Staff dealing with AI systems must have a sufficient level of AI literacy, and Article 4 of the EU AI Act makes every provider and deployer take measures to ensure it. For teams that brief, approve and oversee AI agents, sufficient means knowing what each agent can do, what it cannot see, and when to stop it.
What does Article 4 require?
Article 4 is short. Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other people dealing with the operation and use of AI systems on their behalf. What counts as sufficient depends on those people's technical knowledge, experience, education and training, on the context the systems are used in, and on the people the systems are used on.
The Act defines AI literacy in substance as the skills, knowledge and understanding that let people deploy AI systems in an informed way and be aware of the opportunities, the risks and the possible harm. Our short explainer on what AI literacy is covers the definition.
Three features make Article 4 unusual:
- It applies to all AI systems, not only high-risk ones. A drafting agent in a back office is in scope.
- It sits in the Act's general provisions and applies in the first phase, alongside the prohibitions.
- It sets an outcome, not a curriculum. You decide what sufficient means for each role and must be able to show your reasoning.
Who does it apply to?
Every provider and deployer, of any size, for any AI system. The duty extends beyond employees to contractors, outsourced service staff and anyone else operating or using AI systems on the firm's behalf.
For agents, the relevant population is wider than the people who build them. We think it has five roles, and the question of whether AI literacy applies to staff who supervise agents is settled for all of them:
- Briefers, who describe an agent's job and choose its sources and connections.
- Approvers, who release actions an agent has drafted or held.
- Overseers, who monitor agents and can stop them.
- Reviewers, in risk, compliance and audit, who challenge the agent's design and evidence.
- Recipients, who rely on an agent's output in their own work.
What does literacy mean for people who supervise agents?
Generic AI training covers how models work, why they make things up and why prompts matter. That is a start, but it does not tell an approver what they need to know at the moment of approval.
Agent supervision needs specific knowledge:
- Capabilities and depth. Which actions this agent can take, and which of them it may take without a person. An approver who does not know the agent can only draft cannot spot one that has been misconfigured to send.
- Sources and their trust. What the agent read, and which of those sources could have been written by an outsider. An approver must treat a figure from an emailed invoice differently from one in the ledger.
- Automation bias. The pull to agree with a confident, well-formatted draft. Approvers need practice disagreeing, with cases built to be wrong.
- What the record shows. How to read the reason an action was held and which limit triggered it.
- When and how to stop. Where the stop control is, who may use it and what happens to work in flight.
Approvers deserve particular care, because their sign-off turns a draft into an action. Our piece on AI literacy for staff who approve agent actions goes deeper into that role.
How do you meet Article 4 and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Measures taken to the best extent | Literacy policy setting a standard for each of the five roles | Approved policy with an owner |
| Account for knowledge and experience | Role-based training paths, with a baseline check before access | Assessment results per person |
| Account for context of use | Training on each specific agent a person supervises, not only general material | Agent-specific module records |
| Account for affected persons | Content on vulnerable customers and the agent's limits with them | Module content and completion |
| Cover non-employees | Contract clauses requiring literacy for outsourced staff | Contracts and supplier attestations |
| Keep it current | Refresh when an agent gains a capability or changes depth | Change-linked training records |
| Show it works | Sampled approvals checked for quality; approvers tested with seeded errors | Quality review results; detection rates on seeded cases |
The last row is the one most firms skip. Completion records show people sat the training. Approval quality shows they learned something. A supervisor faced with an approver who passed every draft in seconds will not be reassured by a certificate. The step-by-step method is set out in how to meet AI literacy duties for staff who supervise AI agents.
What will a supervisor or auditor ask?
- Who in your firm deals with AI systems, and how did you decide what each needs to know?
- Show us training records for the people who approve this agent's actions.
- Ask an approver: what can this agent do without you? What sources does it read?
- How do you know approvers are not rubber-stamping?
- What happened to training when the agent gained a new capability?
What does Article 4 not cover?
It does not prescribe hours, formats or certifications. It does not require everyone in the firm to be trained, only those dealing with AI systems on the firm's behalf, though in practice that group is large. It does not replace the specific competence the Act requires of people assigned to oversee high-risk systems, which is a separate and higher bar. And it does not make the firm's data governance someone else's problem: staff who choose an agent's sources need to understand the points in Article 10 on data governance. Our guide to AI agent regulation, mapped to controls places literacy alongside the other duties.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does AI literacy apply if we only use agents built by a vendor?
Yes. The duty sits on deployers as well as providers. The vendor's training material can help, but you must decide what your own staff need for the way you use the agents.
Is a one-off e-learning module enough?
Rarely. A general module may satisfy recipients with low exposure. Approvers and overseers need training on the specific agents they supervise, refreshed when those agents change.
How do we evidence literacy for contractors?
Put the requirement in the contract, ask the supplier to attest to training by role, and sample the contractor's work as you would your own staff's.