# EU AI Act AI literacy What Article 4 asks of providers and deployers for their staff's AI literacy, how the July 2026 amendment changed it, and what good evidence looks like. Source: https://sted.digital/docs/standards/eu-ai-act/ai-literacy · Last reviewed 17 October 2026 · Strand Standards and regulations EU AI Act Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and others using AI on their behalf. It has applied since 2 February 2025; Regulation (EU) 2026/1744 reworded it from 27 July 2026, so no individual has to reach a specific level. ## The requirement in plain English AI literacy, as EU AI Act Article 3(56) defines it, is the skill, knowledge and understanding that lets providers, deployers and the people affected make informed use of AI systems and be aware of their opportunities, risks and possible harms. **Who it applies to.** Every provider and every deployer, whatever the risk tier of their systems. A company whose only AI is a bought-in writing assistant is a deployer and has the duty. It covers your staff and anyone else who operates or uses AI systems on your behalf, such as contractors and agency workers. **What it asks for, since 27 July 2026.** Providers and deployers "take measures to support the development of AI literacy" of those people (EU AI Act Article 4, in the [consolidated text on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727)). The measures take into account their technical knowledge, experience, education and training, the context the systems are used in, and the people they are used on. The amended article says that it does not require any individual to reach a specific level of literacy. The Commission and Member States support the effort, especially for small firms, the Commission publishes practical examples, and the AI Board adopts recommendations. **What it asked for before.** From 2 February 2025 to 26 July 2026 the original text required measures to ensure, to the best of your ability, a sufficient level of AI literacy. That was closer to a result to achieve; the amended text is a duty to act and keep acting. Training material and policies written in 2025 often quote the old wording. **Where it meets other duties.** For high-risk systems, literacy is the floor under two harder duties: the provider designs for oversight by people who understand the system's limits (EU AI Act Article 14), and the deployer assigns oversight to people with the necessary competence, training and authority (EU AI Act Article 26). Article 4 applies to everyone; those two apply on top. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 50-person logistics software company starts from its AI system register, which lists eight tools: two it builds and six it uses. Its AI literacy plan sets three tiers. Everyone completes a short session at joining and once a year: which AI tools are approved, what data may go into them, where they get things wrong, and how to report a concern. Each person confirms they have read the AI acceptable use policy at the same time. People who use AI daily, the support and sales teams, get a practical session on checking outputs, spotting confident errors and knowing when not to use the tool. The support team's session uses real examples from their own chatbot console. The engineers who build the route-planning model, and the operations staff who can override it, get a deeper module on the model's limits, the data it was trained on and the warning signs of over-reliance. The head of people owns the plan and reviews it whenever a tool is added. Attendance, materials and a one-line note of what each session covered are kept per person, including for the two contractors on the support desk. ## Evidence an auditor expects - **An AI literacy plan by role** (usual): a market surveillance authority asks what measures you took and why they fit the people and the tools. - **Training materials with dates**: shows the content matches your actual systems and the current wording of the duty. - **Records per person**: who completed what and when, including contractors acting for you. - **Acknowledgement of the AI acceptable use policy**: shows staff know which tools and data are allowed. - **Deeper training for oversight roles**: for high-risk systems, records that the people given oversight are competent to exercise it. - **Review history**: when the plan was last updated, and why. ## Common mistakes ### One webinar for everyone A single generic session does not reflect people's knowledge or the context of use, which Article 4 asks you to take into account. Tailor at least by how heavily people use AI. ### Content about AI in general, not your tools Staff need to know what your systems get wrong. Use your own tools and your own failure examples. ### Forgetting the people outside your payroll Contractors, agency staff and outsourced teams using your AI systems on your behalf are inside the duty. Add them to the plan and the records. ### Reading the 2026 change as the end of the duty The amendment softened the standard of the result; it did not remove the duty to act. Keep the programme running and update the policy wording. ### Treating literacy as oversight Literacy is the floor. A person given oversight of a high-risk system needs deeper competence and the authority to override, which the high-risk rules require separately. ## How Sted helps Training is completed against a specific approved version; a new version asks people to train again. Re-issuing training on an unchanged version is not available yet. Training in Sted is the person's own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else. A completed training record cannot be changed or deleted. Administrators and Policy and Process Owners see a training register of every person's training across documents, filterable by status and document. A training record shows a person confirmed they read an approved document. Judging whether your measures build enough AI literacy for each role stays with you. ## Related guides and terms - [Training and awareness guide](/docs/guides/training-and-awareness): planning, delivering and recording training, with an AI literacy example. - [EU AI Act](/docs/standards/eu-ai-act): the hub, with the roles that carry the duty. - [Obligations for high-risk systems](/docs/standards/eu-ai-act/high-risk-obligations): the oversight competence that sits on top of literacy. - [ISO 42001 context, scope and AI policy](/docs/standards/iso-42001/context-and-leadership): the roles and the AI policy your plan supports. - [Training in Sted](/docs/product/training): how training is assigned, confirmed and recorded. ## Frequently asked questions Q: Did the 2026 amendment remove the AI literacy requirement? A: No. Since 27 July 2026 providers and deployers must take measures to support the development of their staff's AI literacy, instead of ensuring a sufficient level of it. The duty to act remains; what changed is that no individual has to reach a specific level. Q: Do contractors need AI literacy training too? A: Yes, if they operate or use AI systems on your behalf. Article 4 covers your staff and other people dealing with your AI systems for you, so an outsourced support team using your chatbot console is in scope. Include them in the plan and keep their records with your own.