AI Act Article 4: mandatory AI training, what companies must do

What exactly does Article 4 say?

In the version in force since 27 July 2026, Article 4, entitled "AI literacy", has three paragraphs. The first, the only one addressed to companies, provides that providers and deployers of AI systems "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". These measures take into account the technical knowledge, experience, education and training of those persons, the context of use and the persons on whom the systems are used.

The same paragraph states: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." Paragraphs 2 and 3 are addressed to the Commission, the Member States and the European AI Board, which must support companies (SMEs in particular) and publish practical examples.

What did the 2026 Digital Omnibus change?

The original 2024 version required measures "to ensure, to their best extent, a sufficient level of AI literacy". The European Commission proposed a simplification on 19 November 2025 (the "Digital Omnibus on AI"). Its proposal gave the task of promoting AI literacy to the Commission and the Member States. The text finally adopted keeps an obligation on companies, but rewords it.

	Original version (2 February 2025 to 26 July 2026)	Amended version (since 27 July 2026)
Wording	Measures to "ensure […] a sufficient level" of literacy	Measures to "support the development" of literacy
Nature	Close to an obligation of result	Obligation of means
Individual level	"Sufficient" level, undefined	No specific level required
Public support	Not provided for in the article	Commission and Member States, priority to SMEs

Regulation (EU) 2026/1744, signed on 8 July 2026, was published in the Official Journal on 24 July 2026. Its recital 8 justifies the change by the burden that strict obligations placed on small businesses.

Who is concerned?

Article 4 covers two categories defined in Article 3 of the Regulation. A provider is anyone who develops or has developed an AI system or model and places it on the market under its own name. A deployer is any natural or legal person, public authority or body "using an AI system under its authority", except for personal non-professional use.

A company whose employees use a chatbot, a translation tool or an AI feature built into business software is therefore a deployer. The Regulation sets no size or sector threshold. The European Commission confirms in its Q&A that a company whose employees use ChatGPT must comply with Article 4, at the very least by informing them of risks such as hallucinations.

"Other persons" covers people acting under the organisation's responsibility without being employees, for example a contractor or service provider, according to the same source.

What does "AI literacy" mean?

Article 3, point 56, defines AI literacy as the "skills, knowledge and understanding" that allow an informed deployment of AI systems and awareness of their opportunities, risks and the harm they can cause.

The phrase "sufficient level", at the centre of debate in 2025, was never quantified by the text and no longer appears in Article 4. The Commission's Q&A proposes a four-step approach rather than a threshold:

1. ensure a general understanding of AI within the organisation (what AI is, how it works, which tools are used);
2. take into account the organisation's role (provider or deployer);
3. take into account the risks of the systems used and what staff need to know to deal with them;
4. tailor actions to people's knowledge and the context of use, including legal and ethical aspects.

The Commission states that relying only on a tool's instructions for use is not enough. For high-risk systems, Article 26(2) remains stricter: human oversight must be assigned to people who have "the necessary competence, training and authority".

Is there a minimum number of training hours?

No. Neither the Regulation nor the Commission sets a duration, a standard programme or a certification. The Q&A states that no mandatory training or strict requirement is imposed, that there is no one-size-fits-all approach, and that Article 4 does not require employees' knowledge to be measured. Grids such as "two hours for everyone, six hours for regular users" that circulate do not come from the text or from the Commission.

Training remains the most obvious measure, but other means also meet Article 4: usage guides, on-the-job support, short sessions when a new tool is rolled out.

How should the measures taken be documented and proven?

The law imposes no format of proof. The Commission indicates that an organisation can keep an internal record of trainings and other guidance initiatives, and that no certificate is needed. In practice, a file that a third party can read often rests on the following elements (good practice, not legal requirements):

• an inventory of the AI systems used, by department and by use;
• identification of the populations concerned, including contractors;
• the measures chosen for each population and their justification in light of the risks;
• a record of the actions carried out: dates, content, participants, materials;
• internal usage rules (authorised tools, data not to be entered, human review of outputs);
• periodic review, especially when a new tool arrives.

The Commission maintains a public repository of company practices on AI literacy. It specifies that replicating these practices does not grant a presumption of compliance.

Under French law, two rules apply in addition, outside the AI Act. Article L6321-1 of the French Labour Code requires employers to maintain employees' ability to hold a job in light of changing technologies. In companies with at least 50 employees, Article L2312-8 requires the CSE (the employee representative body) to be informed and consulted on the introduction of new technologies.

Who enforces it and what is the risk?

Enforcement of Article 4 lies with national market surveillance authorities, not with the European AI Office. According to the Commission, they exercise their supervision and enforcement powers from 2 August 2026.

The amount of penalties for Article 4 is not set at EU level. Article 99 leaves it to Member States to define penalties that are "effective, proportionate and dissuasive". The ceilings of EUR 15 million or 3% of worldwide turnover (Article 99(4)) apply to a list of obligations that does not include Article 4. The Commission also points out that the AI Act creates neither criminal offences nor a right to compensation.

In France, as of 10 October 2026, the competent authorities have not yet been designated by law. The bill on various provisions adapting French law to EU law, adopted by the Senate on 18 February 2026, divides these tasks among several authorities, including the DGCCRF (consumer protection authority), the CNIL (data protection authority), Arcom (audiovisual and digital regulator) and the ACPR (banking and insurance supervisor). It is at first reading in the National Assembly.

What is the AI Act timeline?

Date	What applies
1 August 2024	Entry into force of the Regulation
2 February 2025	Chapters I and II: AI literacy (Article 4) and prohibited practices (Article 5)
2 August 2025	General-purpose AI models, governance, penalty regime
27 July 2026	Entry into force of the Omnibus (Regulation (EU) 2026/1744) and new wording of Article 4
2 August 2026	General application, including Article 50 transparency obligations; start of national supervision
2 December 2026	New prohibitions added by the Omnibus; marking of generated content for systems placed on the market before 2 August 2026
2 December 2027	High-risk systems in Annex III (including recruitment, workforce management, education and vocational training)
2 August 2028	High-risk systems embedded in regulated products (Annex I)