1. ed.cafe
  2. AI safety guides
  3. Rules, Liability & MA Law
Rules, Liability & MA Law Includes: The ed.cafe 40-Person Team EU Article 4 Role-Matched AI Literacy Log & Contractor Attestation For HR leads, L&D managers, team leads & certificate graduates at 10-to-500 person firms

EU AI Act Article 4 Literacy Rules: A Role-Matched Training Record for a 40-Person Team

EU AI Act Article 4 now asks employers to take measures to support AI literacy; use our role-matched training log for a 40-person team.

Constance Ibe-Whitmore The regulatory translator · ed.cafe editorial persona · Researched & verified by ed.cafe editors
Published · 14 min read (3,248 words)
ed.cafe guide banner: EU Article 4 AI Literacy Log by Constance Ibe-Whitmore
Status as of October 2026: US federal & state rules (Massachusetts highlighted where distinct). Primary sources & sample sizes linked inline.

A composite scenario assembled from documented cases: In March 2026, an HR generalist at a 40-person Cambridge software firm with six remote support contractors in Lisbon and thirty client accounts in Frankfurt bought a generic 45-minute "Prompting 101" video course to satisfy Article 4 of the EU AI Act. Nobody in customer support learned when chatbot replies require EU transparency notices. Neither recruiter learned why pasting candidate resumes into personal chat accounts breaches GDPR rules. All six contractors in Portugal were skipped because they lacked payroll logins. Four months later, after Regulation (EU) 2026/1744 (published July 24, 2026; effective July 27, 2026) softened Article 4's legal verb, a sales director asked whether the firm could delete its training spreadsheet altogether (EUR-Lex Reg. 2026/1744). Scrapping that log removes the exact evidence national regulators request first after an AI incident.

The short answer

Under EU AI Act Article 4 AI literacy rules (live since February 2, 2025 and updated July 27, 2026 by Regulation (EU) 2026/1744), covered providers and deployers must take documented measures to support the development of AI literacy among staff and contractors, matched to role, context, and affected people. No accredited certificate or standalone fine schedule exists, so use the ed.cafe 40-Person Team Literacy Log below.

Why keep a structured record if the July 2026 Digital Omnibus eased the phrasing? Because unguided workplace AI use creates measurable security and compliance incidents. In KPMG and the University of Melbourne's 2025 global survey (n = 48,340 people across 47 countries), 66% of respondents reported intentional AI use, yet almost half of workplace users admitted using AI in ways that broke company policies (KPMG, Apr 2025). Separately, IBM's 2026 Cost of a Data Breach report (n = 602 breached organizations, vendor-sponsored Ponemon research) found unapproved employee AI tools involved in 43% of security incidents (IBM, Jul 29, 2026). Paired with our five-question EU AI Act scope check for US businesses and free 60-minute AI literacy session plan, this guide gives HR leads and internal champions a lightweight system that fits a 40-person firm. It provides operational compliance guidance, not formal legal advice.

What changed in Article 4 under the July 2026 Digital Omnibus, and what stayed mandatory?

On July 27, 2026, Regulation (EU) 2026/1744 (published July 24, 2026) replaced Article 4's outcome-heavy phrasing ("ensure, to their best extent, a sufficient level") with an action duty: providers and deployers "shall take measures to support the development of AI literacy" of their staff and external operators (EUR-Lex Reg. 2026/1744; Garrigues, Jul 2026). Every scoping rule stayed active.

Think of workplace vehicle safety versus racing licenses. Under 2024 wording, small firms feared having to guarantee that every employee passed an undefined EU exam ("a sufficient level"). Under the July 2026 rule, you need not guarantee individual exam scores, yet you must run documented, vehicle-specific instruction before handing one worker a box-truck key and another a warehouse forklift. Where that analogy breaks is licensing: unlike state motor registries, the European Commission mandates no government license or paid vendor credential (DLA Piper, May 2025).

