AI Literacy Training Requirements Under EU AI Act Article 4

Who Article 4 applies to

The obligation falls on providers, meaning businesses that develop or place AI systems on the market, and deployers, meaning businesses that use AI systems under their own authority in a professional context. That second category captures almost every company that uses a chatbot, an assistant, an AI feature in its CRM or a coding tool for work purposes. There is no exemption for small or micro enterprises and no threshold based on the risk level of the system.

The duty extends beyond employees to other persons dealing with the operation and use of AI systems on the organisation's behalf, which includes contractors, freelancers and agency staff. The measure is proportionate: Article 4 asks for literacy appropriate to the technical knowledge, experience, education and training of the people involved and the context in which the systems are used. A receptionist using an AI email assistant does not need the same training as a developer integrating a model into a product.

What sufficient level means in practice

The Act does not define a curriculum or a number of hours, and it does not require certification. Sufficient means that the people using AI systems understand enough to use them properly and to recognise their risks. For most business roles that comes down to a small set of competencies: knowing what generative and other AI tools can and cannot do, understanding that outputs can be wrong or biased and must be checked, knowing which data may and may not be entered, recognising when an AI system is making or influencing a decision about a person, and knowing the organisation's rules and how to report a problem.

For people in higher-exposure roles, such as those configuring AI systems, using them in hiring or customer decisions, or building them into products, the standard rises. They need to understand the specific obligations that attach to those uses, including transparency duties and, when they apply, the high-risk requirements. The sensible approach is a baseline session for everyone and a short additional module for the roles that need it.

A 45 to 60 minute training outline

The outline below is designed for a general workforce session delivered by a manager or the policy owner, using your own tools and examples. It works live, on a video call or as a recorded session with a short quiz at the end.

• Minutes 0 to 5: why we are here. The business reasons for AI rules, the legal duty under Article 4, and what the session covers.
• Minutes 5 to 15: how these tools work in plain terms. Prediction, not lookup. Why outputs are fluent but can be wrong. What training on inputs means and why it matters for our data.
• Minutes 15 to 25: our approved tools and accounts. Walk through the tool register, show how to access the company accounts, and explain what is not approved and why.
• Minutes 25 to 35: our data rules. The classification table with three worked examples, one clearly fine, one clearly not, and one at the edge. Practise anonymising a real-looking document.
• Minutes 35 to 45: verification and disclosure. Show an output with a fabricated citation and a subtle numerical error. Explain when AI use must be disclosed, including chatbot and synthetic content labelling for EU audiences.
• Minutes 45 to 55: decisions about people and incidents. Why AI must not make or drive hiring, discipline or credit decisions without human review. What counts as an incident and how to report one.
• Minutes 55 to 60: acknowledgement and quiz. Five questions, sign the policy acknowledgement, record attendance.

Keeping records

Article 4 does not prescribe a records format, but the enforcement reality is that you will be asked to show what you did. Keep a simple training log with the date, the session title and version, the trainer, the attendee list and the materials used. Store the slides or recording alongside it. When people join, add them to the next session or have them complete the recorded version within their first month, and log it. When the policy or the tool list changes materially, run a short refresher and log that too.

Link the training log to the policy acknowledgements and the tool register so that the three documents tell one story: these are the tools we use, these are the rules, and these are the people who were trained on them and signed. That set answers a regulator, a client audit and an insurer with the same folder.

How AI literacy interacts with your acceptable use policy

The acceptable use policy and the literacy programme are two halves of one control. The policy states the rules; the training makes sure people understand them well enough to apply them to situations the policy did not foresee. A policy without training produces staff who can recite that confidential data must not enter unapproved tools but cannot tell whether a particular document is confidential. Training without a policy produces staff who understand the risks but have no agreed rules to point to when a colleague or a client pushes back.

In practice, build the training directly from the policy. Each section of the policy becomes a segment of the session, and each segment ends with the rule people should remember. Update both together at review time. If your generator or template produced a training outline alongside the policy, use it, and adapt the examples to your own business, because the examples are what people remember.

Proportionality for very small businesses

A five-person company does not need a learning management system. A one-hour session delivered by the owner, a five-question quiz, a signed acknowledgement and a spreadsheet row per person is a proportionate response to Article 4 for a low-exposure business. What it cannot be is nothing. The duty has applied since February 2025, and the transparency obligations that arrived in August 2026 assume the people operating your systems understand them. Do the session, keep the log, and revisit it when your tools change.

Frequently asked questions

Does Article 4 apply to a company outside the EU?

It applies to providers and deployers whose AI systems are placed on the market or used in the EU, or whose outputs are used in the EU. A non-EU business serving EU customers with AI-driven interactions should assume its relevant staff are in scope.

Is there a required number of training hours?

No. The Act requires a sufficient level of literacy appropriate to the role and context. For most staff a session of 45 to 60 minutes plus periodic refreshers is a defensible, proportionate approach.

Do we need external trainers or certification?

No. Internal training delivered by a competent person using your own policy and tools is acceptable. Certification is not required, though records are strongly advisable.

Do contractors and freelancers need training?

Yes, if they operate AI systems on your behalf. Include them in the session or give them the recorded version, and keep their acknowledgement with the others.

What are the penalties for failing to meet Article 4?

Article 4 does not carry its own fine tier. Its practical weight comes from the fact that regulators and courts will consider whether staff were adequately trained when assessing other breaches, and from client and insurer expectations.

How often should we repeat the training?

Annually as a baseline, at onboarding for every new starter, and whenever the policy, the tool list or the law changes in a way that affects what people should do.

Related guides

• EU AI Act Article 50: Transparency Rules for Small Business
• Generative AI Policy for Employees: 10 Plain-English Rules
• AI Policy for Small Business: A 30-Minute Practical Guide