How to Build an AI Literacy Program Under Article 4

Article 4 of the EU AI Act has been in force since February 2, 2025. It requires that providers and deployers of AI systems take measures to ensure their staff have a sufficient level of AI literacy. This is not aspirational — it is a legal obligation already in effect.

This guide explains exactly what the requirement means, who it covers, and how to build a training program that satisfies it.

What Article 4 Requires

The text of Article 4 is brief but consequential: providers and deployers of AI systems "shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf."

Three things to note. First, this applies to deployers — any organisation using AI tools in their operations — not only companies that build AI. If your team uses ChatGPT, Copilot, AI-assisted hiring tools, or any AI-powered software, you are a deployer and Article 4 applies. Second, the obligation is to take measures "to their best extent" — this is a proportionality standard, not a perfection standard. A 250-person company is not held to the same standard as a 50,000-person enterprise. Third, the obligation is ongoing. It is not satisfied by a one-time training event. As tools change, training must keep pace.

Who It Covers

Article 4 covers staff who use AI systems in their day-to-day work. This is not limited to technical staff. It explicitly includes "other persons dealing with the operation and use of AI systems on their behalf."

In practice, this means:

• Customer service staff using AI-assisted response tools
• HR staff using AI for CV screening or performance monitoring
• Finance staff using AI for fraud detection or credit assessment
• Marketing staff using AI for content generation or audience targeting
• Managers using AI dashboards or forecasting tools to make decisions

The obligation does not require every employee to become an AI expert. The standard is "sufficient literacy" — enough to understand what the AI does, recognise its limitations, and know when to apply human judgment.

What "Sufficient" Means

The regulation does not define a certification standard or a minimum number of training hours. What counts as sufficient depends on the role, the AI systems involved, and the decisions being made.

As a working definition, an employee has sufficient AI literacy if they can answer yes to the following:

• I understand what this AI tool does and what it is designed for.
• I understand what inputs the tool uses and what its outputs represent.
• I know the main limitations of this tool — what it can get wrong and why.
• I know when I should not rely on the AI output alone and need to apply human judgment.
• I know my data protection obligations when inputting personal data into AI tools.

No formal certification is required. Documented training that addresses these points is sufficient.

What a Compliant Program Looks Like

A practical AI literacy program for deployers can be structured as four modules:

Module 1 — What Is AI? Cover the basics: what machine learning means, how AI systems generate outputs, why they can be wrong, and the difference between narrow AI (a specific tool) and general AI. Duration: 30–45 minutes. Format: e-learning or recorded video works well here.

Module 2 — How Our AI Tools Work This module is tool-specific and will differ by role. Cover each AI system your organisation uses: what it does, what data it processes, who makes the final decision, and what the tool cannot do. Duration: 15–30 minutes per tool. Format: guided walkthrough or live workshop.

Module 3 — Risks and Limitations Cover the main failure modes of AI: hallucination (confident wrong answers), bias in training data, distribution shift (the tool behaving differently in new contexts), and automation bias (humans over-trusting AI output). Duration: 20–30 minutes. Format: case studies or scenario exercises are effective.

Module 4 — When to Escalate to Human Review Define clear escalation criteria: when must a human review an AI output before it is acted on? What are the red flags that should trigger escalation? What is the process for flagging concerns about an AI tool? Duration: 15–20 minutes. Format: decision flowchart plus worked examples.

For onboarding, deliver a condensed version (Modules 1 and 4 minimum) before a new employee starts using AI tools. For existing staff, roll out the full program and then run refreshers annually or whenever a significant new tool is introduced.

Documentation: What to Record

Documentation is what makes the difference between training that happened and training that can be demonstrated to a supervisory authority. The record does not need to be sophisticated — a spreadsheet is sufficient — but it should contain:

| Field | What to Record | |-------|---------------| | Employee name | Full name | | Role | Job title and department | | Training completed | Module name and version | | Date | Date of completion | | Format | E-learning / workshop / briefing | | Attestation | Employee confirmation (checkbox or signature) |

Store this record in your HR system or a dedicated compliance tracker. Retain it for the duration of employment plus at least three years.

Common Mistakes

Thinking this only applies to AI developers. It does not. The obligation applies to deployers — any organisation using AI in its operations. If your HR team uses an AI CV screener, Article 4 applies to them.

Thinking it is a one-time exercise. It is not. The obligation is ongoing. When you adopt a new AI tool, the relevant staff need training on that tool before they start using it. When a tool is significantly updated, a refresher is appropriate.

Training only technical staff. The people with the highest exposure to AI outputs are often non-technical: recruiters using screening tools, customer service agents using response assistants, finance staff using forecasting dashboards. They need training as much as engineers do.

No documentation. Training without records cannot be demonstrated. If a supervisory authority asks for evidence of your Article 4 compliance, "we had a presentation" is not sufficient. Records are the proof.

5-Step Implementation Checklist

1. Inventory your AI tools — list every AI system your organisation uses, and identify which staff interact with each one.
2. Map training needs by role — for each AI tool, identify which roles use it and what level of understanding is appropriate.
3. Build or adapt your four-module program — adapt the module structure above to your organisation's tools and context.
4. Deliver and document — roll out to all relevant staff and record completion in your tracking spreadsheet.
5. Set a review schedule — schedule annual refreshers and define the trigger for ad hoc refreshers (new tool adoption, significant tool update).

Article 4 is already in force. The cost of a basic literacy program is low. The cost of being unable to demonstrate compliance is not.

---

Last updated: April 2026. For informational purposes only — not legal advice.