Statutory element2024 text (Reg. 2024/1689, Feb 2, 2025)July 2026 text (Reg. 2026/1744, Jul 27, 2026)Meaning for a 40-person firm
Core verb."Ensure, to their best extent, a sufficient level...""Take measures to support the development of..."Proves structured employer support rather than individual exam guarantees.
Pass/fail floor.Ambiguous on individual score floors.No duty to guarantee a specific level per person.Paid certificates and proctored tests are optional.
Workforce scope.Staff + "other persons... on their behalf."Unchanged. Covers staff, contractors, and agencies.Freelancers and BPO reps touching EU outputs need a briefing.
Role tailoring.Match technical background and experience.Unchanged. One-size decks stay weak.Engineers, HR, and support reps get distinct rules.
Affected group.Match deployment context and affected people.Unchanged. Scales with downstream EU risk.Public bots and HR tools get tighter drills than internal drafts.

Under Article 2(1)(c), a US firm enters Article 4 scope only when placing AI on the EU market or where the output produced by its AI system is used in the Union (Art. 2). Once support bots, localized ads, or app outputs reach EU residents, Article 4 applies to everyday generative tools and high-risk systems alike.

If Article 4 has no standalone fine schedule, how does a missing training log hurt a small firm?

State this legal distinction plainly: Article 99 of the EU AI Act sets no standalone fine tier solely for an isolated Article 4 paperwork gap, so tying missing training logs to financial penalties is an indirect enforcement inference, not an automatic fine (Art. 99). In real investigations and sales reviews, that inference bites through four channels:

  1. Aggravating factor (Article 99(7)): When a national market surveillance authority (Article 70) investigates an unlabelled deepfake or bot (Article 50, up to EUR 15M or a 3% turnover threshold for firms) or banned workplace emotion AI (Article 5, up to EUR 35M or a 7% turnover threshold for firms), Article 99(7) weighs negligence and operator safeguards. Zero staff guidance turns a worker slip into organizational negligence.
  2. High-risk oversight (Article 14): Annex III HR and education obligations start December 2, 2027 (Reg. 2026/1744). Article 14(4) requires human overseers trained on automation bias and system overrides; zero Article 4 records invalidates Article 14 oversight.
  3. GDPR culpability (Article 83(2)): When staff leak EU client data into consumer bots, regulators weigh Article 32 training measures before setting GDPR fines (up to EUR 20M or a 4% turnover threshold for firms).
  4. Enterprise procurement: EU buyers request Article 4 records in security reviews (see our 25-question enterprise AI security review answer bank).

Why do generic slide decks fail Article 4's role-and-context test?

Generic "What Is an LLM?" videos miss Article 3(56)'s definition of AI literacy: skills, knowledge, and understanding enabling informed deployment and awareness of opportunities, risks, and possible harm (Art. 3(56)). Theory slides never teach a marketer to spot an Article 50 deepfake trigger.

Two public benchmarks show what role-matched support looks like:

  • EU AI Office Living Repository of AI Literacy Practices: Built from EU AI Pact submissions, the repository shares 40+ real organizational programs tiered across awareness, deployers, and builders (EC AI Office Living Repository). The Commission explicitly warns that copying a repository practice grants no automatic presumption of compliance; measures must fit your own tools and risks.
  • US DOL Five AI Literacy Areas (TEN 07-25, Feb 13, 2026): Search snippets often misstate "four pillars", whereas US DOL defines five areas: understand principles, explore uses, direct AI, evaluate outputs critically, and use AI responsibly (US DOL TEN 07-25). Pair those five areas with our scoreable DOL five-skill AI literacy rubric.

How do you divide a 40-person team (plus contractors) into four practical Article 4 tracks?

Instead of building 40 custom lesson plans, group a 40-person company (plus its external contractors) into four role tracks anchored to the decisions and EU outputs each group touches. Every person completes Track A once, and staff who publish to EU audiences, handle sensitive HR/client records, or ship code add one 30-to-45-minute role module.

