Article 4 of the EU AI Act (Regulation 2024/1689) has been in force since 2 February 2025. It requires every provider and every deployer of an AI system to reach a "sufficient level of AI literacy" among staff and contractors working with AI tools.
On 2 August 2026 national market-surveillance authorities gained formal supervisory powers over Article 4. The "everyone watched the ChatGPT webinar" slide will not survive the first supervisory query.
This article covers three things. First, what Article 4 actually asks for. Second, what changed in summer 2026. Third, two concrete programs — for a team of 30 and one of 90 employees.
What Article 4 requires
The duty is outcome-based, not process-based:
- Who is in scope. Every provider (organisations building AI) and every deployer (organisations using AI in operations). Practically that covers almost any company with a ChatGPT Enterprise licence, Microsoft Copilot, or an internal LLM integration.
- Who must be literate. Employees and "other persons dealing with the operation and use of AI systems on their behalf". Contractors, external consultants and temporary workers all count.
- What "sufficient" means. Calibrated to the person's existing knowledge, the context of use, and the groups exposed to the AI's effects (customers, applicants, patients).
The format is not prescribed. No mandatory certificate, no fixed hours. The entity itself proves it hits a level proportionate to risk.
What changed in summer 2026
Until 2 August 2026 the duty was formally in force but effectively toothless. That day national market-surveillance authorities gained supervisory powers over Article 4.
The Digital Omnibus, endorsed by the European Parliament on 16 June 2026, also softened the standard from "ensure a sufficient level" to "support the development of" AI literacy. Deadlines and enforcement dates stayed the same. The change is more rhetorical than substantive — supervisors still expect a documented, current program.
Fines
Article 4 carries no direct fine. Two enforcement paths still hit:
- General penalties under Article 99. Up to EUR 15 million or 3 % of global annual turnover for operator-duty breaches. Up to EUR 35 million or 7 % for the prohibited practices in Article 5. Enforceable since 2 August 2025.
- Civil liability. If an untrained employee uses an AI tool in a way that harms a customer or third party, that liability runs from 2 August 2025.
What HR must prepare
A supervisor will ask for four things:
- Inventory of AI tools in use. Who, which tools, for which tasks. Copilot inside Word is an AI tool. A chatbot embedded in a CRM is an AI tool.
- Inventory of roles and contexts. Who uses AI for which task, and which decisions are affected by that task.
- A curriculum keyed to context. Not a generic "AI 101" for the whole company. Developers need different content than an HR coordinator using AI to screen CVs.
- Attendance and comprehension records. Date, names, short knowledge check, refresh evidence.
Two concrete programs
Program 1: marketing agency of 30 employees
The team uses ChatGPT for copy, Midjourney for visuals, Notion AI for summaries. Low risk under the AI Act taxonomy. Program:
- Onboarding module (25 min) — what AI literacy is, why Article 4, prompt hygiene, what must not go into a prompt (client PII, IP, pricing strategy).
- Role-tailored module (15 min) — copywriters get authorship and hallucination coverage, designers get IP rules on generated images, account managers get client-facing AI disclosure.
- Quarterly 5-min refresher quiz with current examples (deepfake incidents, new Copilot changes).
- One-time written acknowledgement — every employee confirms they read the internal six AI-use rules.
Roughly 90 minutes per employee in year one, 25 minutes every year after. Evidence: LMS export, signed acknowledgements. Retention: three years.
Program 2: fintech of 90 employees
The company builds an AI-driven credit-risk scoring tool. It qualifies as a provider of a high-risk AI system. The program is deeper and split by role:
- Baseline module for everyone (45 min) — Article 4, Article 5 prohibited practices, internal governance flow.
- Engineering (2 hours) — technical requirements for high-risk systems, Annex IV documentation, model-monitoring duties.
- Business teams (30 min) — when an AI-driven decision must be explained to a customer, what sales can promise about the model.
- Management (60 min with outside counsel) — Article 99 penalties, civil liability, incident-reporting path to the EU AI Office.
- Semi-annual tabletop (60 min) — supervisor audit simulation, who prepares what within 48 hours.
Roughly 4–6 hours per employee per year, more for engineering and management. Separate record for contractor data scientists.
Three mistakes we keep seeing
- "Everyone signed the AI use policy." A signature is not literacy. A supervisor asks for evidence of understanding, not a PDF with signatures.
- "IT owns this." Literacy is measured at the end user. An HR coordinator using AI to screen CVs must recognise bias in the output.
- "One-time training is enough." Tools change monthly. The Copilot from June is not the Copilot from December. Regular refresh is not nice-to-have, it is a supervisory expectation.
For the wider view of overlapping training laws see Compliance training in 2026.
Where to start this week
If no program is in place, four steps take about five working days:
- Take an inventory of AI tools by department. Send an anonymous survey to department leads, not just IT.
- Classify use risk against Annex III of the AI Act. Most SMB use will land in minimal or limited risk.
- Write the first five internal AI-use rules you can test in a quiz.
- Book the first management session before the month closes — same pattern as NIS2 and GDPR.
What consolidation actually solves
AI-literacy supervision is not a user IQ test; it is a documentation test. An LMS such as Mentor keeps role-based content in one place, tracks comprehension and exports a report a national supervisor can validate in half an hour. Without evidence, even a sensible internal rule does not count at inspection.