AI literacy under Article 4: from intention to evidence that holds
For: HR and compliance leads
Updated: 2026-09
Article 4 asks for a sufficient level of AI literacy, measured against role, context and the people affected. It becomes workable in four moves: form roles, set a depth per role, train accordingly, and record attendance with date, content and the link to the role.
Article 4 is the obligation most companies stumble on first — not because it is hard to meet but because it has no tangible end state. There is no prescribed number of hours, no set curriculum and no certificate that closes the matter.
This checklist turns it into something testable. The measure is not whether training happened but whether its depth matches the task and whether that can be shown.
The checklist
- 01
Form roles rather than person lists
Three or four groups usually suffice: responsibility for selecting and operating systems, professional use with decision effect, occasional use without decision effect, and leadership. Person lists go stale; roles do not.
Done when: Every person in the company maps to exactly one group, and the mapping is traceable.
- 02
Set a depth of competence per role
Establish what each group must understand: system limits, handling of output, recognising errors, the legal frame. Those selecting systems need classification knowledge; those merely using them need handling knowledge.
Done when: For each role the points to be conveyed are written down before any training is chosen.
- 03
Factor in the people affected
Article 4 expressly refers to the persons on whom the systems are used. Where output affects customers, applicants or patients, the expected level rises noticeably.
Done when: For each role it is noted which groups of people are affected by the output.
- 04
Choose a training format per role
External certificate for roles carrying responsibility, documented internal briefing for general use. One uniform programme is either too shallow for some or needlessly heavy for others.
Done when: Each role has a chosen format with the reasoning recorded.
- 05
Record attendance so it holds
Name, date, content and link to the role. Those four fields decide whether training counts as evidence — not the quality of the material.
Done when: For any person picked at random, what they completed and when can be shown in under five minutes.
- 06
Build new joiners into the process
Initial training belongs in onboarding. Without that link, a growing group without evidence builds up within a year.
Done when: AI literacy is a fixed item on the onboarding checklist rather than a verbal arrangement.
- 07
Tie refreshers to change
Retrain when system use changes materially or new guidance appears. A fixed annual cycle with no substantive trigger creates effort without effect.
Done when: The triggers for a refresher are named and someone is responsible for watching for them.
Common mistakes
- —Everyone receives the same training. That is either too thin for the responsible roles or oversized for general use — and hard to justify either way.
- —Training takes place but is not recorded. Without attendance evidence the effort is legally close to worthless.
- —The link to roles is missing from the documentation, so the very thing Article 4 turns on — appropriateness of depth — cannot be shown.
- —External contractors and temporary staff are forgotten, although they work with the systems on the company’s behalf.
What this checklist does not cover
- —This checklist covers Article 4 only. Classification, transparency and high-risk obligations are separate subjects not addressed here.
- —There is no official benchmark for a sufficient level. What is written here is a defensible reading, not a confirmed minimum.
- —Heavily regulated sectors may impose additional qualification requirements that go beyond Article 4.
Parent service: EU AI Act & Compliance Advisory
Matching offers
AI Act literacy training
Article 4 of the EU AI Act requires a sufficient level of AI literacy among staff. This training meets that obligation practically and by role: the people who deploy and oversee AI understand what the systems do, where their limits lie, and when an output should be questioned.
Building AI governance
AI governance gives your handling of AI a repeatable structure: an AI policy, a risk inventory, clear roles and a lifecycle process — oriented to ISO/IEC 42001. The result is the organisational backbone that produces the records the AI Act requires, audit-ready and durably.
FAQ
Is a one-hour briefing enough for everyone?
For occasional use without decision effect it may well be appropriate. For people who select systems, or whose output feeds decisions about individuals, it usually is not.
Does training have to come from outside?
No. Article 4 prescribes no format. An external certificate has the advantage that the evidence survives independently of your internal record-keeping discipline.
What about people who use no AI at all?
They carry no separate training requirement. It is still worth recording that finding so the completeness of the assessment remains visible.
More checklists
GDPR for SaaS: what has to stand before your first enterprise customer
Six areas are unavoidable for a SaaS product: a legal basis per processing activity, a maintained processing register, data subject rights implemented in the system, a deletion concept that actually works, clean sub-processor chains, and a demonstrable statement on data residency.
Reviewing a data processing agreement: what to look for before signing
Six points decide a DPA review: subject matter and instruction binding, the sub-processor chain and your right to object, place of processing, assistance with data subject rights, the breach notification route, and what happens to the data when the contract ends.
Technical due diligence: what can be established in a few days
Technical due diligence under time pressure concentrates on six questions: does the architecture carry the planned growth path, how large is the technical debt, does the system depend on individuals, how do security and licensing stand, and can operations be handed over.