Article 4 of the EU AI Act: What It Actually Requires

Article 4 of the EU AI Act requires that providers and deployers of AI systems take measures to support the development of AI literacy among their staff and other relevant persons, considering their knowledge, experience, training, the context of use, and the persons affected. This obligation has been in effect since 2 February 2025 and applies to virtually all businesses - even those that only use AI, rather than develop it. This article is the first substantive obligation under Regulation (EU) 2024/1689 - the so-called EU AI Act.

What is Article 4 of the AI Act?

Article 4 establishes the AI literacy obligation. Its text is relatively brief: providers and deployers must take measures to support the development of AI literacy among staff and other persons using AI on their behalf, considering knowledge, experience, education, training, context and the people affected. It does not require a guaranteed individual level of literacy.

Key elements of this article:

• Who it applies to: both providers (those who develop AI) and deployers (those who use AI). Most Lithuanian micro-enterprises fall into the "deployer" category, as they use tools like ChatGPT, Copilot, Canva, or similar.
• What the obligation covers: measures supporting AI literacy development, tailored to people’s roles, knowledge and context. It does not prescribe a formal exam, fixed training hours or guaranteed individual proficiency.
• When it applies: since 2 February 2025. This is one of the first obligations under the AI Act to take effect. Supervision and enforcement of these measures begin in August 2026.

Note: Article 4 does not require you to stop using AI or hire experts. It requires measures to support understanding of AI use; this is a duty to take contextual measures, not to guarantee a particular learning result.

How should AI literacy measures fit the context?

Measures should fit the people and their use of AI. A small café and a large bank have different activities and risks. The following five factors help plan practical guidance:

Useful learning aims for staff in a micro-enterprise include:

1. Knows which AI tools the company allows and which are prohibited.
2. Understands that AI can make mistakes, hallucinate facts, and that responses must be verified.
3. Knows what data must not be entered into AI (e.g., personal data without a lawful basis, trade secrets, confidential client information).
4. Understands the main risks of AI and knows who to report to if something goes wrong.

For more on the concept itself, read our article What is AI literacy?.

Does Article 4 apply to my small business?

Yes - Article 4 does not exempt any business based on size. If your company or even a single employee uses AI for work purposes, the obligation applies. This includes very common scenarios:

• An employee uses ChatGPT in the company to write texts or emails.
• A programmer uses Copilot or other AI coding tools.
• An accountant uses AI tools in accounting to process documents.
• A marketing person generates images with AI.

Even if AI is used only occasionally, the formal obligation still exists. The difference is that for low-risk cases, compliance is simpler and easier. If you want to precisely assess who the regulation applies to, read Who does the EU AI Act apply to?.

A common mistake is assuming that the obligation arises only when a company officially "deploys" an AI system. In reality, it is sufficient that any employee uses a general-purpose AI tool, such as a chatbot, for their work tasks. This often happens quietly, without any decision from management - which is why many micro-enterprises already formally fall under the scope of Article 4, even without realising it. This is why the first practical step is not writing rules, but simply understanding where and how AI is actually used in your team.

How to prove compliance with Article 4?

Article 4 does not specify a particular document format, certificates, fixed training hours, external trainers, audits, or the appointment of a dedicated AI officer. However, practice and the logic of compliance checks show that you must be able to demonstrate that measures have been taken. Written records help explain the steps taken, but the absence of this particular documentation does not automatically establish non-compliance.

A recommended minimal set of documents for a micro-enterprise to demonstrate compliance with Article 4 includes:

• AI Usage Policy - internal rules on which tools are permitted, what is allowed, and what is prohibited. More: AI Usage Policy in the Company.
• AI Tools Register - a list of AI tools actually used by the company. See: AI Tools Register.
• Employee AI Guide - a short, understandable document explaining the rules to employees. See: Employee AI Guide.
• AI Literacy Training with Knowledge Check - to demonstrate that employees have reviewed and understood the material.
• Compliance Record - a document recording who, when, and what measures were implemented. See: Compliance Record under Article 4.

This set is not a mandatory legal minimum or a guarantee of compliance. These are practical documents that nebedirbam.lt automatically prepares for a fixed €149 + VAT (€299) price - based on templates reviewed by compliance experts, without meetings or waiting. Based on your questionnaire responses, all documents and training with certificates are prepared, so in one session you get a practical foundation for implementing Article 4 requirements.

What happens if I do not comply with Article 4?

Article 4 itself does not have a separate fine amount, but this does not mean it is unimportant. AI literacy is a fundamental obligation, and non-compliance increases the risk of other violations and may be assessed alongside other obligations. Furthermore, supervisory authorities can check AI literacy compliance starting from August 2026.

The risk is not just theoretical: an employee who does not understand AI risks may enter personal data into an unapproved public tool (violating GDPR), trust a hallucinated response, or create shadow AI without any control. GDPR does not ban AI use outright - it requires assessing lawful basis, data minimisation, the use of approved tools, and safeguards. For more on possible sanctions and real risks, read our article AI Act Fines and Risks.

What does the implementation sequence for Article 4 look like?

In practice, a micro-enterprise can implement the requirements of Article 4 with the following steps:

1. List the AI tools you use - even if it’s just one, like ChatGPT. This is your AI Tools Register.
2. Establish rules - what is allowed, what is prohibited, and what data must not be entered. This is your AI Usage Policy.
3. Train your people - conduct AI literacy training and verify knowledge.
4. Document - create a compliance record with the date and list of participants.
5. Update - when tools or rules change, review the documents. More on this: Updating AI Documents.

If you are just starting with AI and only want training, you can begin with free AI literacy training and later move to a full documentation package when you need to demonstrate compliance. The free path is for one signed-in participant; team training is included in the paid documentation package.

Frequently Asked Questions about Article 4

Do I need a certified trainer or external audit? No. Article 4 does not require a certified trainer, mandatory external audit, specific certificates, a fixed set of documents, a set number of training hours, or a dedicated AI officer. The obligation is to take measures supporting AI literacy in the relevant context, without guaranteeing an individual level. Practical records can help explain those measures.

Is one team meeting enough? A meeting is a start, but without a written record, you cannot prove it took place. Therefore, it is recommended to have training materials, a knowledge check, and a compliance record.

Is Article 4 the same as high-risk AI rules? No. Article 4 is a general AI literacy obligation for all. High-risk systems (e.g., those listed in Annex III) are subject to separate, stricter obligations, most of which take effect from 2 December 2027. High-risk AI embedded in regulated Annex I products must comply by 2 August 2028. General and transparency (Article 50) obligations applied from 2 August 2026. For more on the differences, see our article AI Act Risk Categories.

To get a complete picture of the EU AI Act and other obligations, check out our list of all articles - there you will find a glossary of terms and explanations tailored to your sector.

Key Takeaways

Article 4 of the AI Act is short but has been in effect since 2 February 2025. It requires measures supporting the development of staff AI literacy, considering the context, without guaranteeing any individual level. For a micro-enterprise, this practically means four things: an AI Usage Policy, an AI Tools Register, employee training, and a compliance record. These documents are not legally mandated, but they are a convenient way to demonstrate that measures have been implemented. Most businesses can prepare these quickly using standard templates; the important thing is not to dismiss this obligation as "something that does not concern me", because it applies to every Lithuanian business using AI.

For the official text of Article 4 and explanations, visit the EU AI Act Service Desk and the European Commission’s Digital Strategy page. These sources provide up-to-date information on the requirements of Article 4 and their implementation timelines.