EU AI Act Article 4: The AI Literacy Duty, Rewritten

Quick answer: Article 4 of the EU AI Act has applied since 2 February 2025 to every provider and every deployer of an AI system — in practice, any Luxembourg company whose staff use AI tools at work. The Digital Omnibus on AI, Regulation (EU) 2026/1744, amended it in July 2026: the duty is now to take measures to support the development of AI literacy, rather than to ensure, to their best extent, a sufficient level of it. That is a genuine reduction in the standard — an effort duty rather than an outcome duty — and it removes none of the obligation. The Act still prescribes no fixed training hours and no certification. What holds up is a documented, tiered programme: 30–60 minutes of awareness training for all staff, 2–4 hours of role-specific training for operational users, attendance records kept.

Last verified 7 August 2026.

Most Luxembourg AI Act conversations focus on the headline obligations: the GPAI provider rules, the high-risk documentation, the conformity assessments. The article almost no Luxembourg company we have audited has actually addressed is Article 4 — AI literacy — and it is the one that already applies today, regardless of whether you build AI, deploy AI, or just bought a Microsoft 365 Copilot licence last quarter.

It does not have its own conformity assessment, does not require a notified body, and does not generate a CE marking. What it generates is a documented obligation on every provider and every deployer of an AI system in respect of the people who operate AI on their behalf.

Want to know where you actually stand on your Article 4 obligations? Book a free 30-minute call — thirty minutes is usually enough for a first read.

This guide is the 90-day plan we run with Luxembourg SMEs to close the literacy gap — usually the first brick of a wider AI implementation in Luxembourg.

What Article 4 says now (and what the omnibus changed)

The original text required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in."

Regulation (EU) 2026/1744, in force since 27 July 2026, replaced the operative verb. The duty is now to take measures to support the development of AI literacy among those same people.

Why that matters practically: the old wording invited the argument that you had to guarantee an outcome — a "sufficient level" — that no employer fully controls. The new wording is an obligation of means. It is easier to satisfy and easier to evidence. It is not a repeal, and the people it covers have not changed.

Three things Article 4 still does not say, and four things it does:

Does not say:

• A specific number of training hours.
• A specific certification standard.
• That a particular vendor's course satisfies the obligation.

Does say:

• Applies to providers and deployers. Deployers includes any organisation using AI in the course of a professional activity. That sweeps in essentially every company in Luxembourg.
• Applies to staff and other persons operating AI on your behalf: contractors, interim staff, the agency that built your chatbot, the consultancy running your fund administration outsource.
• Measures must be proportionate to the person's role and to the context the AI is used in. A junior fund accountant supervising a NAV-exception model has different needs from the legal counsel who writes the AI policy.
• The obligation is risk-based and ongoing — not a one-off checkbox.

The European Commission maintains non-binding Q&A material on AI literacy through its AI Act service desk and the regulatory framework pages. Useful, non-prescriptive. For Luxembourg companies the practical question is what a market surveillance authority would accept as evidence of "measures taken".

Why this matters more now that the high-risk deadline moved

The omnibus deferred stand-alone Annex III high-risk obligations to 2 December 2027 and product-embedded AI to 2 August 2028. It did not defer Article 4, and it did not defer the Article 50 transparency duties that took effect on 2 August 2026.

That leaves a specific gap that literacy training closes. Article 50 requires your people to disclose AI interaction, label deepfakes, and know when AI-generated public-interest text needs a disclosure or documented editorial review. Those are not engineering controls — they are decisions made by staff, daily, in marketing, support and sales. A workforce that does not know Article 50 exists will breach it without anyone deciding to. The literacy programme is the cheapest control you have over the one part of the AI Act that is live today. See what actually applies now.

