EU AI Act Article 4 Is Live: Building an Audit-Ready AI-Literacy Programme

Since 2 August 2026, national market surveillance authorities across the EU can walk into your organisation and ask a question most engineering teams have never prepared for: what measures have you taken to ensure your staff — and your contractors — are AI-literate? Article 4 of the EU AI Act has been in force since February 2025, but enforcement went live this August. It is the only obligation in the Act that applies to every provider and deployer of AI, regardless of risk class, and it is now actively supervised.

If your organisation runs a customer-service chatbot, uses GitHub Copilot, or deploys an internal RAG assistant, Article 4 applies to you. Not to your HR department — to you.

What Article 4 Actually Requires

Article 4(1) obliges providers and deployers of AI systems to take measures supporting the development of AI literacy — defined in Article 3(56) as the skills, knowledge and understanding that allow for informed deployment of AI systems and awareness of their opportunities and risks. Three scope details catch teams out:

• It covers contractors. The duty extends to "other persons dealing with the operation and use of AI systems on their behalf" — the Commission's Q&A explicitly names contractors, service providers and, notably, clients using your systems on your behalf.
• There is no de minimis carve-out. A two-person startup using off-the-shelf GenAI for marketing copy is in scope, as the Commission confirmed in its February 2025 webinar.
• It is an obligation of effort, not result. The Digital Omnibus on AI, in force since mid-July 2026, amended Article 4 to make this explicit: no specific literacy level is mandated, and you are not required to guarantee any individual's competence.

The Commission's Q&A sets out minimum expectations: ensure a general understanding of AI across the organisation; clarify your role in the AI value chain (provider or deployer); identify the risks of the systems you use; tailor training to staff's existing technical knowledge and the context of use; and cover legal and ethical issues. The Commission also states plainly that simply asking staff to read a system's instructions for use "might be ineffective" — a hint at where the bar actually sits.

The Enforcement Timeline

Date	What happens
2 Feb 2025	Article 4 duty and Article 5 prohibitions apply
2 Aug 2025	GPAI model obligations apply; penalties chapter in force
2 Aug 2026	Enforcement architecture activates: national market surveillance authorities gain supervisory powers; Article 50 transparency duties enforceable
Mid-Jul 2026	Digital Omnibus amendments to Article 4 in force (effort-based duty)
2 Dec 2027	Annex III high-risk obligations (delayed from Aug 2026 by the May 2026 Omnibus deal)
2 Aug 2028	Annex I embedded high-risk obligations

The practical consequence of the May 2026 delay: today's enforcement risk concentrates on exactly three things — prohibited practices, Article 50 transparency, and Article 4 literacy. High-risk regime compliance has been pushed down the road; literacy has not.

What a Breach Actually Costs

Article 4 appears in none of the penalty tiers of Article 99. Breaches are sanctioned under national rules each member state was required to adopt, so there is no EU-wide ceiling tied to literacy failures. Before you relax, note how it compounds:

Tier	Breach	Ceiling
1	Article 5 prohibited practices	€35M or 7% global turnover
2	Articles 16, 22–24, 26, 31, 33, 34, 50 (provider/deployer obligations, transparency)	€15M or 3%
3	Misleading information to authorities	€7.5M or 1%
—	Article 4 literacy	National rules, no EU ceiling

Article 99(7) obliges authorities to weigh "the technical and organisational measures in place" when setting any fine. An Article 4 failure that contributes to a downstream incident — a biased high-risk decision under Article 26, an undisclosed chatbot under Article 50 — becomes an aggravating factor in a tier-2 case. Conversely, a documented literacy programme is mitigation. For SMEs and start-ups, every fine is capped at the lower of the fixed amount and the turnover percentage.

The Evidence Gap Nobody Is Measuring

We analysed a 12,422-paper research corpus on AI literacy (1984–2026, arXiv, OpenAlex and publisher records). The momentum numbers are unambiguous: compliance-and-AI-Act research is the fastest-growing category at +175% year over year, with 69% of all 913 papers published in the last twelve months. The research community has noticed.

What it has not done is evaluate. Across the corpus, evaluation-oriented work is the thinnest aspect in nearly every category: the compliance×evaluation cell contains five papers. Ever. Organisations are building literacy programmes at record pace, and almost nobody is measuring whether they work. The effort-based regime the Digital Omnibus introduced is, in effect, the regulator conceding this point: what you must evidence is measures taken, not outcomes achieved. Your audit trail — not your quiz scores — is the compliance artefact.

Engineering It Like a Service

You already run systems that produce audit evidence continuously: version control, CI, structured logs. Treat Article 4 the same way. The core artefact is a literacy evidence register:

# literacy-register.yaml — one entry per role touching AI systems
- role: "Platform Engineer"
  touches: ["internal-rag-assistant", "github-copilot"]
  literacy_tier: 3            # 1 awareness → 3 builds/operates AI systems
  training:
    - course: "ai-literacy-training.org — tier 3 module set"
      version: "2026-09"
      completed: 2026-09-14
      certificate_id: "AIL-2026-0914-0417"
  refresher_due: 2027-09-14
  notes: "includes prompt-injection incident escalation drill"

- role: "Support Agent"
  touches: ["customer-chatbot"]
  literacy_tier: 1
  training:
    - course: "ai-literacy-training.org — tier 1 module set"
      version: "2026-09"
      completed: 2026-09-02
      certificate_id: "AIL-2026-0902-1188"
  refresher_due: 2027-09-02

Validate it in CI so the register can never silently rot:

python3 -c "
import yaml, sys, datetime
reg = yaml.safe_load(open('literacy-register.yaml'))
today = datetime.date.today()
for e in reg:
    assert e['training'], f\"{e['role']}: no training record\"
    if e['refresher_due'] < today:
        print(f\"WARN {e['role']}: refresher overdue\", file=sys.stderr)
print(f'{len(reg)} roles, register valid')
"

Version the training material and hash it into the record — when a regulator asks what a "tier 3 module" contained in March 2026, git history answers. That single property separates a defensible programme from a folder of PDF certificates.

A minimum defensible set, per the Commission's own guidance:

1. A written AI-literacy policy referencing Article 4
2. An inventory of every role — employee and contractor — touching AI systems, with the literacy tier each requires
3. Role-tiered training content, refreshed on a cadence proportionate to system risk
4. Completion records with dates and material versions
5. Separate oversight-competence records for anyone seated at an Article 26 human-oversight console (those matter from December 2027)

If building curriculum from scratch is not where your team creates value, off-the-shelf programmes now map directly onto this evidence structure — for English, ai-literacy-training.org offers 16 lessons with 300+ practice questions and audit-ready certificates; the German-language equivalent is ki-kompetenz-training.org. Either slots into the register above as a versioned course entry. What no vendor can do for you is the role inventory and the refresher cadence — those require knowing your own systems.

Start Here

• This week: write down every AI system your team operates or uses, and every role that touches it. That inventory drives everything else.
• This month: assign literacy tiers, enrol staff and contractors, and put the evidence register under version control with CI validation.
• Ongoing: set refresher cadences, and trigger re-training when you ship a new AI system or an incident occurs — the Commission expects literacy to track context, not a calendar alone.

Article 4 is the rare compliance obligation engineers can genuinely meet with engineering: versioned artefacts, continuous validation, audit trails by construction. The authorities start asking in earnest now; the register is the answer.