EU AI Act Article 4: AI Literacy Readiness Benchmark (2027)

Article 4 of the AI Act, as replaced by Article 1, point 5 of Regulation (EU) 2026/1744, requires providers and deployers to take measures to support the development of AI literacy, and it no longer requires any specific level of literacy. National market surveillance authorities supervise the provision from August 2026, so Article 4 readiness is shown through documented measures rather than through test results. The benchmark in this publication scores those measures across seven evidence dimensions and links its highest level to the deployer obligations for high-risk systems that apply from 2 December 2027.

What the Amended EU AI Act Article 4 Can and Cannot Be Scored Against

Paragraph 1 of the replaced Article 4 covers staff and other persons dealing with the operation and use of AI systems on the organisation’s behalf. The measures must take into account those persons’ technical knowledge, experience, education and training, the context in which the systems are used, and the persons or groups on whom the systems are used. The paragraph closes with a sentence stating that the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual. Paragraph 2 obliges the Commission and the Member States to support providers and deployers, in particular SMEs, including through practical examples of compliance on the single information platform. Paragraph 3 tasks the AI Board with recommendations that take European competence frameworks into account and set out common objectives.

Recital 8 of the same regulation explains the shift. Stakeholder experience, the recital states, showed that stringent obligations to ensure a sufficient level of AI literacy would not suit every type of provider and deployer and added compliance burden for smaller enterprises, while AI literacy should remain a strategic priority regardless of regulatory obligations and potential sanctions. The legislator therefore moved Article 4 from an outcome the organisation had to reach to an effort the organisation has to make and be able to describe.

The Commission’s AI literacy questions and answers (last updated 27 July 2026) adds that Article 4 does not entail an obligation to measure employees’ knowledge of AI. As analysis rather than a statement of law, a readiness benchmark that scores individuals’ test results would measure something the provision does not require. A defensible benchmark scores the organisation’s measures: what was identified, who was addressed, what was delivered and what was recorded.

How Enforcement Reaches Article 4: Authorities, Dates and Penalty Rules

Supervision and enforcement of Article 4 sit with national market surveillance authorities, not with the AI Office, according to the Commission Q&A. The same page states that supervision and enforcement apply from August 2026 and names 3 August 2026 in one answer and 2 August 2026 in another, so the date cannot be cited to a single day from that source.

Penalties are a matter for national law. Article 99(1), as replaced by the Digital Omnibus, requires Member States to lay down rules on penalties and other enforcement measures, which may include administrative fines, warnings and non-monetary measures, and requires those penalties to be effective, proportionate and dissuasive. The Commission Q&A adds that sanctions must be proportionate to the individual case, taking account of the nature and gravity of the infringement and whether it was intentional or negligent, and that a sanction may be more likely where an incident can be traced to a lack of appropriate training and guidance. The Q&A also states that the AI Act creates no criminal offence and no right to compensation, leaving harm claims to national law.

The Q&A’s emphasis on incidents suggests that the records most likely to carry weight are those connecting a specific system and role to a specific measure. That reading is analysis; no published enforcement position states it.

Seven Dimensions of Article 4 Readiness

The first six dimensions below are taken from the factors in Article 4(1) and from the steps the Commission Q&A says providers and deployers should consider, with oversight training added for high-risk deployments. The seventh is an editorial addition, flagged as such. Each dimension is scored on its own, because an average across dimensions can hide a missing record.

The scale below is an editorial convention for scoring each dimension. It is not drawn from the AI Act, the Commission guidance or any standard.

Mapping role and systems (dimensions 1 and 2)

The Commission Q&A frames the starting analysis as four questions: what the organisation understands about AI generally, whether it provides or deploys systems, what risks the systems it provides or deploys carry, and what its measures should therefore address. The Q&A states that these considerations include legal and ethical aspects and that links to the AI Act and to principles of ethics and governance are encouraged. It also states that the AI Act applies to actors outside the EU when a system is placed on the Union market, used in the Union or has an impact on people located in the EU, and that this extends to Article 4.

The Q&A gives a concrete case for generally available tools: employees who use ChatGPT to write advertisement text or translate should be informed about specific risks such as hallucination. An inventory that omits such tools leaves dimension 2 at level 1 even where formal training exists for other systems.

Differentiating measures by role (dimension 3)

The Q&A confirms that training concepts may differ in level of detail, and that having different levels of training or learning approaches could be appropriate. It treats staff with a degree or experience in AI development as normally literate, subject to the specific tool and qualification, and still expects the organisation to ask whether those staff know what they need to know about the organisation’s own systems and the legal and ethical aspects. It imposes no sector-specific requirements, although sector, purpose and risk level are relevant to design. On format, the Q&A states that relying on instructions for use, or asking staff to read them, might be ineffective.

Reaching other persons (dimension 4)

Article 4(1) covers persons dealing with operation and use on the organisation’s behalf. The Commission Q&A describes them as persons broadly under the organisational remit and names a contractor, a service provider or a client as examples. For service providers and contractors, the Q&A states that the answer depends on the type of AI system and its risk, and that people working for them need the appropriate skills for the task, as employees do. For clients, it states that literacy can be useful depending on the specific risk. Scoring this dimension therefore starts with deciding which external roles touch which systems; the Q&A does not prescribe contractual terms.

Records (dimension 5)

The Q&A states that no certificate is needed and that organisations can keep an internal record of trainings or other guiding initiatives. It also states that no specific governance structure is mandated, which covers an AI officer or an AI governance board. Records at level 3 or above would, as governance practice rather than obligation, identify the person or group addressed, the system concerned, the measure delivered and the date.

