Point of law
AI literacy under Art. 4 AI Act
Art. 4 AI Act requires a sufficient level of AI literacy and names five circumstances by which that level is measured. Three of those circumstances differ from person to person and from deployment to deployment. The necessary training scope therefore follows the system in use, from a general basic course up to an in-depth session for complex applications. The duty has applied since 2 February 2025 to every deployment of AI systems and not only to high-risk ones.
One session for everyone, whatever the task
Staff received an hour of instruction on artificial intelligence in the spring, all of them the same session. The attendance list is on file. Whether the duty under the Regulation is thereby met cannot be answered from that list.
Five circumstances determine the sufficient level
What Art. 4 AI Act actually requires tends to be cut down on reading to the first third of the sentence. The provision names no format and no number of hours, but an outcome and five circumstances by which that outcome is measured. What is owed is a sufficient level of AI literacy, ensured to the best of the organisation’s ability for its own staff and for other persons dealing with operation and use on its behalf, contractors included.
The five circumstances by which the level is measured
Liste zu erledigender Punkte
- Technical knowledge
- Experience
- Education and training
- The context of deployment
- The persons on whom the systems are to be used
What AI literacy means in substance is set out not in Art. 4 but in Art. 3(56) AI Act. What is called for there are skills, knowledge and understanding that allow an informed deployment and create an awareness of opportunities, risks and possible harm.
A single session does not last
How often training needs repeating is usually treated as settled once a certificate of attendance exists. But Art. 4 AI Act requires staff to have a sufficient level of AI literacy, not to have had one. Where the system in use, the task or the persons involved change, retraining follows so the level is maintained.
How we support you with training
The necessary depth follows the use case, not the workforce as a whole. A language model used for drafting text calls for a different depth than a system that proposes findings in radiology or pre-sorts candidates in recruitment. Training therefore starts from the particular system and scales from a general basic course up to an in-depth session for complex AI applications.
Frequently asked questions
Whom exactly does the duty bind?
Providers and deployers, in respect of their staff and of other persons dealing with the operation and use on their behalf. It therefore covers employees who merely apply a system, and contractors working with it on their behalf.
Is there a fine for breaching Art. 4 AI Act?
Not directly under Art. 99(4) AI Act, because the list there does not name Art. 4 AI Act. Under paragraph 1 the member states nonetheless lay down rules on penalties for infringements of the Regulation. What matters more in practice is that human oversight under Art. 26(2) AI Act presupposes competence, and breaches of Art. 26 are expressly subject to fines.
How can compliance be shown?
Through the allocation, not through the attendance list. Compliance is demonstrable where it is recorded, role by role, which systems that role works with, what level was determined for it and how that level is reached. An attendance list without that allocation says nothing about a sufficient level.
Is a data protection training enough?
No, and the other way round just as little. Art. 39(1)(b) GDPR assigns awareness-raising and training on the processing operations to the data protection officer. Art. 3(56) AI Act names alongside that an awareness of opportunities, risks and possible harm. The two subjects overlap but do not coincide.
Get in touch!
Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!
Contact usAlternatively you can request a call back.