Not in so many words, but in practice yes. Article 4 of the EU AI Act requires providers and deployers to take measures ensuring sufficient AI literacy among staff and others who operate or use AI systems for them. It does not prescribe a course. Training is the usual way to meet the duty and show you did.
What does Article 4 actually say, in substance?
Article 4 puts a duty on two groups: providers, who develop AI systems or place them on the market, and deployers, who use them in their own operations. Both must take measures so that the people dealing with the operation and use of those systems have sufficient AI literacy.
"Sufficient" is not a fixed standard. The Article asks you to take account of the person's technical knowledge, experience, education and training, the context in which the system is used, and the people on whom it is used. A claims handler approving an agent's settlement offers needs a different level from a marketing assistant using a drafting tool. The duty is about fitting literacy to the role, not ticking a box for everyone.
Who does it cover?
Three points are easy to miss:
- It applies to all AI systems, not only high-risk ones. A business using an agent to draft customer emails is covered as a deployer, even if the use is minimal risk.
- It covers more than employees. It extends to other persons dealing with the systems on the organisation's behalf, which in practice means contractors, temporary staff and outsourced teams.
- Providers and deployers carry it separately. A vendor's literacy measures for its own staff do not discharge your duty to yours.
For a closer look at which people fall in scope, see who needs AI literacy under the EU AI Act, and for the wider set of deployer duties, what the EU AI Act requires of deployers of AI agents.
What does sufficient literacy mean when the system is an agent?
Agents act, not just answer. That raises what "sufficient" means for the people around them. Someone overseeing an agent should understand, at the level their role needs:
| Literacy element | Why it matters for agents |
|---|---|
| What the agent may do, by capability and depth | So they know whether an action should have been held for them |
| Why an action was held, refused or withheld | So they do not route around a refusal by doing it by hand |
| Where each fact came from | So they do not approve an action that rests on an unverified external claim |
| That an agent's certificate can lapse | So they notice when its permitted actions shrink |
| How to stop the agent and escalate | So a problem is contained, not worked around |
The Act also requires, under Article 26, that deployers of high-risk systems assign human oversight to people with the necessary competence, training and authority, and Article 14 sets the design expectations for that oversight. Article 4 sits underneath both: it is the baseline for everyone, on top of which overseers of high-risk systems need demonstrable competence.
What does a good set of measures look like?
A proportionate programme usually has four tiers: general awareness for everyone, role training for people who use agents, tested competence for people who approve agent actions, and deeper training for those who design or own agents. Records of who was trained, to what level, and when they were last refreshed are what turn the measures into evidence.
Sector pieces show how the tiers vary: Article 4 AI literacy in banking and in payments. For the practical build, see how to set up an AI literacy programme under the EU AI Act.
Take an example
A mid-sized insurer deploys agents to draft claim settlement offers and answer policy questions. It gives every employee a short general module, trains claims staff on the claims agent's capabilities and limits, and requires claims handlers who approve offers to pass a test on real cases before they get approval rights. Contractors in its outsourced call team get the same role training as staff. It keeps a register of who reached which level, and refreshes training whenever an agent's depth or sources change.
None of that is spelled out in Article 4. All of it is a reasonable reading of "sufficient", "to their best extent" and "taking into account the context".
What does Article 4 not require?
It does not set a syllabus, a number of hours, an exam or an external accreditation. It does not require certification of individuals, although certification is a strong way to evidence competence for the people who approve. Pryme Intelligence Academy's free Foundations badge is one way to cover the general tier, but any measure must be judged against your own roles and context.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
The guide to AI literacy and certification sets out how literacy and certification fit together across an organisation.
Questions people ask
Does Article 4 apply to organisations outside the EU?
It can, where an organisation is a provider placing systems on the EU market or a deployer whose use falls within the Act's territorial scope. Check your position with counsel.
Is there a penalty for failing Article 4?
Ask counsel about the enforcement position in your member state. Whatever it is, a lack of literacy will weigh heavily if something goes wrong and a supervisor asks how staff were prepared.
Do we need to retrain when we change model provider?
Briefly, yes. A new model can fail differently, and the people overseeing the agent should know what to look for.