Revision when systems or roles change (dimension 7)

Neither Article 4 nor the Commission Q&A prescribes a review cycle. The Q&A does note the speed of technological developments when discussing staff with AI qualifications, and Article 4(1) ties measures to context and to the persons affected, both of which change when a system is adopted or a role is reassigned. Dimension 7 is an editorial addition built on that link; a dated change log is the simplest evidence of it.

The Oversight-Training Layer That Arrives With Annex III Obligations

The Commission Q&A states that for those who deploy high-risk AI systems, the obligation to ensure that staff are trained for human oversight remains in place after the amendment. The Q&A ties this to Article 26 of Regulation (EU) 2024/1689, under which deployers of high-risk systems must ensure that the staff dealing with the systems are sufficiently trained to handle them and ensure human oversight, and it adds that reliance on instructions for use is not sufficient.

The timing is set by Article 113 of the AI Act as replaced by the Digital Omnibus. Chapter III, Sections 1 to 3, which include Article 26, apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to systems classified under Article 6(1) and Annex I. Annex III covers employment-related uses among others, which places many workplace deployments inside this date.

For the benchmark, dimension 6 applies only to organisations deploying such systems, and it separates level 3 from level 4. An organisation that deploys an Annex III system and holds general literacy records but has not designated and trained the persons overseeing that system scores below level 4, whatever the quality of its general programme. Because the obligation begins on 2 December 2027 for those systems, the designation and training records can be built ahead of that date.

ISO/IEC 42001 Clauses 7.2 and 7.3 Against Article 4

ISO/IEC 42001:2023 is a management system standard for AI, published by ISO and IEC in December 2023. Its clause 7.2 addresses competence and clause 7.3 addresses awareness. ISO/IEC 42001 addresses what an organisation determines, ensures and retains as evidence for persons whose work affects its AI management system; Article 4 addresses measures supporting AI literacy of staff and others operating AI systems on the organisation’s behalf.

The Commission Q&A does not reference ISO/IEC 42001 as a route to demonstrating compliance with Article 4, and it states that replicating practices from the Commission’s living repository does not grant a presumption of compliance. Following the same reasoning, an organisation scoring itself should treat an ISO/IEC 42001 certificate as a source of evidence structure, not as proof that Article 4 is met. That conclusion is analysis. Where an AI management system already exists, the competence and awareness records it produces can populate dimensions 3, 4 and 5 without duplicate effort.

Instruments Still to Come: Article 4(2) Examples and Article 4(3) Recommendations

Two parts of the amended Article 4 depend on Commission and Board output. Under Article 4(2), the Commission is to publish practical examples of compliance on the single information platform. The Commission states that it will draw on its repository of AI literacy practices, which holds more than 40 initiatives collected between December 2024 and February 2025 and again between April and June 2025, while noting that replicating those practices does not automatically grant presumption of compliance.

Under Article 4(3), the AI Board is to adopt recommendations that take European competence frameworks into account and set common objectives. Recital 8 names the Digital Competence Framework for Citizens and the AI Literacy Framework for Primary and Secondary Education as examples of such frameworks. The Commission Q&A, last updated 27 July 2026, and the Commission’s AI talent, skills and literacy page both describe the recommendations in the future tense. Common objectives, once adopted, would supply the reference point that Article 4(1) lacks, and the benchmark scale would then need to be re-based against them.

Where Self-Assessments Go Wrong

Five misreadings recur in materials that predate the amendment or that carry earlier wording forward, and each distorts a readiness score in a predictable direction.

• Scoring an outcome. Article 4(1) states that no specific level of AI literacy of any individual must be guaranteed. A score built on pass rates measures the wrong object.
• Requiring a certificate. The Commission Q&A states that no certificate is needed and that internal records suffice.
• Treating staff testing as mandatory. The Q&A states that Article 4 entails no obligation to measure employees’ knowledge.
• Counting instructions for use as a measure. The Q&A states that relying on them, or asking staff to read them, might be ineffective, and that Article 26 requires more for high-risk deployments.
• Treating technical qualifications as an exemption. The Q&A treats staff with AI degrees or experience as normally literate, subject to the specific tool and qualification, and still expects the organisation to ask what those staff need to know about its own systems.

A further hazard is source age. The Digital Omnibus replaced Article 4 in full, and materials written against the original text frame the duty as ensuring a sufficient level. A benchmark built on that framing would score against a standard the current text does not contain.

Why Article 4 Readiness Now Depends on Documentation Discipline

With no level to assert, the organisation’s record is its position. The sequence below follows the dimensions in the order in which each depends on the previous one.

1. Build the system inventory with a role determination and the risks relevant to each system (dimensions 1 and 2).
2. Map staff groups to measures reflecting knowledge, experience, education, training and context of use (dimension 3).
3. Identify the contractors, service providers and other persons who operate systems on the organisation’s behalf, and record the measures applied to them (dimension 4).
4. Start the internal record with the person or group, the system, the measure and the date (dimension 5).
5. For each Annex III deployment, designate the persons overseeing the system and record their training before 2 December 2027 (dimension 6).
6. Keep a dated change log and re-score when the AI Board recommendations and the Commission’s compliance examples are published (dimension 7).

The next dated milestones are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, as set by Article 113 of the AI Act as replaced. Until the Board recommendations appear, the Commission Q&A remains the most specific official statement of what a programme should consider, and the dimensions above should be re-scored against it each time the Commission updates that page.

AI Governance Desk

Covering responsible AI, governance frameworks, policy, ethics, and global regulations shaping the future of artificial intelligence.