Role trackTypical seats (40 staff + 6 contractors)Tools & EU contextCore risks & rules coveredScoreable 10-minute verification check
Track A: All-Hands Foundation.All 46 people (18 staff take Track A only).Approved workspace chat, search, meeting notes (60 min).Hallucinations, red-light PII rules, Art. 5(1)(f) emotion-AI ban, shadow-AI reporting.Spot 3 invented facts + 2 GDPR leaks in a sample draft.
Track B: Customer, Comms & Sales Deployers.10 staff + 3 support/ad contractors.Support bots, localized EU blogs, AI video dubbing (+30 min).EU Article 50 labelling rules, chatbot promise liability, human editorial sign-off log.Classify 5 EU assets (bot, dubbed video, edited post) and write disclosure lines.
Track C: HR, Finance & Operations Reviewers.6 staff.ATS filters, payroll/vendor docs, contract summaries (+45 min).Automation bias, GDPR PII boundaries, human corroboration, Dec 2027 Annex III readiness.Audit an AI candidate summary against raw resumes and document an override.
Track D: Builders, IT & API Integrators.6 engineers + 3 dev contractors.LLM APIs, coding assistants, MCP plugins, CMS pipelines (+45 min).Prompt injection, leaked API keys, Art. 50(2) C2PA preserveMetadata, zero-retention API flags.Configure preserveMetadata: true and block an indirect prompt-injection payload.

Worked annual time and dollar math for a 40-person firm (with 6 contractors):

  • Track A foundation: 46 people x 1.0 hour = 46.0 hours.
  • Role add-ons (Tracks B, C, D): 13 people x 0.5 hr (6.5 hr) + 6 people x 0.75 hr (4.5 hr) + 9 people x 0.75 hr (6.75 hr) = 17.75 hours.
  • Version-change micro-refreshers: Two 15-minute async updates per year when switching models or shipping a new EU bot = 46 x 0.5 hr = 23.0 hours.
  • Total annual budget: 86.75 hours across the entire organization (~1.9 hours per person per year). At a blended internal rate of $50/hour and $0 in third-party LMS software fees, full Article 4 role-matched support costs ~$4,338 per year in staff time, less than a single day of outside EU regulatory counsel.

Why are freelancers, agencies, and BPO agents the biggest blind spot in Article 4 audits?

Read the second half of Article 4's subject clause: "their staff and other persons dealing with the operation and use of AI systems on their behalf" (EUR-Lex Reg. 2026/1744). In a 40-person firm, high-exposure EU outputs often come from outside payroll: a freelancer making Midjourney ads for Berlin, a Lisbon support agency using your Intercom AI copilot, or a contract developer wiring an OpenAI key into checkout.

European Commission Q&A notes confirm deployers cannot outsource Article 4 away (DLA Piper, May 2025), while labor counsel warn against 20-hour mandatory contractor onboarding that blurs W-2 status. Use a clean two-part boundary instead:

  1. Send a 15-minute AI Tool & EU Output Briefing Sheet stating approved tools, banned PII inputs, and Article 50 label rules for SOW deliverables.
  2. Collect a signed Contractor AI Literacy Attestation before system access or EU asset delivery.

How do you maintain the ed.cafe 40-Person Team EU Article 4 Role-Matched AI Literacy Log?

Copy the ed.cafe 40-Person Team EU Article 4 Role-Matched AI Literacy Log & Contractor Attestation into an HR/Ops sheet or Git repo. The ed.cafe 40-Person Literacy Log follows the Commission's May 2025 Q&A: internal records prove support without external certificates, linking role, tools, EU audience, and verification task.

The ed.cafe 40-Person Team EU Article 4 Role-Matched AI Literacy Log & Contractor Attestation
THE ED.CAFE 40-PERSON TEAM EU ARTICLE 4 ROLE-MATCHED AI LITERACY LOG
Verified: Oct 29, 2026 | Reg. (EU) 2024/1689 Art. 4 as amended by Reg. (EU) 2026/1744
Publisher: ed.cafe by No Worker Left Behind (501(c)(3), EIN 88-3268312)
Internal operational record; not formal legal advice.

PART 1: ONE-PAGE ORGANIZATIONAL ARTICLE 4 SUPPORT POLICY
1. Legal Basis: Pursuant to EU AI Act Art. 4 (Reg. 2026/1744, eff. Jul 27, 2026),
   [Organization Name] takes documented, role-matched measures to support AI literacy
   for employees and external contractors operating AI systems on our behalf where
   systems or outputs reach the European Union (Art. 2(1)(c)). No individual exam
   guarantee is claimed; practical verification tasks confirm informed deployment.
2. Refresh Triggers: Re-brief affected tracks within 30 days whenever (a) onboarding
   a new hire or contractor, (b) approving a new AI tool or model family, or (c)
   launching a customer-facing EU chatbot, synthetic media campaign, or HR AI workflow.
3. Retention: Keep logs for 48 months alongside approved tool inventories.

