What does EU AI Act Article 4 require from a Romanian company?

Article 4 of the EU AI Act requires companies that provide or deploy AI systems to take measures ensuring a sufficient level of AI literacy among their staff and other people using AI on their behalf. It has applied since February 2, 2025. It does not require a mandatory certification, a specific course or a standardized exam. The measures should reflect people's technical knowledge, the context in which AI is used and the people affected by that use.

If employees in your company use ChatGPT, Microsoft Copilot, Gemini or internal AI tools as part of their work, your company is in scope as a deployer. That is true even if the company never bought licenses, because informal use on work tasks still counts as use on the company's behalf.

What Article 4 does not say

Three common misreadings create bad buying decisions:

• It does not mandate a certificate. No EU body issues an official "Article 4 certificate", and a provider who guarantees legal compliance through one course is overselling.
• It does not prescribe one training format. The measure must fit the context: the technical knowledge of your staff, the tools they use and the people affected by that use.
• It is not only about training. Usage rules, data boundaries, verification habits and documented practice all count as literacy measures.

What reasonable measures look like

For a typical Romanian company where non-coding roles use AI tools at work, a defensible baseline covers:

1. An inventory of which AI tools are used, by whom and on which tasks.
2. Written rules on what data must never enter public or unapproved tools.
3. Role-based training on the tasks people actually do, not generic tool demos.
4. A verification standard: how AI output is checked before it is used or sent.
5. Internal records of who was trained, on what, when, and what rules were issued. The Commission recommends keeping such records as prudent evidence, but Article 4 does not prescribe a certificate or a specific documentation format.

The output of these measures is evidence. If a client, auditor or authority asks how your company addresses AI literacy, you can show documents and observed practice instead of intentions.

Where to start

The fastest way to see where you stand is to measure the gap between the AI tools your company pays for and how work actually starts each day. The free AI Adoption Score at unlearning.ro/score takes 7 minutes and gives you a concrete picture. For the deeper legal context, read the full guide on AI literacy under Article 4.

Frequently asked questions

Does Article 4 apply if we only use free ChatGPT informally?

Yes. If employees use AI tools on work tasks, the company is a deployer and should take proportionate literacy measures. Informal use without rules is the riskiest position, because there is use but no evidence of responsible use.

Is there a fine for ignoring Article 4?

Article 4 is not listed with a dedicated fine in the AI Act's penalty provisions. Other legal or contractual duties may still apply depending on the AI system and its use. Treat those questions separately and obtain legal advice for your specific case.

Do we need to certify every employee?

No. You need proportionate literacy measures for the people who use AI on your behalf. Keeping internal records is a prudent way to show what the company did. Depth should follow role and context, not a one-size certificate.

Can a single workshop make us compliant?

No provider can honestly guarantee compliance. A good workshop produces part of the evidence: documented training on real tasks, usage rules and verification habits. Compliance is the ongoing practice, not the event.

Sources

• European Commission, AI Literacy, Questions & Answers
• EUR-Lex, Regulation (EU) 2024/1689 (AI Act)

Next step

Read AI literacy for employees or measure your starting point with the AI Adoption Score.