Why literacy remains an immediate issue
Article 4 initially applied on 2 February 2025. The amended wording entered into force on 27 July 2026. Organizations should evaluate their current measures against that wording rather than wait for the principal 2027 and 2028 high-risk dates. Literacy is a separate obligation family.
For operational leaders, the question is what people need to understand to perform their actual AI-related work. A software engineer changing a system, a service agent using its output and a publisher releasing generated text face different decisions. A uniform introductory presentation may be useful, but it will not explain all those workflows.
Article 4 requires measures that account for knowledge, experience, education and training, use context and affected people; it excludes guaranteeing a specific individual literacy level.
The Commission Q&A supports context-sensitive measures rather than one uniform course or competence test. Curriculum, review cadence and any internal pass mark are program-design choices in our recommended approach below, not requirements attributed to that Q&A.
What the law says
The measures obligation concerns providers and deployers. It takes account of technical knowledge, experience, education and training, the context in which AI systems are used and the people or groups affected. The organization must take measures; it is not required to guarantee any particular individual's attainment.
The amendment also assigns support and facilitation functions to the Commission and Member States, with practical examples and AI Board recommendations. That public support complements organizational efforts. It does not transfer the measures obligation away from providers and deployers.
A provider develops or has developed an AI system or GPAI model and places it on the market, or puts an AI system into service, under its own name or trademark, whether paid or free. System putting into service can include first own use; model placement is a separate branch. A deployer uses a system under its authority, apart from purely personal non-professional use. Role analysis therefore matters even for an enterprise that mainly buys AI products. See provider vs deployer.
What the Commission Q&A says
| Question | Commission interpretation | Boundary |
|---|---|---|
| Is a certificate needed? | No; internal training and guidance records can document efforts. | An evidence suggestion, not a statutory certificate requirement or retention period. |
| Must the organization appoint an AI officer? | Article 4 does not mandate an AI officer or particular governance structure. | Separate appointments or oversight duties under other provisions or laws may still matter. |
| Does everyone need the same course? | Measures can vary with knowledge, experience and context. | Discretion still needs to address the relevant work and affected people. |
The legal duty above comes from amended Article 4. The Q&A answers in this table are Commission interpretation and do not replace the legislation.
Designing proportionate measures
The following sequence is an operational recommendation derived from the contextual duty, not a mandated training methodology.
Start with the AI systems people actually use. Identify the decisions they make, what output they receive, the limits they need to recognize and where they can seek help. Link measures to those activities. A course catalog organized only by department can miss the people who operate the same system in different business units.
Then group participants by relevant work. Some need a basic explanation of system limits and escalation. Others need to examine data, validate performance or make publication decisions. Technical depth should follow responsibility rather than job title alone. Include people using AI on the organization's behalf when they fall within the obligation's scope.
Use a mix of instruction and practical support. Short scenario exercises, guidance for the system, release briefings and clear escalation instructions may all be useful. These are examples, not officially required formats. The measures should help people perform the work, not simply add course completion counts.
Review measures when the system or use changes. If a tool moves from drafting internal notes to preparing customer communications, users may need different instruction about publication, disclosure and review. Article 50 obligations must be examined separately; a literacy measure does not discharge a disclosure duty.
Evidence of organizational efforts
Commission Q&A identifies internal training and guidance records as possible documentation. It does not establish a statutory retention period for those records.
Our recommended evidence record connects the measure to its purpose and audience. Record what was provided, who it addressed, which systems or uses it concerned, when it occurred and who owned it. Where practical, preserve the version of the guidance people received. An attendance list without the material or intended audience explains little.
| Evidence | What it can help demonstrate | What it cannot establish alone |
|---|---|---|
| Training material and participant record | The organization delivered a defined measure to a recorded audience. | That every individual attained a fixed level. |
| Guidance for a specific system | Practical instruction was available for a particular system version. | That people used it correctly in every interaction. |
| Scenario exercise results | Participants responded to specified test situations. | Competence across all future situations. |
| Review and improvement record | The organization examined weaknesses and changed measures. | A final legal conclusion on Article 4 compliance. |
This table describes evidence limits. It does not require all four record types or prescribe a universal evidence format. Separate the organizational measure, the artifact and the conclusion supported by it.
Literacy and human oversight
Literacy and high-risk human oversight are related but separate. Articles 14 and 26 address effective oversight design and assignment, including competent, trained and authorised people and relevant intervention capabilities. Those duties have their own applicability and amended high-risk timetable. Article 4's no-officer Q&A statement cannot erase them.
Operationally, training someone to identify an unreliable output is useful only if the workflow gives that person a practical way to act. Examine decision rights, escalation, time and access alongside instruction. Conversely, a stop button without an operator who understands when to use it offers limited assurance. These observations concern control design, not additional statutory job titles.
Common misconceptions
The amendment did not make Article 4 purely voluntary. The measures obligation remains. Removing a guarantee of individual attainment changes what is required; it does not remove organizational responsibility.
A training certificate is not the required outcome described by Commission Q&A. A certificate can be an internal artifact, but the organization still needs to explain why its measures fit the relevant context.
An AI officer is not generally mandated by Article 4 according to the Q&A. Organizations may still choose an accountable owner for their program. That ownership arrangement is our operational recommendation. It should not be sold as a legally prescribed appointment.
What organizations should do now
Identify the provider/deployer activities, the people operating or using AI on the organization's behalf and the systems involved. Review existing instruction against actual use context and affected groups. Address gaps with proportionate measures, retain an intelligible record and assign an owner for updates. Use system-change and workflow-change events as review triggers.
Keep Article 4 work alongside active transparency screening and future high-risk preparation. Do not make the literacy program wait for a complete enterprise governance platform. An intelligible record of relevant measures is a practical starting point. This sequence is operational guidance rather than legal advice.
Open issues
The research has not completed a Member State authority and penalty review. It does not establish a single universal Article 4 fine or national enforcement arrangement. The amended Office-supervised system regime also needs its own competence analysis. Avoid deriving literacy penalty advice from the general maximum-fine headlines.
FAQ
Does every employee need an AI literacy certificate?
Commission Q&A says a certificate is not needed. The law concerns measures for the relevant staff and people operating or using AI on the organization's behalf, with context taken into account.
Must an organization guarantee a literacy level?
No. Amended Article 4 expressly excludes guaranteeing any specific individual literacy level, while preserving the measures obligation.
Is one introductory course enough?
The baseline does not establish that conclusion for every organization. Commission Q&A permits context-sensitive measures. Examine what the relevant people do and what instruction or support that work needs.
Does appointing an AI officer satisfy Article 4?
The Q&A says Article 4 does not mandate that appointment. A title alone does not describe the literacy measures the organization has taken.
Next step
Use the operational readiness sequence to connect literacy measures with system use and ownership.
Primary sources
Use the consolidated text to navigate provisions and the authentic original and amending Official Journal acts for the legislation. Guidance and Q&A retain their separate legal status.
- Consolidated text: Regulation (EU) 2024/1689, 27 July 2026 · legislation.
- Regulation (EU) 2024/1689 of 13 June 2024 · legislation.
- Regulation (EU) 2026/1744 of 8 July 2026 · legislation.
- AI literacy: Questions & Answers · official information, nonbinding.