EU AI Act Article 4: AI Literacy as a Competency Strategy

What Article 4 asks for, in one sentence

Under Article 4 of the EU AI Act as amended by Regulation (EU) 2026/1744, providers and deployers should support their staff to building up adequate AI competency, proportionate to the systems they work with and the people affected by them.

The original duty entered into force on 2 February 2025. The Digital Omnibus reframed it: instead of a hard guarantee of a "sufficient level" of literacy, it is now a duty to actively support the development of competency. That is a lower legal bar and a higher practical one, because competency is something you keep building, not something you certify once.

Why competency, not literacy, is the right target

Literacy is a threshold: people know what an AI system is and where it can go wrong. Competency is a capability: people can choose the right tool, judge its output, escalate when it is wrong, and stop using it when it stops being appropriate.

The gap matters because the tooling moves faster than any curriculum. A team trained on last year's assistant is working with a different product today - new modalities, new autonomy, new failure modes. An organisation that treats Article 4 as an annual slide deck will always be a release cycle behind. One that treats it as competency development keeps pace, and gets the productivity upside that the training was supposed to unlock in the first place.

Regulators are not the only reason to care. Competent teams produce fewer incidents, fewer shadow deployments, and far better procurement decisions.

Who is covered

• Providers - organisations that develop or place an AI system on the EU market under their own name.
• Deployers - organisations that use an AI system under their authority in a professional context.

"Staff" is read broadly: employees, contractors, and anyone operating the system on the organisation's behalf.

What "adequate" means

The Act prescribes no curriculum. Adequacy is proportionate to the technical knowledge of the people involved, the context of use, and the people on whom the systems are used. A clinician using a triage tool and a developer fine-tuning it need different competencies, not different lengths of the same course.

A competency model that holds up

Tier the programme rather than flattening it:

1. Everyone - what AI is, what your organisation permits, how to report a problem.
2. Frequent users - prompt and output hygiene, hallucination and bias awareness, automation bias, when human judgement must override.
3. Owners and approvers - risk tiers, prohibited practices, Article 50 transparency duties, procurement and vendor questions, records.
4. Builders and providers - documentation, human oversight design, post-market monitoring, incident reporting.

Then tie refreshers to events rather than the calendar: a new tool, a new use case, a new model version, or a serious near miss should each trigger an update. An annual cadence on top of that is a floor, not the plan.

How to evidence it

• A written competency policy signed off at management level, naming the tiers and who owns them.
• Records of what was delivered, to whom, and when - including contractors.
• Role-based materials rather than one-size-fits-all.
• A change log linking tool adoption to the competency update it triggered. This is the artefact that shows you supported development rather than ran a course once.

Common mistakes

• Reusing a GDPR module and calling it AI competency.
• Training IT while the business teams do the actual prompting.
• Leaving external contractors out of scope.
• Delivering the training and never recording that it happened.
• Treating the softened wording as permission to do nothing - supervisory authorities will still ask what you did.

---

Related: AI competency programmes · EU AI Act overview · Free readiness assessment