AI literacy: the EU AI Act duty that is already live

Edition 12. A reading time of about 5 minutes.

The hook

Most of the EU AI Act that touches hiring arrives in 2026 and 2027, on a timetable that is still moving. One part did not wait. Since 2 February 2025, every organisation that uses an AI system, including the tools your recruiters and HR team already rely on, has owed a duty to make sure the people operating that system have a sufficient level of AI literacy. It is the first AI Act obligation to be in force, it applies whether or not your tool is classed as high-risk, and almost no one has noticed. The reassuring part: meeting it costs very little, and the law deliberately leaves you room to do it your way.

What this means

The duty is short and broad. As both the law and the European Commission's AI Office put it, "Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf" (AI Act, Article 4). "AI literacy" is defined as the "skills, knowledge and understanding" that let people make informed use of AI systems and stay aware of the opportunities, risks, and possible harm involved (AI Act, Article 3(56)). In plain terms: the people who run an AI hiring tool should understand, at the level their role requires, what it does, where it can go wrong, and when to question it.

Two features make this different from the rest of the Act. First, the timing. Article 4 sits in Chapter I, which has applied since 2 February 2025, well ahead of the general application date of 2 August 2026 (AI Act, Article 113). Second, the reach. It is not limited to high-risk systems. If your team uses AI in screening, scheduling, sourcing, or drafting, the literacy duty already covers them.

What it does not demand is just as important, and the AI Office has said so plainly. Supervision and enforcement of Article 4 do not sit with the AI Office; they fall to national market surveillance authorities, which start that role from 2 August 2026, under penalty rules each Member State is to adopt by 2 August 2025 (AI Office, AI Literacy Q&A). The same guidance is explicit that there is "no one size fit all", that the AI Office will not impose mandatory trainings, and that "there is no need for a certificate", an internal record of trainings and other initiatives is enough. The obligation is real and live; the approach is yours to shape to your roles and risks.

One open thread, flagged honestly. Under the Commission's Digital Omnibus package, Article 4 is among the provisions proposed for change, with the general literacy push shifting toward Member States and the Commission, while the duty to train staff who operate high-risk systems for human oversight would remain. That proposal is not yet final law and has not been published in the Official Journal, so today's text stands as written above. We will flag it here the moment it is settled.

What to do with this

You can satisfy this duty this quarter, on the staff and tools you already have. Three steps.

1. List who operates AI, then match literacy to the role. A recruiter using an AI screening tool needs a working grasp of what it scores and how to override it; a hiring manager glancing at a ranking needs less. Article 4 asks for a level that fits "their technical knowledge, experience, education and training and the context", so calibrate, do not over-engineer. (This pairs naturally with a quick inventory of where AI sits in your hiring stack.)
2. Run a short, role-appropriate briefing, and keep a light record of it. A focused session on what the tool does, its known limits, and when to escalate is enough for most teams. Note who attended and what was covered. The AI Office confirms no certificate is required, but a simple internal record is the difference between "we trained people" and "we can show we did".
3. Fold it into onboarding, not just a one-off. New joiners and new tools arrive all year. Make the briefing part of how someone is set up to use an AI system, so literacy stays current instead of decaying after a single all-hands.

Done this way, AI literacy stops being a compliance line item and becomes what it was meant to be: the baseline competence that makes every other safeguard, oversight, evidence, vendor scrutiny, actually work. The teams treating it as a habit now are the ones who will not be scrambling when the rest of the Act lands.

This is educational material and a starting point, not legal advice. The EU AI Act is still being amended, and parts of Article 4 are among the provisions proposed for change under the Commission's Digital Omnibus package, which is not yet final law. For how the AI literacy duty applies to your specific tools, roles, and workforce, and how national rules implement it, consult a qualified lawyer. Signato is not a law firm and does not certify compliance.

Not sure where your hiring stack stands? Take the free AI Hiring Risk Self-Assessment to see where you are exposed, then see the same evidence-first discipline applied to what your AI sends out: the free local trial of the Signato chamber blocks a draft that pairs the wrong person with the wrong subject before it leaves, no card, nothing leaves your machine.

Every claim here is traced to the primary regulation and checked by a person before it goes out. We tell you what is settled, what is still open, and what to do next. Know someone who uses AI in hiring in the EU? Forward this to them.

Sources (primary, read 2026-06-07):

- AI Act, Article 4 (AI literacy), verbatim text of the obligation. - AI Act, Article 3(56), definition of "AI literacy". - AI Act, Article 113, application dates: Chapters I and II from 2 February 2025; general application 2 August 2026. - European Commission, AI Office, AI Literacy: Questions & Answers, application date; enforcement by national market surveillance authorities from 2 August 2026; national penalty laws due by 2 August 2025; no certificate required; no one-size-fits-all.