Telecoms operators that deploy AI agents must ensure their staff and contractors have sufficient AI literacy under Article 4 of the EU AI Act. For an operator that means care advisers, retail dealers, network operations staff and outsourced contact centres must understand what agents do with SIM swaps, porting, billing and network tickets, and when a person must decide.
What does Article 4 ask of a telecoms operator?
Article 4 places a duty on every provider and deployer of AI systems: take measures, to the best extent possible, to ensure a sufficient level of AI literacy among staff and others who operate or use AI systems on their behalf. What is sufficient depends on the person's background, the context of use and the people the system is used on.
Telecoms context is unusual on two counts. First, the operator holds a service people cannot easily do without, so errors land on everyday life: a wrongly suspended line, a missed emergency call, a number ported away. Second, some telecoms actions are attack targets. A SIM swap approved on false grounds hands a criminal the customer's one-time passcodes for banking. Literacy for staff overseeing those actions is a fraud control as much as a compliance duty.
Our article on what AI literacy means for telecoms operators using AI agents covers the operational side. Here we focus on what the rule asks and how to show it is met.
Who inside an operator is covered?
Article 4 covers people dealing with AI systems on the operator's behalf, which in telecoms is a long chain:
- Care advisers in chat, voice and social channels, who pick up held cases from service agents.
- Retail and dealer staff, often employed by third-party dealers, who sell contracts using agent-assisted credit and eligibility checks.
- Fraud and security teams who review held SIM swaps, porting requests and account changes.
- Billing and collections staff who release agent-drafted credits, payment plans and disconnection notices.
- Network operations staff whose agents read alarms, correlate faults and draft trouble tickets.
- Outsourced contact centres, in or outside the EU, handling your customers.
Dealer staff and outsourced centres are where most operators have no visibility. The duty follows the work, not the employment contract.
What competence does the rule imply for telecoms agents?
Training must match what the agents actually do. For a typical operator, that means teaching each role the following.
Which actions are hard to undo. A SIM swap, a port-out authorisation or a line suspension is depth 4 territory: hard to reverse, with real harm if wrong. Staff should expect these to be held for a named person, never allowed silently. An adviser who sees one go through without a hold should raise it at once.
What a verdict tells them. A held SIM swap is waiting for their judgement. A refused credit was beyond the agent's bounds. A withheld action is blocked at the platform floor for every agent at every depth. Advisers who understand the difference stop treating refusals as faults to work around.
How to weigh evidence. A customer's statement that they lost their phone is declared. A device check from the network is sealed. An emailed letter claiming to be from a customer's employer is external and cannot authorise a change on its own. Staff must read the provenance the agent shows, not just the conclusion.
Social engineering aimed at agents. Fraudsters test chat agents with urgency, invented account history and impersonation. Fraud teams need practice spotting a conversation built to push the agent towards a swap.
Vulnerable customers. Disconnection and collections agents meet people in hardship. Staff releasing those actions need to recognise signs the agent may have missed.
Network context. Operations staff reading agent-drafted fault summaries must know which telemetry the agent saw and which it did not, before they dispatch an engineer or declare an outage.
How can an operator meet Article 4?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Sufficient literacy for each role | Role standards for care, dealer, fraud, billing, network and outsourced staff | Approved literacy policy with an owner |
| Context of use | Training on each agent, its certified depth and its held actions | Agent-specific assessment results |
| People affected | Modules on vulnerable customers, disconnection and fair treatment | Module records; sampled releases |
| High-harm actions | Only current, trained fraud staff may release held SIM swaps and port-outs | Release log with approver and training status |
| Third parties | Dealer and outsourcing contracts require role literacy and attestation | Attestations; audit samples of third-party releases |
| Show it works | Seeded social engineering cases in review queues | Detection results by team and site |
| Keep it current | Retraining when an agent gains a capability or a new fraud pattern appears | Change-linked training records |
The seeded case row deserves attention. A fraud reviewer who has never seen a planted swap request will not catch the real one on a busy evening. Whether the Act requires AI literacy training as such is debated; that it requires measures you can evidence is not.
What will a supervisor or auditor ask?
- Which customer and network actions do your agents take, and which are held?
- Who released this SIM swap, and what training had they completed?
- How do dealer staff learn what the eligibility agent decides?
- Show us how outsourced centres are trained and sampled.
- What changed in training after the last fraud pattern?
- Does the board understand which agent actions are hard to undo?
The last question is increasingly a governance one. The argument that the EU AI Act made AI literacy a board question applies to operators whose agents can cut off a customer's line.
What is outside the scope of Article 4?
It does not set content, hours or certification. It does not replace NIS2, which imposes its own cybersecurity risk management and incident reporting duties on operators within its scope, including training. It does not cover telecoms consumer rules or data protection law, which apply separately. And it does not set the higher standard for high-risk systems; if an operator uses an agent for credit scoring of individuals, that use is listed in Annex III and brings Article 14 oversight duties with it.
Retailers selling devices on credit face similar questions; see Article 4 for AI agents in retail. Insurers bundling device cover can compare Article 4 for AI agents in insurance. The general method is in our guide to AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do network engineers need AI literacy if agents only draft tickets?
Yes, at a lighter level. They act on what the agent wrote, so they must know which data the agent read and when to check the alarms themselves.
How do we cover dealer staff we do not employ?
Make literacy a contract condition, give dealers short modules on the agents they use, and sample their agent-assisted sales and checks.
Is SIM swap review an AI literacy issue or a fraud issue?
Both. The fraud risk is old; what is new is that an agent prepares the case. Reviewers must understand how the agent reached its view before they release it.