AI literacy: a real duty, and nothing you have to buy

Article 4 binds providers and deployers of AI systems in respect of their staff and other persons dealing with the operation and use of AI systems on their behalf. It sits in Chapter I of the Regulation, which means it is not limited to high-risk systems and there is no size threshold under it.

It has applied since 2 February 2025. It was not deferred by the Digital Omnibus and it never had a later date attached to it.

In practice that means an Irish business with five people, one of whom uses a general assistant to draft emails, is inside Article 4. So is a business whose accounts package added a forecasting feature nobody switched on deliberately.

The original wording asked providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. Regulation (EU) 2026/1744 replaced that.

The current wording asks them to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the systems are to be used in, and considering the persons or groups of persons on whom the systems are to be used. It then adds a sentence that was not there before: this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

That is a shift from a duty of result to a duty of effort, and it is the difference between having to prove your staff know something and having to show you did something reasonable about it.

Two consequences follow. Any internal AI policy written before late July 2026 states the obligation more strictly than the law now does. And any supplier still quoting the sufficient level wording at you is quoting a superseded text.

This is the part worth being blunt about, because a certification market has grown around Article 4 in Ireland and the Commission has answered the question directly.

The AI Act Service Desk's guidance on AI literacy says there is no single approach that works for all, and then says plainly that there is no obligation for external training or external certification.

There is no prescribed syllabus in the Regulation, no accredited body, no register of qualified staff and no certificate that discharges the duty. An organisation that runs a competent internal session and writes down what it covered has done more than one that bought a course nobody finished.

The duty is proportionate by construction. Article 4 asks you to take account of technical knowledge, experience, education and training, the context the systems are used in, and the people the systems are used on. A hospital using AI on patients and a print shop using it on invoices do not owe the same thing.

What both owe is evidence. The obligation is soft; the ability to show you met it is not, and the only artefact anybody will ever ask for is a record.

Because nothing happens if you do not do it. No fine attaches at all: Article 4 appears nowhere in Article 99, which is where the Regulation sets its penalties. It is enforced through compliance notices, and commercially through the due diligence your own customers do on you.

One detail cuts the other way and is rarely mentioned. Article 99(6) says that for SMEs, including start-ups, each fine is up to the percentage or the amount, whichever is lower, rather than whichever is higher. For a small Irish company the headline figures in most coverage of this Regulation are the wrong way round.

The better reason to do it is not the fine. It is that the AI literacy note and the list of systems behind it are the two documents every other exercise on this subject starts from: the Article 50 disclosure work, the provider or deployer question, and any data protection assessment that follows.

Article 4 is one of two duties an ordinary Irish business owes today. The other is Article 50 transparency, which started on 2 August 2026 and covers anything a customer talks to or that generates content.

If your staff use AI anywhere near hiring, check Article 5 before anything else. Inferring emotions of a person in the workplace is prohibited outright, and no amount of literacy training makes a prohibited practice lawful.

If it helps to see what the record looks like when somebody actually keeps one, our own AI use policy is published: where we are a provider and where we are a deployer, what we will not build, and what we disclose. It is short, which is the point.

And if the tools touch personal data, the questions that matter next are data protection ones. Whether the processing needs an assessment first has a published Irish answer, and it is a shorter conversation than most people expect.