What "sufficient" looks like in practice — the four-tier model

The framework that has held up across our 2025–2026 client engagements maps staff to four literacy tiers based on their relationship to AI in their daily work:

Tier 1 — Awareness (everyone)

Every employee, including non-users. 30–60 minutes of structured content covering:

• What AI is (and isn't) in the regulatory sense
• The categories of risk under the AI Act
• The company's own AI policy and acceptable-use guidelines
• How to report an AI-related concern

This tier is the literacy floor. If a regulator asks "did you train all your staff on basic AI literacy?", you need a yes here, with attendance records.

Tier 2 — Operational user (anyone who uses AI tools in their daily work)

Sales reps using a CRM with AI features. Accountants using a Copilot. Anyone running AI-assisted document drafting. 2–4 hours of role-specific content covering:

• How the specific tools they use actually work (RAG vs. agentic vs. fine-tuned — see our RAG / fine-tuning / custom-LLMs guide)
• Common failure modes and hallucination patterns
• Output verification routines (the supervision routine described in our pilot-to-production playbook)
• Data handling, especially what should never go into a prompt
• Bias and fairness considerations relevant to their workflow

Tier 3 — Supervisor / decision-affecting role (managers, ops leads, anyone who acts on AI output)

The managers in step 1 of the pilot-to-production playbook. The fund accounting manager signing off on AI-pre-screened exceptions. The HR lead reviewing AI-shortlisted candidates. 4–8 hours of content covering everything in Tier 2, plus:

• Risk classification under the AI Act and what changes for high-risk systems
• The supervisor's specific obligations on human oversight and on detecting drift
• Documentation requirements (what you record, where, for how long)
• Escalation pathways

Tier 4 — Builder / configurator (anyone who selects, configures, integrates, or maintains AI systems)

IT, data, the AI agency you partnered with. 8–16 hours, structured covering everything in Tier 3, plus:

• The Act's provider-vs-deployer distinction and how it shifts in your specific deployment pattern
• Conformity assessment basics for the high-risk systems they touch
• Logging, monitoring, and post-market obligations
• Interaction with adjacent law: GDPR, the DORA × AI Act overlap, AI cybersecurity under NIS2, the EU Data Act

The four tiers are cumulative: Tier 4 staff also receive Tier 1–3 content. Total Tier 4 commitment is usually 20–25 hours over the year. Total Tier 1 is under an hour. Most Luxembourg SMEs end up with 70% of staff at Tier 1, 20% at Tier 2, 8% at Tier 3, and 2% at Tier 4.

The 90-day plan

If today is the start of week 1, here is the path:

Weeks 1–2: Inventory and tiering.

• List every AI tool currently used in the business (and shadow-IT — you will find some).
• For each tool, list the staff who use it, who supervises them, and who is responsible for maintaining or configuring it.
• Assign each staff member a tier.

Weeks 3–4: Policy.

• Write a one-page AI Acceptable Use Policy. Reference Article 4 explicitly.
• Get sign-off from the named person on the org chart who owns AI governance (if there isn't one, name them now — this is the same person who will own the high-risk system documentation for 2 December 2027).

Weeks 5–8: Tier 1 training rollout.

• Build or buy a 45-minute Tier 1 module. Trilingual (FR / DE / EN) — this is Luxembourg.
• Include a five-minute Article 50 block: when to disclose AI interaction, when to label AI-generated content, who signs off editorial responsibility. It is the part of the training that pays for itself immediately, because Article 50 is already enforceable.
• Roll it out with attendance tracking. Treat it like the annual GDPR refresher: dry, mandatory, completed.

Weeks 9–11: Tier 2 and Tier 3 training rollout.

• Build role-specific modules per tool / per supervisor type.
• Use the actual tools the staff member uses; not a generic vendor course.
• Document what was covered, by whom, on what date.

Week 12: Tier 4 training and audit.

• Tier 4 typically requires either external delivery or a formal internal programme — book it now if you haven't.
• Audit the records. Your literacy file should contain: the inventory, the tier assignments, the training records, the policy with sign-off, and the planned annual refresh schedule.