PART 2: SPREADSHEET LOG SCHEMA & FILLED SAMPLE ROWS
Columns: [Worker_ID | Type | Dept_Track | Approved_Tools | EU_Affected_Group |
Prior_Background | Modules_Completed | Practical_Check_Completed | Date_UTC | Next_Trigger]

Row 1: EMP-014 | Employee | Support (Track A+B) | Zendesk AI, Claude Team | EU SaaS
       buyers | Non-technical BA | 60m Foundation + 30m Art.50 Bot/Text | Passed 5-item
       EU bot & deepfake label drill | 2026-10-15 | New bot launch / Oct 2027
Row 2: EMP-022 | Employee | HR Ops (Track A+C) | M365 Copilot, Greenhouse | EU remote
       applicants | SHRM HR generalist | 60m Foundation + 45m Bias & PII | Audited AI
       resume summary & logged override | 2026-10-18 | Pre-Dec 2, 2027 Annex III check
Row 3: CON-004 | Contractor | Lisbon Support Agency (Track A+B) | Zendesk AI | PT/ES/DE
       support tickets | Customer support | 15m EU Briefing Sheet + SOW Rider | Signed
       Agency Attestation + PII red-line check | 2026-10-20 | SOW renewal

PART 3: CONTRACTOR & AGENCY SOW AI LITERACY RIDER (COPY-PASTE)
"EU AI Act Art. 4 & 50 Compliance: Contractor confirms that any personnel using AI
tools to perform Services or produce deliverables reaching the European Union on
Company's behalf have reviewed Company's 1-Page AI Tool & Transparency Briefing and
possess role-appropriate AI literacy regarding hallucination verification, confidential
data exclusions, and mandatory EU Article 50 synthetic-content disclosures. Contractor
shall identify in writing any unreviewed AI-generated public-interest text or synthetic
audio/video/image resembling real persons or places upon delivery."
Signed: _______________________  Entity/Role: _________________  Date: __________

If an operations lead or HR generalist on your team wants structured peer practice building workplace AI verification habits, No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312) is forming Circle #1 at ed.cafe/start/, a free 30-chair cohort built around the Google AI Professional Certificate (free for Massachusetts residents via the Massachusetts AI Hub; Circle #1 closes December 1, 2026 and is pre-launch as of October 2026 with zero completed cohorts yet). Pair the ed.cafe 40-Person Literacy Log with our free 60-minute AI literacy session script and open guides in the Staff Room.

Where this stops being true

  • High-risk Annex III human oversight after December 2, 2027: Lightweight 90-minute literacy tracks satisfy general Article 4 deployer duties today, but if your firm deploys high-risk AI in employment, credit, education, or essential services inside the EU, Article 14 and Article 26 (effective December 2, 2027 under Reg. 2026/1744) require deeper system-specific operator training based on the provider's instructions for use.
  • Works councils and collective bargaining in EU Member States: If you employ staff directly in Germany (BetrVG § 87 / § 90), France (CSE), or the Netherlands, rolling out AI tools or tracking individual quiz scores can trigger mandatory works-council consultation or co-determination before launch. Log completion of attendance and group drills rather than invasive employee surveillance metrics.
  • Sector licensing rules: Clinical staff, licensed engineers, attorneys, and financial advisers remain bound by professional supervision and continuing-education rules that exceed Article 4.
  • Not legal advice: Retain EU employment and technology counsel when drafting works-council agreements, deploying Annex III HR tools, or responding to a national market surveillance authority request.

Questions people ask

Did the July 2026 EU Digital Omnibus repeal Article 4 AI literacy training?

No. Regulation (EU) 2026/1744 (published July 24, 2026; effective July 27, 2026) kept Article 4 active and rewrote the duty so providers and deployers must "take measures to support the development of AI literacy" for staff and contractors, while clarifying they do not have to guarantee a specific competency score for each individual.

Do employees need an official EU certificate to comply with Article 4?

No. Both Regulation (EU) 2026/1744 and the European Commission's AI Office Q&A confirm there is no mandatory EU-wide exam, accredited vendor course, or formal certification requirement. Documented internal role-based sessions, practical verification drills, and tool-specific guidelines satisfy the employer's duty to support AI literacy.

