Article 4 — AI literacy

Official title, Regulation (EU) 2024/1689

Special-category data processed for bias detection in a high-risk system — strict necessity, pseudonymisation, access control, no onward transfer, deletion once corrected

Who it binds

provider

Evidence that discharges it

a written policy

Usually owned by

DPO

Severity

Major — a gap here is a finding an auditor will raise and expect a remediation plan for.

Does it apply to you?

Applicability under the Act is risk tier × operator role, not tier alone. This grid is computed by running the same function the assessment uses, so it cannot drift from what the product would tell you.

• high riskprovider

Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744). What we work from