What Article 4 of the EU AI Act actually requires
Article 4 of Regulation (EU) 2024/1689 requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy for people operating or using AI systems on their behalf. It is not a requirement for one standardized EU course or a blanket certificate for every employee. The requirement is appropriate capability for the actual use case. For the broader process, see Using AI Safely: ChatGPT, Confidential Data, and Shadow AI at Work. See also: EU AI Act course.
The Regulation refers to factors including technical knowledge, experience, education and training, as well as the people affected by the use of AI. Companies should therefore first understand which systems they use, what role they have and which decisions or processes the systems influence. The AI literacy obligation has applied since 2 February 2025; its scope and evidence should fit the organization and the risk. A useful deeper dive is GDPR Training for Employees: Content, Timing, and Evidence.
Who the obligation is relevant to
Deployers are companies and other organizations using an AI system under their authority. Providers develop a system and place it on the market under their name or trademark. Depending on the activity, a company can be a deployer, a provider or both. An internal chatbot, a recruitment tool, document analysis or a generative assistant can therefore create different responsibilities and training depths. See also: Compliance topic world.
Not every user needs the same knowledge. Employees drafting text need clear rules for data, sources, review and approval. People configuring, integrating or monitoring models need additional technical and risk-related knowledge. Managers and subject owners need to understand decisions, responsibilities and escalation paths. A foundation module for everyone can help, but it does not replace role-specific additions.
- All users: basic concepts, limitations, permitted data and human review.
- Subject-matter users: source checking, approvals, documentation and handling errors.
- Administrators and developers: configuration, access, logging, testing and security risks.
- Decision-makers: provider or deployer role, risk, accountability and escalation.
What AI literacy covers in practice
AI literacy means more than knowing how to write a prompt. Users should be able to judge what a system can do, where it is unreliable and which failure patterns may occur. This includes hallucinations, biased results, missing sources, unclear copyright issues and the risk of entering sensitive information into an unsuitable system. Training should connect these points to the company’s actual tools and workflows. See also: safe use of AI tools.
A useful learning objective can be expressed as observable behavior: classify confidential data before entering it, check an answer against primary sources, follow a human approval point, document use or choose the right channel for an incident. For sensitive or high-risk applications, system limitations and the role of human oversight must remain visible. This prevents a course from being completed without improving a real workplace decision.
AI-generatedUse role-based learning paths instead of one generic course
For rollout, use a small learning path with a shared foundation and targeted additions. The foundation explains concepts, limits, privacy, security, source checking and human responsibility. Additions address the systems and decisions of a role. An HR team needs different cases from a development team; sales needs concrete rules for customer data and approvals, while IT also needs to understand access, logging and technical testing. See also: Security Awareness topic world.
Learning paths should connect to the internal AI policy, procurement and incident management. A policy that sounds different in training from the one used in daily work will not be applied. Approved tools, prohibited inputs, approval levels, contacts and reporting channels should therefore share one information architecture. Where rules are company-specific, teams can turn an AI policy into a custom course instead of distributing a generic document without practical context.
Connect governance, data protection and security
Article 4 does not sit apart from other compliance work. Who may use an AI system is often connected to privacy, information security, copyright, confidentiality and output controls. A training program should explain these interfaces without treating every use as a high-risk application. The key is a documented assessment of the actual system and the affected data.
For employees, this should become a simple action chain: check the use, classify data, match the tool and purpose, critically review the output, obtain approval and escalate uncertainty. Owners need a second layer: maintain an AI inventory, assess provider information, define roles and permissions, monitor changes and update training content. This makes AI literacy part of governance rather than a one-off webinar.
Evidence and continuous updating of AI literacy
Evidence does not have to be a particular certificate. It is useful to document the audience, role, content, version, assignment, completion and, where relevant, the knowledge check. An assessment should also be able to explain why the chosen training was appropriate for the use case. A short course for general text assistance may produce different evidence from an in-depth briefing for a system supporting personnel decisions. See also: mandatory training and evidence for companies.
Updating becomes important when tools, models, providers, policies, data flows or risks change. Incidents and recurring errors are also signals for a refresher. An owner should therefore review at regular intervals whether learning objectives, examples and approval paths are still correct. Version history and the reason for a change make active management visible later.
AI-generatedA practical 30-60-90 day plan
During the first 30 days, the company should inventory the AI systems, providers, user groups and sensitive data flows in use. Include informal use that is not visible in central procurement. Then record provider and deployer roles, internal owners, minimum rules and the most important risk scenarios. The first learning path should cover a clear use case rather than trying to solve every open governance question at once.
By day 60, the foundation module, role-specific additions, policies and a simple knowledge check can be piloted. By day 90, assignments, reminders, evidence, review dates and a change process should be in place. Start free trial can support a limited pilot that tests not only the course but also the evidence and export logic. The legal assessment of the actual use case remains the responsibility of the relevant owners.
Related ConformBase pages
- EU AI Act course
- safe use of AI tools
- Compliance topic world
- Security Awareness topic world
- turn an AI policy into a custom course
- Start free trial
- mandatory training and evidence for companies
Official sources
Start your free ConformBase trial
For day-to-day implementation, run a short review after four weeks: Which questions recurred, which role needed additional orientation, and which process change belongs in the next course version? This keeps AI literacy connected to concrete work decisions instead of ending with a one-time introduction.
ConformBase
Turn knowledge into training that works.
Bring compliance, privacy and security awareness into a format your people want to complete, with certificates and audit-ready evidence.
Start free trialAsk about custom courses →
