Training Your Teams in AI: What Article 4 of the AI Act Requires

What Article 4 said, and what it has said since the Omnibus#

The original text of Regulation (EU) 2024/1689 required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons using AI systems on their behalf. This wording resembled an obligation of result.

Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”, adopted on 8 July 2026 and in force since 27 July 2026, rewrote the article. Companies must now take measures to support the development of AI literacy among their staff. The idea of a level to be guaranteed disappears. In return, the Commission and the Member States must support these efforts, particularly for SMEs, and the European Artificial Intelligence Board must adopt recommendations based on European competence frameworks.

The shift from an obligation of result to an obligation of means does not remove the obligation. It changes the question asked by an inspector or a client: no longer “do your staff have the right level?” but “what have you put in place, for whom, and how do you know?”.

Who is covered, including in Morocco#

Article 4 covers providers and deployers. The provider develops an AI system and places it on the market under its own name; the deployer uses it under its own authority in a professional context. Our guide provider or deployer sets out the method for determining which you are.

The AI Act applies to providers and deployers established outside the Union where the output produced by the system is used in the Union (Article 2). Covered organisations therefore include, for example:

• a Moroccan contact centre that uses a chatbot, a voicebot or a writing-assistance tool for European customers;
• a Moroccan software publisher that sells an AI tool to European companies;
• a firm or service company that uses AI to produce analyses delivered to a European client.

The general context of the regulation for the sector is presented in our guide on the AI Act and Moroccan BPOs. A company with no link to the Union is not covered, but it has every interest in applying the same approach: some AI-related incidents in customer service can stem from a poorly understood use of the tool.

What the Commission has clarified#

The Commission's questions-and-answers page on AI literacy provides several useful pointers:

• the regulation sets no level of proficiency;
• no certificate is required;
• no AI literacy officer has to be appointed;
• organisations keep internal records of their measures;
• enforcement lies with the national market surveillance authorities, with effective enforcement indicated from 3 August 2026.

The Commission also maintains a living repository of AI literacy practices, which lists more than forty initiatives by organisations. It makes it possible to draw inspiration from existing programmes without copying them.

What a proportionate programme looks like, by role#

The regulation does not set any content. Proportionality is worked out from three questions: which systems, used by whom, with what risks for the people affected. The table below is a good-practice proposal, not a legal requirement.

For customer-facing agents, training must cover informing customers that they are talking to an AI, mandatory since 2 August 2026 (see our guide on Article 50 and chatbots), and what is prohibited, such as recognising employees' emotions from their voice or image (see our guide on emotion analysis in call centres). For high-risk systems, Article 26 additionally requires human oversight to be assigned to people who are competent, trained and have the necessary authority, from 2 December 2027 for Annex III systems.

The links with Law 09-08 and ISO/IEC 42001#

Law 09-08. Law 09-08 on personal data protection, Morocco's data protection law, contains no AI literacy obligation. But most AI tools in customer service process personal data: recordings, transcripts, histories. Teams must know the rules on purpose, information and security, and Article 11 of the law, which governs decisions based on automated processing. Training in AI without training in data leaves a blind spot; see our comparison of Law 09-08 and the GDPR.

ISO/IEC 42001. The AI management system standard includes the competence requirement common to management system standards: determine the competences needed, make sure people have them, act to close the gaps and keep evidence. A programme designed for Article 4 therefore also serves an ISO/IEC 42001 approach.

Compliance culture. AI literacy works best when it is part of an existing compliance culture, with reporting channels that are known and used.

The evidence to keep#

1. The inventory of AI systems used or provided, with their use.
2. The company's role (provider or deployer) for each one.
3. The matrix of roles and associated training content.
4. Dated materials, in the teams' languages.
5. Attendance lists and, where useful, short comprehension checks.
6. The update plan for each new tool or significant change.
7. A review by management at least once a year.

30-day action plan#

1. Week 1: take an inventory of AI tools, including those adopted without approval.
2. Week 2: identify the exposed roles and the risks for each tool.
3. Week 3: produce a common module and role-specific modules, in French and Arabic.
4. Week 4: train the first groups, archive the evidence, schedule the review.