Do you have to prove your staff are AI literate

What Article 4 says after July

The obligation is not new. Article 4 of the EU AI Act has applied since 2 February 2025, and the amending regulation, adopted on 8 July 2026, left that date alone. What it replaced was the wording, with effect from 27 July 2026, the third day after publication in the Official Journal.

What changed was the wording. The recitals to the amendment describe the position before it: "Article 4 of Regulation (EU) 2024/1689 currently imposes an obligation on all providers and deployers of AI systems to ensure AI literacy of their staff." The replacement provision says something different. Providers and deployers "shall take measures to support the development of AI literacy" of their staff and other persons dealing with the operation and use of AI systems on their behalf. And then, explicitly: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

Ensuring became supporting the development of it, and the guarantee was ruled out in so many words. There is no level left to reach, and so no level left to fall short of.

That applies to Article 4 and not to the regulation as a whole, and the Commission says as much on its own page: "for those who deploy high-risk AI systems, the obligation to ensure that their staff is trained to ensure human oversight remains in place". Those duties sit in Chapter III Section 3 and begin to apply on 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III and on 2 August 2028 for those classified under Article 6(1) and Annex I. Anyone running high-risk systems has more ahead of them than Article 4, on a different date.

What remains is a duty to act, and it has a direction. The measures are to be taken "taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used".

What Article 4 does not say

Read the provision again and notice what is absent. Nowhere does it say the measures must be documented, recorded, compiled or produced on request.

A duty to act is not the same as a duty to be able to prove you acted.

That the omission is deliberate becomes visible when the same amending regulation discusses a different provision. On Article 6(3) it spells the duty out: "[F]urthermore, a provider applying Article 6(3) of Regulation (EU) 2024/1689 remains obligated to document its assessment before that AI system is placed on the market or put into service." The recital goes further in the next sentence: "National competent authorities should be able to request that assessment." The legislator writes a documentation duty into the text where one is intended. In Article 4 it does not.

The Commission confirms this from the other direction. Asked how compliance should be documented, its questions and answers page on AI literacy replies: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives." The verb is can, not must, and that is the entire difference between an option and a requirement.

So Article 4 answers none of the evidence question. What it does not do is make the question disappear. The market surveillance authority that supervises Article 4 holds the powers in Article 14(4) of Regulation (EU) 2019/1020, which the new Article 75a refers to, and point (a) of that paragraph is "the power to require economic operators to provide relevant documents, technical specifications, data or information on compliance". There is no prescribed record. There is still someone who can ask.

The examples already exist, and they come with nothing attached

It would be easy to read the above as leaving an organisation without any reference points. It does not.

Since 4 February 2025 the AI Office has maintained a living repository of AI literacy practices, gathered first among the AI Pact pledgers and later among further organisations. It was last updated on 10 August 2026, and the policy page for it describes the contents as more than forty initiatives.

The examples are published, but copying one of them buys you no presumption.

The repository carries its own caveat, and that sentence decides how it should be used: "While replicating the practices collected in this living repository does not automatically grant presumption of compliance with Article 4". Doing what someone else did confers no presumption of compliance. The repository is a source of ideas, not a standard.

The new Article 4 also calls for something other than the repository. Paragraph 2 obliges the Commission and the Member States to support and facilitate the efforts of providers and deployers, in particular SMEs, in fulfilling their obligation, and obliges the Commission to publish practical examples of how to comply on the single information platform referred to in Article 62(3), point (b). Paragraph 3 obliges the Board to adopt recommendations, taking European competence frameworks into account, to support the Commission and Member States in the promotion of the AI literacy required under paragraph 1, including by setting out common objectives. The recitals name two such frameworks, but attach them to the Commission's and the Member States' own supporting duty rather than to the Board's: when complying with that duty they "could take into account" the Digital Competence Framework for Citizens (DigComp) and the AI Literacy Framework for Primary and Secondary Education.

Neither paragraph carries a date. The same amending regulation is otherwise precise about deadlines: guidance on the post-market monitoring plan is due by 2 September 2027, guidelines on the interaction with product legislation by 1 August 2027, and the delegated acts specifying which requirements may be limited by 2 August 2027.

