Who does Article 4 of the EU AI Act apply to?
Article 4 has been binding since February 2025, and most companies do not know whether it covers them. Who is in scope, who is not, and what «sufficient AI literacy» actually means.
The most common misreading of Regulation (EU) 2024/1689 is that it only concerns those who build artificial intelligence. Article 4 is not about that: it is about those who use it. That includes the accountancy firm drafting emails with ChatGPT, the workshop sorting invoices with an automated tool, and the HR team screening CVs with software that promises to save time.
What Article 4 actually says
«Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff.»
Regulation (EU) 2024/1689, Article 4
One word carries the weight: deployers. It is the role most organisations do not realise they occupy, because it sounds technical and in fact describes something very simple: using an AI system under your own authority in the course of a professional activity.
So who is in scope?
It applies to your organisation when these three conditions hold at once:
- Someone on your staff uses an AI system at work. You need not have bought or configured it: using it is enough.
- That use happens in the course of a professional, not personal, activity.
- The organisation is established in the European Union, or the system's output is used within it.
There is no size threshold. No exemption for small businesses or sole traders. A two-person practice using a writing assistant is in scope, exactly like a multinational.
What «a sufficient level of AI literacy» means
The Regulation sets no syllabus and no number of hours, and that open-endedness is what causes most of the anxiety. What it does define, in Article 3(56), is the objective: staff should have the skills, knowledge and understanding to deploy AI systems on an informed basis, and to be aware of the opportunities, risks and possible harm.
In practice that means anyone using AI in your company should know at least four things: what the tool in front of them can and cannot do, what data must never go into it, how to validate an output before relying on it, and when to stop and escalate to a human.
Since when is it enforceable
Article 4 has applied since 2 February 2025. There is no transition period for this particular obligation, unlike other parts of the Regulation that phase in until 2027.
Questions we get often
Is an internal memo pointing out that the Regulation exists enough?
No. The text speaks of ensuring a level of literacy, not of informing people that the rule exists. A memo does not evidence acquired competence, and an inspection asks for proof of training, not proof of notification.
If our supplier provides the AI tool, is the obligation theirs?
The obligation to train your staff is yours, because your staff are the ones using it. The supplier has its own obligations as a provider; those are different and do not replace yours.
How do you demonstrate compliance in an inspection?
With documented evidence: who was trained, in what, when, and with what result. A dated record and a verifiable accreditation per person is what turns a claim into proof.
Where to start
Before commissioning anything, it helps to know where you stand. Our free exposure assessment asks six questions and returns a report with your role under the Regulation, the articles that apply to you, and the date from which each obligation is enforceable. It is not legal advice, but it is enough to know whether you have a problem and how large it is.
This article is general information based on the text of Regulation (EU) 2024/1689. It is not legal advice and does not replace consulting a qualified professional: assessing a specific case depends on circumstances an article cannot capture.
Want to know whether Article 4 applies to you, and from when?
Take the free assessment