What should AI literacy training cover to satisfy Article 4?
Cover four things: what AI is and how the tools your people use actually work, your organisation's role as a deployer, the specific risks of those tools in your context such as hallucination and data leakage, and what each role should do differently on Monday. That mirrors the Commission's four-step approach, and it is what the record should describe. A session that covers those four things for the right people, and is written down, is a measure under Article 4.
The checklist
Tick each item against the session you are planning or the one you have already run.
1. A general understanding of AI
- What an AI system is, in the Act's sense, and the difference between a rule-based tool and a model that predicts
- How a large language model produces an answer, and why that means it can be fluent and wrong at the same time
- What the AI Act is, in five minutes, and why Article 4 applies to you
2. Your organisation's role
- That you are a deployer, and what that word means in Article 3(4)
- Which of your tools are AI systems, including features bundled inside software you already had
- Whether any of them screen, score or rank people, because that changes the depth needed
3. The specific risks of your tools in your context
- Hallucination, with an example from your own work, not a generic one
- Confidentiality and data leakage: what must never be pasted into a public tool, given your sector and your clients
- Bias and automation bias, especially for anyone reading a ranking or a score
- Transparency: when someone you deal with must be told they are dealing with AI
4. What each role does differently
- For everyone: the tasks that are fine, the tasks that need a human check, the tasks that are off limits
- For administrators and power users: what the settings do, what the vendor says the human reviewer should do
- For managers: how to spot over-reliance in a team, and who to escalate to
- Who to ask when something looks wrong
The record
- What was covered, who attended, when, and why that depth suited those roles
Why this list and not a longer one
The Commission's Q&A on AI literacy sets out four considerations for any organisation: start from a general understanding of AI, consider your role as provider or deployer, consider the risk of the systems you use, and then build your actions on that analysis, taking account of the differences in knowledge and experience among your staff. The list above is those four steps turned into session content. The Q&A also says that simply relying on the instructions for use, or asking staff to read them, might be ineffective, which is why item 3 insists on examples from your own work.
What you can leave out
You can drop model architecture, prompt engineering tricks, vendor product tours and a history of AI. None of it is wrong, but none of it is what Article 4 describes, and every hour spent on it is an hour not spent on the tools your people will open tomorrow.
The four steps are set out on our requirements page, with what each workshop tier covers against them.
Sources
- European Commission, AI literacy: questions and answers, the four-step passage and the instructions-for-use passage.
- Regulation (EU) 2024/1689, the AI Act, Article 3(4), Article 3(56) and Article 4, as amended by Regulation (EU) 2026/1744.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
