Under Article 4, providers and deployers must take measures to ensure a sufficient level of AI literacy for staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training, the context the systems are to be used in, and the persons on whom the systems are to be used. A programme should therefore be role-specific, context-specific, and evidenced, rather than a single generic course for all staff.
Who needs what literacy?
Literacy needs differ by role. A developer diagnosing model failures needs technical understanding of the system, its data, and its failure modes. A procurement officer evaluating supplier claims needs the ability to ask for evidence, to distinguish a marketing claim from a conformity record, and to record the assessment. An operator using AI output in a consequential workflow needs to understand the system's limitations, the oversight expected, and the escalation route when output should be questioned. A manager deciding on deployment needs to understand the risks, the governance, and the limits of the assessment. The programme should start with a role map, listing each role, the systems it deals with, the decisions it makes, and the knowledge it needs for those decisions, and should design learning for each role from that map, rather than from a generic syllabus.
What content should the programme cover?
Content should cover, in role-appropriate depth, what AI systems are and how they work in general terms, the intended purposes and limitations of the specific systems the role deals with, foreseeable errors and failure modes, human oversight and escalation, transparency and disclosure practices, data protection and fundamental rights considerations, and the governance and incident routes for the organisation. Content should use realistic scenarios drawn from the organisation's own workflows, so that learners practise the decisions they will actually face, rather than abstract definitions. Scenarios should include cases where output should be questioned, overridden, or escalated, and cases where a supplier claim should be challenged. Content should be reviewed when systems, workflows, or guidance change, and should be versioned with the systems it describes.
For the broader regulatory framework, see AI governance planning checklist.
How should learning be delivered and assessed?
Delivery should fit the role and the context: short, focused sessions for operators, deeper workshops for developers and reviewers, briefings for managers, and just-in-time guidance at the point of use. Delivery should be interactive where the decision matters, with exercises that require the learner to recognise a limitation, to question an output, or to escalate a concern, rather than only to watch a presentation. Assessment should check whether the learner can apply the learning, for example by working through a scenario and identifying the correct action, rather than only measuring attendance or completion. Assessment results should be recorded by role, with follow-up for learners who do not meet the standard, and with a plan to refresh learning when systems or roles change. A programme that records only attendance has not shown that literacy was achieved.
What evidence should be kept?
Evidence should include the role map, the learning objectives for each role, the materials used, the delivery records, the assessment results, the owners, and the review dates. The Act does not prescribe a universal certificate or a fixed number of training hours, and the programme should not invent a certificate that suggests a formal qualification where none exists. Evidence should be proportionate to the context and the risk, and should be kept in the governance file, linked to the inventory of systems and roles. Where a regulator or an internal reviewer asks how literacy was ensured for a role, the file should show the map, the materials, the assessment, and the review, for that role, without requiring a reconstruction from scattered records. Evidence should be retained for the period the organisation sets for governance records.
How does literacy link to other duties?
AI literacy is a cross-cutting provision that supports other duties, but it does not replace them. Literacy supports human oversight by giving overseers the knowledge to intervene, supports deployer duties by giving staff the ability to use systems in accordance with instructions, and supports incident handling by giving staff the ability to recognise and report a problem. The literacy programme should therefore be linked to the oversight design, the instructions for use, the incident route, and the governance operating model, with shared role maps and shared scenarios. A literacy programme that is designed in isolation from those duties, with generic content that does not mention the actual systems, oversight tools, or escalation routes, will not support the duties it is meant to enable, even if it is delivered to all staff.
Continue with AI literacy in practice.
What does this guide not decide?
This guide does not decide what level of literacy is sufficient for a particular role, whether a programme meets Article 4, or whether a person is competent for a specific oversight or deployment task. It does not set a curriculum, a number of hours, or a certificate for any role. Those questions depend on the role, the systems, the context, and the people affected, together with the consolidated legal text. An organisation should design its programme from its role map, test whether learners can apply the learning, keep the evidence, and confirm the position with a competent authority or legal adviser where the literacy position is material to a deployment decision.
Frequently asked questions
Is a single generic AI course enough?
No, in general. Article 4 requires measures tailored to technical knowledge, experience, education and training, the context of use, and the persons affected. A programme should be role-specific and context-specific, using scenarios from the organisation's own workflows, and should assess whether learners can apply the learning to their decisions.
Does Article 4 require a certificate?
No. The Act does not prescribe a universal AI literacy certificate or a fixed number of hours. Evidence should show the role map, objectives, materials, delivery, assessment and review for each role, proportionate to context and risk, without inventing a formal qualification.
When did Article 4 start to apply?
AI literacy duties under Article 4 apply from 2 February 2025, as part of the general provisions that began applying on that date. Programmes should have been in place from that date for relevant staff, and should be kept current as systems and roles change.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk Article 4 ↗European Commission AI Act overview ↗