AI literacy should reflect people's roles, existing knowledge, the systems they use, the context of use and the people affected.
What Article 4 requires
Providers and deployers must take measures to support the development of AI literacy among staff and other people who deal with operating and using AI systems on their behalf. The measures should take account of knowledge, experience, education, training, context of use and the people on whom the systems are used.
The requirement has applied since 2 February 2025. Following the 2026 amendment, Article 4 does not mandate a specific or ‘sufficient’ level for every individual. That does not make a generic awareness email a safe default: the Commission's Q&A recommends a context- and risk-based approach.
1. Map systems, tasks and audiences
Start from the AI inventory. Identify employees, contractors and other people who select, configure, operate, supervise or rely on each system. Group them by task rather than job title alone.
- All users: basic capabilities, limitations, approved uses and escalation.
- Decision makers: interpretation, automation bias, affected-person impact and review duties.
- Technical teams: data, evaluation, monitoring, security and change control.
- Procurement and legal teams: role, intended purpose, documentation and supplier questions.
- Human overseers: authority, competence, intervention and stop procedures.
2. Build a role-based curriculum
Give every relevant person enough grounding to understand what AI is, which systems the organisation uses, their opportunities and their risks. Add system-specific learning for the decisions and harms that person can influence.
- How the system is intended to work and where it can fail.
- Data protection, confidentiality, intellectual property and security rules.
- Hallucination, bias, over-reliance and inappropriate input or output handling.
- Required notices, human checks, records and escalation paths.
- Hands-on scenarios based on the organisation's real workflow.
3. Choose measures that change practice
Training is one option, not the only one. Combine short learning modules with acceptable-use rules, in-product prompts, checklists, office hours, exercises and supervisor coaching. The Commission notes that merely asking people to read instructions may be ineffective in many cases.
Use proportionate checks such as scenarios, demonstrations or supervisor observation to find gaps. Article 4 does not require testing every employee or obtaining a certificate.
4. Keep useful evidence
Keep an internal record of the analysis and measures: covered systems, target audiences, learning objectives, materials, delivery dates, attendance, practical guidance, identified gaps and updates. Link the programme to incidents and system changes so it improves over time.
No particular certificate or AI-officer role is required by Article 4. What matters is a reasoned, context-specific set of measures that the organisation can explain.
5. Review the programme
Review when systems, features, uses, risks or official guidance change. Also review after errors, complaints, near misses and evidence that people misunderstand the system. High-risk human-oversight training should be assessed alongside the specific deployer duties, not treated as basic Article 4 awareness alone.
Official sources
Use the official text and current Commission guidance for decisions about a specific system.