Every bank in the EU that uses AI agents must take measures, under Article 4 of the EU AI Act, so that staff and others acting for it have sufficient AI literacy. In banking that reaches from branch staff reading agent drafts to directors approving risk appetite, fitted to each role rather than one course for all.
What does Article 4 ask of a bank?
Article 4 applies to every provider and deployer of AI systems, high-risk or not. In substance, they must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. Sufficiency depends on those people's technical knowledge, experience, education and training, the context of use, and the people the systems are used on.
AI literacy here means the skills, knowledge and understanding to use AI systems in an informed way and to be aware of their opportunities, risks and possible harms. Whether the Act requires formal training is a common question, answered in does the EU AI Act require AI literacy training. For a bank, the practical answer is that measures without training are hard to evidence.
Who does it cover in a bank?
The article reaches staff and other persons acting on the bank's behalf. In banking that typically includes:
- Branch and contact-centre staff who read agent-drafted replies and send them.
- Operations staff who approve held payments and account changes.
- Credit staff who decide applications an agent assessed, a high-risk use where Articles 14 and 26 also apply.
- Compliance and AML analysts who work agent-prepared alerts.
- Technology and data staff who connect agents and set their bounds.
- Directors and senior managers who approve the use of agents and answer for it.
- Outsourced teams and contractors, such as offshore operations centres or agencies staffing contact centres, who use the bank's agents.
The question of who needs literacy in general is covered in who needs AI literacy under the EU AI Act.
What does literacy mean when a banking agent acts?
The difference between AI literacy for a chatbot and for an agent is the difference between reading and acting. A governed banking agent may read account data at depth 1, draft letters and payment instructions at depth 2, execute routine account maintenance at depth 3, and move money or take hard-to-undo actions at depth 4 within the bank's limits; above them, it may only draft, and a named person makes the payment. Literacy must cover that range.
Four ideas form the core for any banking role:
- Depth (per agent), and the depth each action needs. The same agent can be allowed to read a customer's history but only draft, never send, a complaint response. Staff must know which applies to what they see.
- The four verdicts. Allowed, held for a named person, refused as outside the agent's bounds, or withheld at the platform floor for every agent, such as reversing a settled payment on the platform's own rail. Only held actions are a reviewer's to decide.
- Provenance. A balance from the core banking ledger is sealed. A confirmation from a correspondent bank is signed. A customer's statement is declared. An emailed instruction is external, and an external claim cannot authorise a payment.
- Lapse. An agent's certificate lapses after 90 days; a lapse, or a run that clears no depth, drops it to depth 1 the same day. Staff must expect it and know what to do.
Beyond the core, literacy deepens by role. Credit staff need to recognise automation bias in their queues. AML analysts need to form their own view before closing an alert. Directors need enough to challenge management's account of where agents act and what happens when one fails.
How does a bank meet Article 4?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Sufficient literacy for staff | Core module for everyone using agents, plus role modules | Completion and assessment records by role |
| Persons acting on the bank's behalf | Outsourcing contracts require equivalent training before agent access | Contract clauses; provider training evidence |
| Fitted to knowledge and context | Modules use the bank's own agents and cases | Course map by business line |
| Awareness of risks and harms | Assessment on held actions, refusals and provenance | Assessment results |
| Kept current | Briefings at each agent recertification or change | Briefing records linked to agent changes |
| Board literacy | Director sessions on agent use and failure | Board minutes and attendance |
What will a supervisor ask?
Banking supervisors and market surveillance authorities may ask: how do you decide what literacy each role needs? Show the training for a sample of staff who approve held actions. How are outsourced teams trained? How do directors know what agents do? What happens when an agent changes; how do staff find out? For credit staff, they will also apply Articles 14 and 26: competence, authority and the ability to intervene.
What does Article 4 not cover?
It does not set a syllabus, hours or credential. It does not replace the competence duties for high-risk uses in Articles 14 and 26. It does not set banking rules on governance, conduct or model risk, which continue to apply. It does not cover customers' own literacy. And it does not require literacy about AI in general so much as about the systems the bank actually uses. Some banks use Pryme Intelligence Academy's Foundations badge as a common baseline, but the measures must still fit the bank's own agents. A general introduction to the law is in what the EU AI Act is, and sector comparisons in Article 4 in payments, in retail and our guide to AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is one AI awareness course enough for a bank?
Rarely. Article 4 asks for literacy fitted to role and context. A general course can be the base, but staff who approve agent actions need training on the agents they oversee.
Do agency staff in a bank's contact centre count?
If they use the bank's agents on its behalf, the bank must take measures for their literacy. Contracts with staffing agencies should say who trains them and how it is evidenced.
How should a bank record Article 4 measures?
Keep training and assessment records by person and role, linked to the agents they use, with dates before access was granted. Records that can be matched to the agent's decision record are the strongest evidence.