AI Literacy: what Article 4 already demands from your company

Article 4 of the EU AI Act (Regulation (EU) 2024/1689) has required, since 2 February 2025, that any company providing or using AI systems ensure its staff have a sufficient level of AI literacy. This isn’t a rule that only concerns model builders: it also covers the small business running a customer-service chatbot, a writing assistant, or a supplier-scoring tool. At Evicron, an AI and custom software studio based in Barcelona, this is the question we hear most from clients who already handled the Article 50 transparency rules and only then discovered a second, older, less talked-about obligation that applies to them too.

What Article 4 actually requires

The text doesn’t mandate a specific course or a set number of training hours. It requires providers and deployers — whoever builds the AI system and whoever uses it under its own authority — to take measures so that their staff, and anyone operating the system on their behalf, understands enough about how it works, what can go wrong, and what human oversight it needs. The law says those measures must account for three things: each person’s prior technical knowledge, the context in which they’ll use the system, and who the system’s use could affect. A salesperson using an assistant to summarise emails doesn’t need the same training as the person reviewing decisions from a CV-screening system.

Since when, and who it applies to

This is where most confusion starts: Article 4 has been in force since February 2025, well before the Article 50 transparency rules (August 2026) and the high-risk obligations now delayed to December 2027 — something we covered when the AI Act’s timeline shifted. It’s one of the few obligations in the Regulation that applies to every AI system, not just high-risk ones, and it doesn’t scale down by company size: a freelancer with a chatbot on their website falls under the same article as a bank running a credit-scoring system, even if the proportionate measure looks very different in each case.

What the Digital Omnibus changed in July 2026

The Digital Omnibus package, in force since 27 July 2026, reworded Article 4 on one specific point: it shifted from an obligation of result — “make sure your people reach a sufficient level” — to an obligation of means — “take reasonable measures to support that level, and document them”. That’s not a cosmetic change. Before, a company had to be able to show its staff knew what was necessary; now it has to show it did what was reasonable to get them there, even if the outcome isn’t perfect across the board. What hasn’t changed is the underlying duty: doing nothing is still not an option, and for high-risk systems, Article 26 still requires sufficiently trained personnel and effective human oversight.

What your company should actually do

1. Inventory every AI system your staff actually use. Not just the tool IT purchased — also the one marketing adopted on its own, or the chatbot customer service installed without telling anyone. Shadow AI is usually the biggest blind spot here.
2. Group people by role and risk, not by department. Someone who only queries a writing assistant needs a one-hour briefing; someone overseeing automated decisions about people needs specific, recurring training.
3. Design a proportionate measure and put it in writing. It can be an internal session, a best-practices document, or tailored AI training; what the law requires after the Digital Omnibus is being able to show what was done and when, not a certificate per employee.
4. Revisit the measure whenever the system or the team changes. Staff trained in 2025 on a simple chatbot aren’t necessarily up to date if that same system gains new capabilities in 2026.

Who enforces it

Enforcement falls to the same market surveillance authorities that already oversee Article 50 transparency. In Spain, that’s AESIA, which we cover in detail in what AESIA is and what it means for your business. There’s no public record yet of fines specifically for breaching only Article 4 — it tends to surface alongside other breaches once a case is opened — but having no documented measure at all is, on its own, a weak spot if AESIA requests evidence for any other reason.

How we handle this at Evicron

We don’t sell a generic “AI 101” course that’s identical for every company. We start with the same inventory recommended above, as part of our AI consulting: which systems exist, who uses them, and at what level of risk. From there, AI training is tailored to each team’s actual role, starting from €1,500/day, and documented in the way Article 4 now requires after the Digital Omnibus.

We’ve worked with companies across twelve sectors throughout Europe since 2019. If you’re not sure whether your staff already meets the AI literacy bar — or don’t even know where to start — get in touch: the first discovery session is free, and we reply within 24 hours.