TL;DR
Article 4 covers two roles defined in Article 3 of the AI Act: providers (organisations that develop or market an AI system in the EU) and deployers (organisations using an AI system under their authority for non-personal purposes). Both must ensure a sufficient level of AI literacy among any staff and third parties who operate AI systems on their behalf, with training proportionate to the role, the system, and the people affected. If your team uses ChatGPT for client work, hires a vendor that runs an AI-driven workflow, or integrates a model into a product, Article 4 applies.
What “provider” and “deployer” actually mean
The European Commission’s AI Act service desk provides the canonical scope guidance. A provider is anyone who develops an AI system or general-purpose AI model and places it on the market in the EU under their own name. A deployer is anyone using an AI system under their own authority, not in the course of a personal non-professional activity. Most organisations in the EU are deployers, often without realising it: any internal use of a third-party AI tool puts the organisation in scope.
The Digital Strategy page on the AI Act framework lists the obligations that flow from each role. Article 4 obligations sit on both: providers must train their development and deployment staff, deployers must train any staff “operating and using AI systems on their behalf”.
The scope decision tree
Run your organisation through these questions in order:
- Do any of your products or services use an AI system? If yes, you are at minimum a deployer.
- Do you build or fine-tune an AI model that is then used by others? If yes, you are also a provider.
- Does any third-party tool you procure (CRM, support desk, marketing platform, code assistant) include AI features that staff actively configure or rely on? If yes, the staff using those features fall in scope as deployer-side operators.
- Are any of your staff supervising AI-driven decisions that affect customers, employees, or members of the public? If yes, those staff need additional Article 4 coverage and, in some cases, Article 22 GDPR coverage too.
The Portuguese national AI strategy and the Government of Portugal’s digital portal anchor the same definitions for organisations operating under Portuguese law.
Role coverage in practice
A workable Article 4 programme covers four role tiers:
- Operators and end-users of AI tools (sales, marketing, ops, support, legal, finance staff using AI inside a workflow). Training focus: prompt hygiene, hallucination spotting, when to escalate.
- Configurers and supervisors (team leads, AI champions, anyone who tunes prompts, sets policies, or monitors model outputs). Training focus: bias signals, escalation paths, audit logging.
- Builders and procurers (developers, data scientists, IT buyers). Training focus: model evaluation, technical documentation expected by Article 11, vendor due diligence.
- Decision-makers and risk owners (executives, compliance, DPOs, internal audit). Training focus: Article 99 penalty exposure, governance design, board reporting.
University-led research from Instituto Superior Técnico and Nova IMS consistently lands on the same four-tier structure as the operationally defensible baseline.
What evidence regulators ask for
Per the AI Office’s published guidance and the AI Act service desk FAQs, supervisors look for: a written training plan referencing Article 4, attendance and completion logs, role-specific curricula, evidence of refresher cadence, and documentation that the level of training is proportionate to the AI systems and the people affected. Generic e-learning that ignores the specific tools your team uses does not meet the bar.
How AISO Learn helps
We map your tools and roles to a four-tier curriculum and deliver it across the organisation in eight weeks, with the documentation pack a regulator would expect. See our team-engagement programme for the structure.
Map your team's Article 4 coverage