Fintechs often build and use AI agents, with small teams where one person writes code on Monday and approves held payments on Friday. Article 4 of the EU AI Act asks every provider and deployer to ensure sufficient AI literacy among staff and others acting for them. In a fintech, that literacy must follow people across hats, not job titles.
What does Article 4 ask of a fintech?
Article 4 applies to all providers and deployers of AI systems. In substance, they must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their knowledge, experience, education and training, the context of use, and the people the systems are used on.
AI literacy means the skills, knowledge and understanding to use AI systems in an informed way and to understand their opportunities, risks and possible harms. It applies whether or not the system is high-risk. A fintech's credit agent will also face Articles 14 and 26 because creditworthiness assessment of individuals is high-risk; its support and operations agents usually will not, but Article 4 still applies. The general explanation of the law is in what the EU AI Act is.
A fintech that builds its own agent and puts it into service may be a provider as well as a deployer, carrying provider duties for any high-risk system it builds. Literacy for the engineers who build is part of that.
Who does it cover in a fintech?
Fintech roles blur, so map literacy to activities rather than titles:
- Building and configuring agents: engineers, product managers and data staff.
- Reviewing held actions: operations staff, and often engineers or founders on rota.
- Customer-facing work: support staff and community managers using agents to answer customers.
- Compliance and risk: often a small team, sometimes outsourced, reviewing agent-prepared AML alerts and complaints.
- Founders and directors, who decide where agents act and answer to supervisors.
- Outsourced partners acting on the fintech's behalf, such as support centres or compliance consultancies using its agents.
Who needs literacy under the Act in general is set out in who needs AI literacy under the EU AI Act.
What does literacy mean in a fast-moving fintech?
Three features of fintech make literacy harder and more important.
Fast change. Fintechs ship often. An agent's sources, bounds or depth can change weekly. On a governed platform, depth is earned, not configured: the role sets a ceiling, evidence from certification sets the depth, and the lower wins. An agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. Staff must know that a change in the agent can change what they are reviewing, and how to find out what changed.
Builders who also review. An engineer who designed an agent may be the worst person to review its held actions, because they know what it is meant to do and see that instead of what it did. Literacy for builders must include the reviewer's discipline: read the facts and their provenance, not the intent.
Thin compliance cover. With small compliance teams, front-line staff often make first-line judgements. They need to recognise when an agent's refusal signals a compliance issue, such as a customer request outside the agent's scope, and route it rather than work around it. They need to know that an external claim, like an emailed instruction to change a payout account, cannot authorise a payment.
The core every fintech role needs:
- Depth, and what each depth allows.
- The four verdicts: allowed, held, refused, withheld, and what each asks of a person.
- Provenance classes: sealed, signed, declared, external.
- Lapse and drop to depth 1, and what manual cover looks like.
How does a fintech meet Article 4?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Sufficient literacy for staff | Core module for all; activity modules for building, reviewing, support, compliance | Records by person and activity |
| Persons acting on the fintech's behalf | Partner agreements require training before agent access | Contract clauses; partner evidence |
| Fitted to context | Training uses the fintech's own agents and products | Course map by product |
| Kept current with fast change | Release notes for agent changes go to reviewers before deployment | Change briefings linked to releases |
| Builders review with discipline | Builders on review rota trained and assessed as reviewers | Reviewer assessments for engineers |
| Directors understand use | Board sessions on agent depth, verdicts and lapses | Board minutes |
What will a supervisor ask?
Supervisors of payment, e-money and lending fintechs, and market surveillance authorities, may ask: who reviews held actions, and how were they trained, including engineers on rota? How do staff learn about agent changes? How are outsourced partners trained? Do founders understand where agents act? For credit products, they will test Article 14 and 26 competence as well.
What does Article 4 not cover?
It does not set financial regulation, which applies in full. It does not replace Articles 14 and 26 for high-risk credit uses, or provider duties for fintechs that build high-risk systems. It does not prescribe course content or credentials. It does not slow release cycles, but it does mean reviewers must keep up with them. Comparisons are in Article 4 in retail and in insurance; whether Article 4 requires training is addressed in does the EU AI Act require AI literacy training.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's tracks map onto fintech activities: Operator for people who review and run the workspace daily, and Builder for those who design, train and certify agents, earned through a proctored exam and a capstone agent certified in Attest to depth 2 or higher. Both credentials are valid for 12 months. Our guide to AI literacy and certification for people who work with agents explains how the tracks connect.
Questions people ask
Do engineers need AI literacy training?
Yes. They operate and configure agents on the fintech's behalf, and often review them too. Their literacy should include the reviewer's discipline, not only technical knowledge.
How can a ten-person fintech evidence Article 4?
Keep simple records: who was trained on what, when, and on which agents, plus briefings on agent changes. Proportionate evidence for a small firm is still evidence.
Is a fintech that builds its own agent a provider?
If it develops an AI system and puts it into service under its own name, it can be. Provider duties for high-risk systems then apply in addition to deployer duties.