AI literacy: the mandatory training in Article 4 of the AI Act

Of all the obligations in the EU Artificial Intelligence Act (AI Act), one affects almost every company that uses AI, whatever its size: AI literacy under Article 4. It has applied since 2 February 2025, and the postponement approved in 2026 for high-risk systems did not change its date.

In this article we explain what it requires, how to comply without red tape and how to turn it into something useful for the business.

What Article 4 says

In short, Article 4 requires providers and deployers of AI systems to take measures so that their staff, and other people operating those systems on their behalf, have a sufficient level of AI literacy.

That level is assessed according to:

• each person’s technical knowledge, experience and training;
• the context in which the system is used;
• the people affected by its use (customers, employees, patients…).

Who does it affect?

Any company that uses AI systems in its professional activity. And that covers much more than it seems:

• The whole team

  Anyone using ChatGPT, Gemini, Claude or Microsoft 365 Copilot to draft or summarise.

• Sales

  A CRM that scores leads with AI.

• Customer service

  A chatbot that answers customers.

• Administration

  A tool that extracts data from invoices.

• HR

  A system that screens CVs.

• External people

  Freelancers or subcontractors who use those systems on your behalf.

What it does not require

To take the pressure off, it is worth being clear about what the rule does not ask for:

• It does not require an official qualification or certificate. The European Commission has clarified this in its FAQs on Article 4.
• It does not require the same course for everyone. Training must be proportionate to use: someone who only summarises emails does not need the same as someone who configures a system that makes decisions about customers.
• It does not require everyone to become a technical expert. The point is to use AI with judgement, not to know how to train models.

What you should be able to do is demonstrate which measures you have taken: what training each role has received, which usage guidelines exist and when they were last updated.

What each role should know

A practical way to organise it is by role: the closer someone is to decisions that affect people, the deeper their training should be. This infographic sums up the minimum content we recommend, what the rule does not require and how to show it.

Visual guide · Article 4 of the AI Act

The mandatory
AI literacy
duty

Every company that uses AI must make sure its people know how to use it wisely. Each role, to the right depth.

01 · Who and what

The closer to the centre, the deeper the training

1. Everyone who uses AI Why AI gets things wrongWhich data never goes inCheck before using or sendingApproved tools and who to ask
2. Management and team leads What it does and does not offerLegal, reputational and lock-in risksPrioritising cases and assessing vendorsAI Act and GDPR obligations
3. Technical teams Technical limits of modelsPrompt injection, leaks and permissionsEvaluating answers and human oversightLogging and documentation
4. Sensitive uses HR, credit, health or educationHuman oversightBiasRights of the people affected

02 · No need to panic

What it does not require… and what it does

An official certificate

The same course for everyone

Making everyone a technical expert

Being able to show what you did

03 · How to prove it

Your file, in four documents

01

Inventory

AI tools and the roles that use them

02

Usage policy

One or two pages: tools, forbidden data, review

03

Training record

Who, when, content and duration

04

Regular review

Whenever tools or uses change

04 · Already applies

2 Feb
2025

The 2026 postponement did not change its date.

• No specific fine in the Regulation, but:
• AESIA, the Spanish authority, can supervise compliance
• After an incident, a lack of training makes liability worse (GDPR included)
• Clients and tenders ask for proof of responsible AI use

Download the infographic (PNG)

Roles with sensitive uses

People who use AI in HR, credit, health or education, or in decisions that affect people, need specific training on human oversight, bias and the rights of those affected. These uses may also be high-risk, with additional obligations from 2 December 2027.

How to document it without red tape

For an SME, four elements are usually enough:

1. Inventory of AI tools and the roles that use them.
2. Usage policy of one or two pages: approved tools, prohibited data and human review.
3. Training record: who, when, content and duration.
4. Periodic review: when tools or uses change, the training is updated.

Keep the evidence (attendance, materials, policy version). If there is ever an incident or an inspection, or a large customer asks you to demonstrate compliance, it will be the first thing they ask for.

What happens if you do not comply?

The Regulation does not set a specific fine for Article 4 (it leaves penalties for other breaches to each Member State), and this is one of the most frequent questions. But that does not mean there are no consequences:

• market surveillance authorities (in Spain, AESIA) can supervise compliance;
• if an untrained employee causes an incident (for example, leaks customer data into a public tool), the lack of measures increases the company’s liability, including under the GDPR;
• more and more customers and tenders ask suppliers for evidence of responsible AI use.

From obligation to advantage

Action plan

1. Build the inventory of tools and roles (you can start with our AI maturity test).
2. Write or review the usage policy.
3. Organise role-based training: practical AI at work for the team as a whole, AI for executives and managers for leadership and prompt engineering for technical teams.
4. Keep the record and schedule an annual review.

For the full context of the Regulation, read our AI Act guide for SMEs. And if you would rather we organise it with you, our AI training for companies page sets out the role-based programmes.