Status update — April 2026: The Digital Omnibus on AI (COM(2025) 836), now in trilogue following the Council position of 13 March 2026 and Parliament plenary vote of 26 March 2026 (569–45–23), proposes to amend Article 4. The current direct obligation on providers and deployers to ensure staff AI literacy would transform into a duty on Member States and the Commission to "foster" AI literacy through training, resources, and good practice exchange. The deployer-specific training obligation under Article 26(2) for high-risk systems remains. This note reflects the Regulation as it currently stands; Omnibus outcome is not yet determined. See our Digital Omnibus deep dive.

Article 4 of the EU AI Act is the obligation most often treated as optional and most often genuinely required. It entered into force on 2 February 2025 — more than a year before most of the Regulation's other obligations — and it applies to any provider or deployer of an AI system, regardless of risk level. For a NYC HR team using AI recruitment tools with any EU exposure, Article 4 already applies. This note covers what it requires and how to satisfy it without turning it into a program that absorbs more resources than it deserves.

The text

Article 4 reads, in full: "Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used."

Four elements embed in that text, and each requires operational response:

First, the duty applies to providers and deployers — both. A NYC HR team deploying a third-party ATS with AI ranking is a deployer. A NYC HR tech company building the ATS is a provider. Both must ensure AI literacy of their staff.

Second, "sufficient" is intentionally flexible. The Article does not prescribe a curriculum, a number of training hours, or a certification. Sufficiency is context-dependent.

Third, the measure must take into account technical knowledge, experience, education, and training — of the persons involved. This implies differentiated training by role. A data engineer working on the model does not need the same training as a recruiter using its outputs.

Fourth, the measure must consider the persons or groups of persons on whom the AI systems are used. In the HR context, this means AI literacy content must include awareness of the candidate population — its diversity, its vulnerabilities, and the ways the AI system's outputs can affect them.

What this looks like operationally for a NYC HR team

A pragmatic Article 4 program for a NYC HR team with 50-200 recruiters includes four components:

A baseline literacy module for all recruiters. One hour of training (live or recorded) that covers: what the AI system in use is, what it does mechanically (ranks candidates, parses resumes, schedules, whatever applies), what signals it uses, where it can fail, what the recruiter's override rights are, what the candidate's rights are under LL144 and Article 26(11), and how to handle a candidate's question about the AI tool. The module is updated when the AI system changes.

A deeper module for HR leadership and compliance. Two to four hours covering additional content: the LL144 bias audit cycle, the EU AI Act Article 9 risk management relevance, the candidate notice infrastructure, escalation paths for suspected discrimination, and the documented human oversight mechanisms under Article 14. Delivered once at onboarding and refreshed annually.

A role-specific module for engineering and data teams. Applies where the company is a provider (building the AI system). Covers: the technical documentation expectations under Annex IV, the risk management system under Article 9, the data governance requirements under Article 10, the accuracy and robustness expectations under Article 15, and the post-market monitoring obligations under Article 72. Delivered through whatever engineering-training format the company already uses (internal wiki, eng all-hands, engineering manager briefings).

A documentation trail. Article 4 does not prescribe specific documentation, but in an enforcement or audit context the company must be able to demonstrate that literacy measures were taken. Minimal defensible documentation includes: the training curriculum, a roster showing who completed what training and when, a sample of the materials delivered, and a brief annual review memo from the compliance function confirming the program is current.

What Article 4 is not

Article 4 is not a certification requirement. There is no required AI literacy certificate that HR staff must hold. Reports that have circulated suggesting IAPP AIGP or similar certifications are mandated for general staff are incorrect — AIGP is valuable professional development for AI governance practitioners, but it is not the standard Article 4 imposes on recruiters.

Article 4 is not a one-time training. The "to their best extent" language implies ongoing measures, updated as the AI systems the company uses change. A 2025 one-hour module that has not been updated when the company adopted a new ATS in 2026 is not sufficient.

Article 4 is not waivable by contract with the AI system vendor. The deployer's obligation is the deployer's own obligation — even if the ATS vendor provides training materials, the deployer is responsible for ensuring its own staff receive and understand them.

The integration point with LL144

LL144 does not contain an explicit AI literacy obligation. But the DCWP Final Rules require a pre-use candidate notice that identifies the job qualifications and characteristics the AEDT will use — which the recruiter delivering that notice must actually understand. In practice, adequate LL144 notice delivery presupposes the kind of literacy Article 4 requires.

For a NYC HR team in dual compliance, the training materials developed for Article 4 should cover LL144 notice content at the same time. A recruiter who understands what the AEDT does (Article 4) and can accurately describe that to a candidate (LL144 notice) is satisfying both regimes with one training program.

For dual compliance program support including Article 4 literacy materials, see Lexara Advisory.

Primary sources. Regulation (EU) 2024/1689: Article 4 (AI literacy), Article 14 (human oversight), Article 26 (deployer obligations), Article 72 (post-market monitoring), Article 113 (entry into force dates). NYC Admin Code §§ 20-870 to 20-874. DCWP Final Rules, 6 RCNY Ch. 5 Subchapter T.