The transparency duty that came later.
Article 4 AI literacy
AI literacy has been a duty since February 2025 — for every AI system, not just high-risk ones.
Last reviewed: 5 October 2026
Article 4 obliges providers and deployers to ensure a sufficient level of AI literacy among their staff and among anyone else operating or using AI systems on their behalf. It is the earliest obligation in the AI Act to bite, and it covers every AI system rather than only high-risk ones. The part most often missed: it follows the work rather than the payroll. If an agency operates an agent for your brand, the people doing it are inside the duty.
What the law requires
- Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf.
- Regulation (EU) 2024/1689, Art. 4
- Sufficiency is judged against the technical knowledge, experience, education and training of the persons concerned, the context the systems are used in, and the persons or groups the systems are used on.
- Regulation (EU) 2024/1689, Art. 4
- The duty is not limited to high-risk systems. It attaches to AI systems generally, which is what makes it the broadest obligation in the Act.
- Regulation (EU) 2024/1689, Art. 4 read with Art. 2
- Chapters I and II, which include Article 4, have applied since 2 February 2025.
- Regulation (EU) 2024/1689, Art. 113(a)
- Persons operating the system on your behalf are inside the duty, which pulls agencies, outsourcers and contact-centre staff in with your own employees.
- Regulation (EU) 2024/1689, Art. 4
What Audact does about it
- Who operated which agent, under whose account and at what time is on the record. That is the first thing an authority asks when it wants to apply the literacy duty to a named person rather than to a policy.
- Material written for the roles that actually touch the system: compliance officers, agency operators, supervisors and developers, rather than one course for everybody.
- In development
- Completion and knowledge-check results recorded against the operator's identity, in the same place as the operating record.
- In development
- Refreshers triggered by a change in the system or in the policy pack, not only by the calendar, because that is when literacy actually goes stale.
- In development
The overlooked scope
Sufficient is a relative standard, and that is deliberate.
Article 4 does not name a curriculum, a number of hours or a certificate, and reading that as vagueness is the mistake. It sets a relative standard: sufficient for these people, operating this system, on these subjects. A developer who tunes the policy pack and a receptionist who watches the handoff queue need different things, and giving them the same slide deck satisfies neither.
What an authority looks for is evidence that the question was asked and answered per role. That means a record of who was trained on what, when, and what changed since. That is a documentation problem long before it is a training problem.
For agencies
The duty travels with the work, not with the employment contract.
The wording covers persons dealing with the operation and use of AI systems on your behalf. For an agency running voice agents for client brands, that phrase points in both directions at once: the agency owes literacy for its own operators, and the client cannot assume the duty was outsourced along with the work.
In practice the cleanest arrangement is to make it explicit in the contract: who trains whom, to what standard, and where the record lives. That is a short conversation before the first campaign and a long one after an incident.
Note
Information, not legal advice.
This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.
Questions
- What does Article 4 actually require?
- That providers and deployers take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and among other persons dealing with the operation and use of their AI systems on their behalf.
- Since when has it applied?
- Since 2 February 2025, under Article 113(a). That is well ahead of the Article 50 transparency duties, which have applied since 2 August 2026.
- Does it only cover high-risk systems?
- No. That is the most common misreading. Article 4 attaches to AI systems generally, which makes it the broadest obligation in the Act and the one most organisations have no file for.
- Our agency operates the agent. Whose duty is it?
- Both parties have something to answer for. The wording covers persons operating on your behalf, so the agency owes literacy for its own operators and the client cannot treat the duty as outsourced with the work. Set it out in the contract, including where the training record is kept.
The record is the part nobody has
Every governed interaction already carries who operated it and under whose account. Proof shows what that record looks like and what part of it a third party can recompute.
Related
EU AI Act Article 50 Article 27 FRIA The assessment for listed high-risk use.
For agencies Where this duty lands hardest.
Assurance Pack Where the literacy record will live.
All frameworks