AI literacy under the AI Act: a guide to training staff and documenting compliance

What AI literacy means under Article 4

AI literacy is the ability to understand enough about AI systems to use them with an informed grasp of their capabilities, limitations and effects. Under Regulation (EU) 2024/1689, it is not merely a voluntary training initiative: Article 4 requires providers and deployers to take measures to ensure, to the best extent possible, a sufficient level of AI literacy among their staff and other people who operate or use AI systems on their behalf.

The law does not prescribe a single course, a set number of training hours, a mandatory exam or a universal certificate for every organisation. It links sufficient AI literacy to people’s technical knowledge, experience, education and training; the context in which systems will be used; and the people or groups those systems may affect. Training should therefore reflect actual tasks: giving everyone the same generic content is not enough.

The obligation has applied since 2 February 2025, according to the European Commission’s institutional information. The fact that it applies from that date does not, by itself, establish that any particular organisation is in breach. The practical questions are what measures it has taken, who they cover and whether they are appropriate to the relevant roles and circumstances.

Who is covered and what training should address

Article 4 identifies two categories: providers and deployers of AI systems. In practical terms, a provider develops a system, or has one developed, and places it on the market or puts it into service under the conditions set out in the Regulation. A deployer—also referred to as a user in some explanations—uses a system under its authority, except for personal, non-professional use. The obligation covers staff and other people who operate or use AI systems on behalf of these organisations; it is not limited to people who programme the systems.

AI literacy must be sufficient in light of technical knowledge, experience, education and training, the context in which the system will be used, and the people or groups affected. Article 4 does not provide a fixed syllabus. The European Commission explains that measures may address how systems work, what they can and cannot do, their risks and opportunities, and their potential impact on fundamental rights. These points can help translate the obligation into training content, but they are not an exhaustive legal checklist that is identical for every organisation.

Useful training connects these topics to concrete decisions: which tasks a system can support, which outputs need review, what information must not be entered, what signs may indicate an error, and how to escalate an issue. The level of detail will vary. Someone configuring a system needs different capabilities from someone approving its purchase or interpreting its outputs.

Designing useful training for each role

Start by identifying which AI systems are used or made available, who uses or operates them, and for what purpose. The goal is not to create a bureaucratic catalogue: the inventory helps link responsibilities and tasks to exposure to system outputs. One employee may need different modules if they use different tools or take part both in selecting and overseeing a system.

Next, define observable objectives for each role. Instead of setting the goal as “understand AI”, specify behaviours: distinguish a plausible response from a verified one; recognise when a system is being used beyond its intended purpose; check information before relying on it in a decision; or pause a workflow and escalate an issue. Use examples from real work, but do not present training as a guarantee that a system is safe or that a decision is correct.

Training can combine introductory sessions, system-specific instructions, practical exercises and updates when tools, tasks or risks change. Article 4 does not impose a universal frequency or format. An organisation can choose them based on the context and how systems evolve, and review whether staff can apply what they have learned.

Documenting measures and checking whether they are adequate

Article 4 requires measures to be taken, but it does not prescribe a single file format or state that an attendance list is enough to demonstrate sufficiency. As a management practice, keep evidence that makes it possible to reconstruct what was done, for whom, about which system and for what purpose. That traceability helps an organisation review its programme and explain the reasoning behind its measures; on its own, it does not prove that those measures are adequate in every case.

A useful record may include an inventory of systems and roles, an assessment of training needs, objectives for each role, the materials and versions used, dates and delivery formats, participation, exercise or assessment results, and any follow-up actions. Also record who approved the programme and when it will be reviewed. Documentation should be proportionate and comply with applicable privacy and personal-data retention rules.

Do not confuse proof that training was delivered with proof of learning: attendance shows participation, not necessarily understanding. Nor should an internal assessment be presented as a legal certification that Article 4 does not require. To assess whether measures are adequate, connect learning outcomes with the tasks people perform and keep examples of how identified gaps are addressed.

Internal verification checklist

Before treating the programme as implemented, check that there is a clear link between the AI systems in use, the people who operate them and the AI literacy measures adopted. The checklist below helps identify gaps and organise evidence. It is not an official form issued by the European Commission or AESIA, and it does not, by itself, guarantee compliance.

If an answer is negative or uncertain, document the gap, assign an owner and set a proportionate action. For example, a group that interprets system outputs but has not received training may need a practical module; adopting a new tool may require updated instructions and objectives. Reviews should take account of changes in context, not just the training calendar.

The official sources provided do not identify a general exemption that would allow particular sectors, company sizes or roles to be treated as automatically outside the obligation. Article 4 refers to providers and deployers and the definition of deployer excludes personal, non-professional use. Each organisation should assess how its activities and people fit the applicable definitions. If there is uncertainty about its legal classification or obligations beyond Article 4, it should seek specialist advice.

Final principle: contextual training, evidence and review

Article 4 creates an organisational obligation to take measures to achieve a sufficient level of AI literacy; it does not define a standard course or make a certificate a universal requirement. A sound response starts with actual uses, distinguishes between roles, teaches relevant capabilities and limitations, and checks that people can act thoughtfully in their work.

Documentation helps show the scope and development of a programme, but the evidence must be accompanied by appropriate measures. A policy without applied training, or an attendance list without objectives or review, may leave important questions unanswered. Keep documentation proportionate, up to date and connected to specific responsibilities.

As a practical rule, ask at each review: who uses which system, for what, with what limitations, and what should they do if an output is unreliable? If an organisation can answer with role-specific training, relevant exercises and consistent records, it has a clearer operational basis for explaining the measures it has taken—without presenting that basis as an automatic guarantee of compliance.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.