any regulatory pressure. If a high-risk AI system produces a harmful output and litigation follows, the question of what training the relevant staff received will be central. Companies that treated high-risk AI deployment as an IT implementation project rather than a governance challenge will find that uncomfortable to answer.
What Companies Can Realistically Deliver
Article 4’s flexibility cuts both ways. It creates uncertainty, but it also creates space for proportionate, sensible compliance that does not require significant investment for most organisations.
The most pragmatic approach — and the one emerging from the AI Pact’s repository of member practices — is a layered model.
At the base, a contextualised introductory course for all staff who interact with AI systems. Not a generic explainer on what artificial intelligence is, but a company-specific module: which AI tools the organisation uses, what those tools do within the organisation’s workflows, what staff are permitted and not permitted to do with AI at work, and where to raise concerns. This kind of onboarding module simultaneously creates a compliance record, communicates internal AI policy, and builds the operational awareness the Act is targeting.
On top of that baseline, role-specific training for those operating or overseeing AI systems in any meaningful capacity — heavier for high-risk systems, lighter for low-risk tools with limited downstream consequences.
Critically, organic learning from daily AI use should not be dismissed. A staff member who uses an AI drafting tool daily will develop practical understanding of its outputs, limitations, and appropriate use contexts. That is genuine literacy in the sense Article 4 intends. The introductory course frames and contextualises that organic learning; it does not replace it.
The documentation requirement is modest but non-negotiable. Records of what training was provided, to whom, and when. Not to prove perfection — the “best extent” standard does not require it — but to demonstrate that the obligation was taken seriously.
What This Means for SMEs
Small and medium enterprises are arguably in the most comfortable position under Article 4 as it currently stands — and will be more comfortable still if the Digital Omnibus amendments are adopted.
The obligation is explicitly proportionate to the organisation’s AI use and the knowledge level of its staff. An SME deploying a standard AI-assisted CRM tool has a radically different literacy obligation than a healthcare provider deploying a clinical decision-support system. The former’s compliance need is genuinely light.
For SMEs using only low-risk, mainstream AI tools — productivity assistants, translation tools, scheduling software — the combination of a brief contextualised onboarding module and reasonable documentation will comfortably satisfy Article 4 as written. No external certification is required. No AI officer needs to be appointed. The obligation scales with actual risk.
Where SMEs using high-risk AI systems need to invest more seriously, the investment is independently justified. Deploying an AI system that makes or influences consequential decisions without ensuring the people operating it understand what it is doing is a governance risk that would exist regardless of any regulation.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
Conclusion
Article 4 is, in the end, a proportionate obligation dressed in ambiguous language — which has predictably generated disproportionate anxiety. The Commission’s FAQ overreached on scope but the Commission is now in the process of walking back the provision’s binding character altogether.
What remains, for now, is a modest but real duty: ensure that the people in your organisation who interact with AI systems are equipped to do so with awareness, understanding, and appropriate skill. For most companies, a thoughtful onboarding programme and clear internal AI policies will achieve that. For those deploying high-risk systems, something more deliberate is both legally required and operationally prudent.
The weight of Article 4, in the end, is proportionate to the weight of the AI systems a company actually deploys. That is, broadly speaking, as it should be.
*This article is part of the AI Act Intelligence and Governance Deep Dives series. It reflects the state of EU AI Act implementation as of March 2026 and will be updated as the Digital Omnibus legislative process progresses.*