At the end of it the file exists, it is complete, and the responsible owner can produce it on request. That is what proportionate, documented compliance looks like under the amended Article 4 — measures taken, evidenced, and kept current.

Deadline maths making you nervous? A free 30-minute call will tell you how much of the Article 4 duty actually applies to you.

Where Luxembourg specifics change the plan

• Trilingual delivery is mandatory in practice. A Tier 1 module that exists only in English is not "proportionate to the staff member's context" for a Luxembourg workforce that operates in FR / DE / LU on the floor. Build all tiers in three languages from day one.
• Cross-border workforce. Many Luxembourg SMEs employ frontaliers who are subject to Belgian, French, or German employment law. The literacy obligation under EU regulation applies regardless of nationality, but training delivery and acceptance forms need to land cleanly across multiple jurisdictions.
• Sectoral overlap. Banks and PSF entities under CSSF supervision should expect Article 4 records to be reviewed alongside their CSSF outsourcing files; insurance under CAA the same. Healthcare under the Ministry of Health. Public-sector entities have their own Service des Médias et Communications angle. Where you sit in the sector overlay determines who additionally asks for the file.
• Funding. Some elements of the literacy programme are eligible under Fit4Digital / Fit4AI and adjacent training-cost subsidies via the INFPC. Worth a 30-minute scoping call with House of Training before you commission an external provider.

Three failure modes we keep seeing

• Treating Article 4 as a vendor course. Buying a 60-minute generic e-learning module from a vendor and rolling it out to all staff satisfies almost none of the proportionality requirement. It is also the cheapest defensible option and so almost everyone defaults to it. It will not survive a real review.
• Confusing GDPR training with AI literacy training. They overlap in places but are not substitutes. Both are needed. The literacy file should reference the GDPR training records, not replace them with them.
• Not naming the owner. The single most predictive item: is there one named individual in the company whose KPI includes "AI literacy programme operational"? If yes, the programme tends to get done. If no, it tends not to.

The Article 4 obligation is, by EU regulatory standards, unusually light — lighter still since the omnibus turned it into a duty of means. The reason to do it cleanly is that the literacy file is also the file you use to demonstrate human oversight for the high-risk obligations landing on 2 December 2027, and the control that keeps your staff on the right side of Article 50 today. Three headings, one project.

---

Make the literacy file part of a register you can actually defend

A training log on its own does not answer the question a supervisor asks first: which AI systems do you run, in what role, and who is accountable for each? Literacy is one column of that answer.

The 20 More AI Act Readiness Assessment. Ten working days, fixed scope:

1. The AI system register — every AI system and AI feature in the business, with the provider-or-deployer determination made and evidenced per system, and the named owner and oversight person for each.
2. The Article 50 gap report — the disclosure duties live on your products today, mapped to the specific chatbots, voice agents, screens and published content missing them, plus the 2 December 2026 machine-readable-marking work scheduled separately.
3. The role-tiered literacy plan — the four-tier assignment across your actual staff list, the trilingual module scope per tier, and the attendance-record structure that evidences "measures taken" under the amended Article 4.
4. A one-page board memo — signed and dated, ready to hand to the CNPD, the CSSF or a client's procurement team.

We build the programme alongside your DPO or internal counsel rather than instead of them: two-week scoping, four-week build, ongoing refresh.

→ See the AI Act readiness service, or book a 30-minute working session against your own staff list and AI-tool inventory. You leave with the tier assignment and a training-week plan.

---

Related reading:

• EU AI Act August 2026: what actually applies now
• DORA × EU AI Act: what CSSF firms owe, and when
• AI cybersecurity for Luxembourg businesses: NIS2-ready protection in 2026
• The EU Data Act meets AI: Luxembourg compliance 2026
• GDPR-compliant AI for Luxembourg SMEs
• AI pilot to production: Luxembourg scale-up playbook
• Fit4AI Luxembourg & Luxinnovation programme guide
• AI Knowledge Hub — 20 More Resources