AI literacy: a real duty, and nothing you have to buy

Article 4 applies to providers of AI systems (the businesses that supply them under their own name) and to deployers (the businesses that use them at work). It covers their staff and anyone else who operates or uses AI systems on their behalf. It sits in Chapter I of the Regulation, so it is not limited to high-risk systems, and it applies whatever the size of the business.

It has applied since 2 February 2025. It was not deferred by the Digital Omnibus and it never had a later date attached to it.

In practice, an Irish business with five people is inside Article 4 if one of them uses a general AI assistant to draft emails. A business whose accounts package added a forecasting feature may be too, if that feature meets the Act's definition of an AI system and staff use it. The Commission's guidelines treat simple forecasting that only projects averages as outside that definition.

The original wording asked providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. Regulation (EU) 2026/1744 replaced that.

The current wording asks them to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. It asks them to take into account those people's technical knowledge, experience, education and training, the context the systems are to be used in, and the persons or groups of persons on whom the systems are to be used. It then adds a sentence that was not there before: this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

That lowers the bar. The old text asked for a sufficient level of AI literacy, to your best extent. Even so, the Commission never read it as requiring you to test what staff know. The new text drops the target level altogether. What you owe now is measures that support staff learning, suited to who they are and how the systems are used.

Two things follow. The "sufficient level" wording no longer applies. And any internal AI policy that repeats the wording in force before 27 July 2026 now states the duty more strictly than the law does.

Article 4 names no syllabus, accredited body or certificate, and the Commission has answered the question directly.

The AI Act Service Desk's guidance on AI literacy says there is no single approach that works for all, and then says plainly that there is no obligation for external training or external certification.

There is no prescribed syllabus in the Regulation, no accredited body, no register of qualified staff and no certificate that satisfies the duty. An organisation that runs a competent internal session has taken the kind of measure the duty asks for. If it writes down what the session covered, it also has a record of it.

The duty is written to be proportionate. Article 4 asks you to take account of technical knowledge, experience, education and training, the context the systems are used in, and the people the systems are used on. A hospital using AI on patients and a print shop using it on invoices do not owe the same thing.

Neither is required to keep evidence, but both will want it. The Commission's answer is that there is no need for a certificate and that organisations can keep an internal record of trainings and other guiding initiatives. The obligation is soft. The Regulation sets no form of proof, so a record of what you did is what you will be able to show if anyone asks.

Irish law currently provides no fine and no enforcement notice for it. Article 99 caps fines for breaches of Article 5, for the obligations listed in Article 99(4) and for misleading information, and Article 4 is not among them. Article 99(1) lets each Member State set penalties, including fines, for any infringement. But the fines in the Regulation of Artificial Intelligence Act 2026 are tied to listed provisions, and Article 4 is not on any of those lists. Nor can an Irish authorised officer serve a contravention notice for it: the contravention notice in section 71 of the Regulation of Artificial Intelligence Act 2026 covers Articles 16, 23, 24, 26, 27(3) and 50, not Article 4. The pressure to comply comes from your own customers, through the checks (due diligence) they make on you.

One detail cuts the other way. Article 99(6) says that for SMEs, including start-ups, each fine is up to the percentage or the amount, whichever is lower. A headline of 35 million euro or 7% of turnover, whichever is higher, does not describe a small Irish company's exposure.

There is a better reason to do it. The AI literacy note and the list of systems behind it feed into the Article 50 disclosure work, the provider or deployer question, and any data protection assessment that follows.

Besides the Article 5 prohibitions, which bind any business, Article 4 is one of two duties an ordinary Irish business owes as at 30 September 2026. The other is Article 50 transparency, which has applied since 2 August 2026. The provider of a chatbot must make sure people are told they are dealing with AI, unless that is obvious. A business that uses AI to make a deep fake must disclose that the content is artificial. Providers of generative tools already on the market before 2 August 2026 have until 2 December 2026 to mark what those tools produce.

If your staff use AI anywhere near hiring, check Article 5 before anything else. Using AI to infer the emotions of a person in the workplace is prohibited, apart from a narrow exception for medical or safety reasons, and the Commission's guidelines apply this to job candidates during recruitment. No amount of literacy training makes a prohibited practice lawful.

To see what such a record looks like, read our own AI use policy. It sets out where we are a provider and where we are a deployer, what is off limits, and what we disclose. It is short.

And if the tools touch personal data, the questions that matter next are data protection ones. To find out whether the processing needs an assessment first, start with the Data Protection Commission's published list of processing that needs one. The DPC says the list is not complete, so other processing can need one too.