What are the fines for violating Article 4 of the EU AI Act?

Article 99 of the EU AI Act does not set a standalone fine tier solely for Article 4 in isolation. However, missing literacy records act as an aggravating negligence factor under Article 99(7) and GDPR Article 83(2) when national authorities investigate substantive breaches such as unlabelled deepfakes, prohibited emotion AI, or data leaks.

Does EU AI Act Article 4 cover freelancers and outsourced agencies?

Yes. Article 4 explicitly covers both "their staff and other persons dealing with the operation and use of AI systems on their behalf." When a marketing agency, freelance designer, or outsourced customer-support vendor uses AI to produce outputs used in the EU for your firm, obtain a briefing sign-off or SOW attestation.

Does copying a program from the EU AI Office Living Repository guarantee compliance?

No. While the European Commission's Living Repository of AI Literacy Practices shares over 40 real-world company examples from EU AI Pact signatories, the Commission explicitly states that replicating a repository example does not grant an automatic presumption of legal compliance. You must still match measures to your own roles and risks.

How long does Article 4 AI literacy training take for a 40-person business?

A practical role-matched program takes roughly 90 to 120 minutes per employee per year: a 60-minute foundational session on hallucinations and data boundaries for everyone, a 30-to-45-minute role module for customer/marketing, HR, or engineering staff, and 15-minute updates when AI tools or EU workflows change.

Key terms

  • AI literacy (Article 3(56)): Skills, knowledge, and understanding enabling providers, deployers, and affected persons to deploy AI systems in an informed way and recognize opportunities, risks, and potential harm.
  • Digital Omnibus on AI (Regulation (EU) 2026/1744): July 2026 EU amending regulation updating Article 4 to "take measures to support" AI literacy and moving Annex III high-risk deadlines to December 2, 2027.
  • Living Repository of AI Literacy Practices: Public database run by the European Commission's AI Office showcasing 40+ organizational literacy programs without conferring automatic compliance safe harbor.
  • Market surveillance authority (Article 70): National EU regulator empowered to request operator documentation, investigate AI incidents, and assess administrative fines under Article 99.
  • Persons dealing on their behalf (Article 4): Statutory phrase extending an organization's AI literacy support duty to contractors, freelancers, agencies, and outsourced service operators.
  • US DOL five AI literacy areas (TEN 07-25): Federal US framework covering AI principles, uses, effective direction, critical output evaluation, and responsible use.

Sources

  1. Official Journal of the European Union, "Regulation (EU) 2026/1744 (Digital Omnibus on AI)" (Jul 24, 2026): EUR-Lex
  2. Official Journal of the European Union, "Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2, 3, 4, 14, 70 & 99" (Jul 12, 2024): EUR-Lex
  3. European Commission AI Office, "Living Repository of AI Literacy Practices" (2025-2026): European Commission
  4. DLA Piper, "EU AI Act Update: European Commission Publishes AI Literacy Questions and Answers" (May 2025): DLA Piper
  5. Garrigues Digital, "The AI Digital Omnibus Regulation Has Been Published, Redefining Deadlines and Obligations" (Jul 2026): Garrigues
  6. US Department of Labor (ETA), "Training and Employment Notice No. 07-25: AI Literacy Framework" (Feb 13, 2026): US DOL
  7. KPMG International & University of Melbourne, "Trust, Attitudes and Use of Artificial Intelligence: A Global Study 2025 (n = 48,340)" (Apr 2025): KPMG
  8. IBM Newsroom, "2026 Cost of a Data Breach Report (n = 602 breached organizations)" (Jul 29, 2026): IBM
  9. Official Journal of the European Union, "Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 32 & 83": EUR-Lex
  10. Future of Life Institute EU AI Act Explorer, "Article 4: AI Literacy & Article 99: Penalties": Artificial Intelligence Act Explorer
Free for Massachusetts learners

Finish Google's AI certificate with 30 neighbors in Boston.

Circle #1 is forming now (closes December 1, 2026; zero cohorts have run yet, and every completion count will be published two ways). Educators can run a Finish Line cohort in the Staff Room; L&D leaders can inspect license waste in the Council.