Utilities rely on contractors, field crews and control rooms as much as office staff, and Article 4 of the EU AI Act covers all who use AI agents for the company. Energy, water and gas firms must ensure everyone operating or using agents on their behalf has AI literacy fitted to their role and to the customers affected.
What does Article 4 ask?
Article 4 applies to all providers and deployers of AI systems, whatever the risk level. In substance, they must take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and other persons dealing with the operation and use of AI systems on their behalf. Sufficiency is judged against those people's technical knowledge, experience, education and training, the context of use, and the people the systems are used on.
AI literacy means the skills, knowledge and understanding to use AI systems in an informed way and to be aware of their opportunities, risks and possible harms. Whether this requires formal training is answered in does the EU AI Act require AI literacy training.
Utilities usually face heavier duties too. Agents acting as safety components in the supply of electricity, gas, heating or water may be high-risk, bringing Article 14 oversight and Article 26 deployer duties, discussed in Article 26 duties in energy and utilities. Many utilities are also essential entities under NIS2.
Who does it cover in a utility?
- Control room operators and engineers working with agents that read telemetry, propose switching or balance load.
- Field crews and their supervisors receiving agent-allocated jobs and agent-drafted work instructions.
- Contractors carrying out maintenance or metering work using the utility's agents or apps.
- Customer service and collections staff working with agents on billing, payment plans and debt.
- Asset and planning teams using agents to analyse network condition.
- Directors and senior managers accountable for safety and supply.
Contractors deserve emphasis. Utilities often outsource large parts of field work, and Article 4 reaches persons acting on the company's behalf, not only employees.
What does literacy mean across a utility?
Literacy here is not one thing. It splits along the line between agents that touch the network and agents that touch customers.
Network-facing roles. Operators need to know which actions an agent may take at which depth, which are held for them, and how to take manual control. A governed network agent might read telemetry at depth 1, draft switching plans at depth 2 and carry out pre-approved routine operations at depth 3, with anything that could interrupt supply held for a named operator. Operators must read the provenance of data behind a proposal: sealed readings from the utility's own systems, signed data from a neighbouring operator, or external feeds such as weather forecasts. An agent acting on an external feed that has gone stale can propose the wrong thing confidently.
Field roles. Crews and contractors need to understand that an agent-generated work instruction is a draft built from records that may be out of date, and that their own observation on site outranks it. They need to know how to report a wrong instruction so the agent's sources are corrected.
Customer-facing roles. Service and collections staff need to recognise customers in vulnerable circumstances, including those relying on powered medical equipment or prepayment meters, and know that agent-drafted debt messages or payment plans must be checked against that. Smart meter data is personal data, and staff must know what the agent may use it for.
Everyone. An agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. Routine operations and allocations then become manual. In winter peaks or storms, that is a capacity risk the whole organisation should understand.
How does a utility meet Article 4?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Sufficient literacy for staff | Core module plus role modules for control room, field, customer and planning | Completion and assessment records by role |
| Persons acting on the utility's behalf | Contractor agreements require agent training before app or agent access | Contract clauses; contractor training records |
| Fitted to the people affected | Vulnerability recognition for customer-facing roles | Assessment results on vulnerability cases |
| Awareness of risks and harms | Modules on stale sources, provenance and manual takeover | Drill and assessment records |
| Kept current | Briefings at agent recertification or network changes | Briefing records linked to agent changes |
A practical sequence for building this is set out in how to set up an AI literacy programme under the EU AI Act.
What will a regulator ask?
Energy regulators, market surveillance authorities and cybersecurity authorities may ask: how do contractors learn what the utility's agents do? Show training for the operators on a given shift. How do customer service staff recognise vulnerable customers in agent-handled cases? What happens when a network agent drops to depth 1 in a storm? How are directors briefed on where agents act?
What does Article 4 not cover?
It does not set safety, supply or licence rules. It does not replace Articles 14 and 26 for high-risk network agents. It does not set consumer protection rules on debt or disconnection, which apply independently. It does not prescribe course content or credentials. Some utilities use Pryme Intelligence Academy's Foundations badge as a shared baseline for office staff and contractors alike, but the measures must still match the agents in use. More on literacy in this sector is in what AI literacy means for utilities using AI agents, with a fast-moving comparison in Article 4 in fintech and the general model in AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do contractors' own employers have to train them?
The utility's Article 4 duty covers persons acting on its behalf, so the utility must take measures. In practice that means contract terms requiring training and checks that it happened.
What literacy does a field crew need?
Enough to treat agent instructions as drafts, trust their own observation on site, and report errors. It does not need to be long, but it must be practical.
Does Article 4 cover smart meter analytics agents?
Yes, if they are AI systems the utility deploys. Staff using their output need to understand what the agent infers and the data protection limits on its use.