Enforcement exists, but naming it is a national matter

The Commission places supervision plainly: "The supervision and enforcement of Article 4 of the AI Act is not with the AI Office, but it is under the remit of national market surveillance authorities." The same page says those authorities begin on 2 August 2026 in one place and states that the supervision and enforcement rules apply from 3 August 2026 in another. The Commission has not reconciled the two, and anyone quoting the page should know it.

Because enforcement is national, the picture differs by Member State. Sweden is worth looking at as one worked example, and readers elsewhere should check their own.

In Sweden the allocation currently rests on an administrative assignment rather than on legislation. Government decision III:50 of 4 June 2026, case number Fi2026/01365, tasks five authorities with acting as national competent authorities under Article 70(1), and writes out provision by provision what each of them is to supervise, among them Article 5 on prohibited practices, Article 6(1) and 6(2) on high risk, the transparency duties in Article 50, the single point of contact under Article 70(2) and the sandbox under Article 57.

Article 4 is not named. The assignment is expressly interim: it runs only until 31 December 2026, pending the Swedish implementing act.

That does not settle the question either way. The Commission places supervision with national market surveillance authorities, while the Swedish decision appoints national competent authorities and hands out the market surveillance role provision by provision. Whether a Swedish market surveillance authority is competent for Article 4 is therefore left open by the appointment itself.

The objection that carries weight

Read the three preceding sections in sequence and you have a fairly strong argument for doing nothing. No documentation duty, no level to reach, at least one Member State where Article 4 is not named in the appointment, and penalties left by Article 99(1) to the Member States, which are to lay down rules on penalties and other enforcement measures and to take account of the interests of small and medium-sized enterprises, including start-ups, and of small mid-cap enterprises and their economic viability when imposing penalties. The Commission notes that national penalty legislation was due to be adopted by 2 August 2025.

The objection is sound as far as it goes, and four things cut against it.

The duty to act is unchanged and has no end date. It has applied since February 2025 and is unaffected by the fact that nobody has asked yet.

The legislator anticipated the argument. The recitals to the amendment state that "AI literacy should be a strategic priority, regardless of regulatory obligations and potential sanctions". A legal text rarely justifies itself on grounds other than the law.

The demand is also already inside the organisation, and it has been measured. In ISACA's European pulse poll, 561 business and IT professionals in Europe surveyed between 28 March and 14 April 2025, "42% believe that they will need to increase their skills and knowledge in AI within the next six months in order to retain their job or advance their career", and "most (89%) recognise that this will be needed within the next two years". The global study by KPMG and the University of Melbourne, over 48,000 people across 47 countries surveyed between November 2024 and January 2025, measures the other half: "only 47% of employees say they have received AI training", while "almost half of employees admit to using AI in ways that contravene company policies".

That combination is not a compliance problem. The use is already happening, some of it outside whatever has been decided, and it will carry on whatever the supervisory authorities do or fail to do. In that situation the obligation in Article 4 is not the reason to act. It is the floor beneath work that already has a reason of its own.

And whoever asks first is rarely a regulator. Which brings us to the criterion.

What decides how much you should keep

Since the law sets no level, the level is set by something else, and that is a question you can answer today.

The first question is who is in a position to ask you, and on what basis. If you supply the public sector it is the buyer, and the question arrives in a tender document with a deadline. If your customer contracts contain audit clauses it is the customer. Neither route runs through the AI Act, so neither depends on whether national legislation arrives on time.

A third route does run through the regulation, but it is narrower than it looks. Article 77 gives national authorities that supervise obligations under Union law protecting fundamental rights, including the right to non-discrimination, the power to request and obtain access to information and documentation created or maintained under the regulation, where that access is necessary to fulfil their mandates effectively within their jurisdiction. The request goes to the market surveillance authority. Since Article 4 prescribes no documentation, a voluntary record is strictly speaking not that material, whereas the technical documentation and the fundamental rights impact assessment are.

The second question is how much the five factors in Article 4(1) actually vary across your organisation. If everyone does much the same work with the same system in the same context, one note covers the whole organisation. If education, context or the people the systems are used on differ between units, a single note is not a simplification but an inaccurate description: it asserts a uniformity the provision gives you no reason to assume, since the factors it lists are there precisely because they differ. Our reading is that the factors, which formally are criteria for how the measures are to be shaped, are therefore also the natural structure for whatever you choose to write down.

The full timeline for the EU AI Act, with every date and what applies from when, is on our page about the EU AI Act. How a competence plan is built role by role is set out under AI competence.