AI Literacy: The Article 4 Obligation Under the EU AI Act

AI literacy is the obligation set out in article 4 of Regulation (EU) 2024/1689 (the EU AI Act). It requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of competence among their staff and other people operating these systems on their behalf. It has applied since 2 February 2025.

This article is informational and is not legal advice.

What article 4 of the EU AI Act says on literacy

The rule is short and framed in terms of principles. It asks organizations to take measures to ensure a sufficient level of AI literacy, taking into account:

• the technical knowledge, experience, education and training of staff;
• the context in which AI systems are used;
• the people or groups of people on whom AI systems are used.

The regulation defines AI literacy as the skills, knowledge and understanding that allow AI systems to be used in an informed way, with awareness of opportunities, risks and possible harm.

Two points deserve attention. First, the obligation is one of means, not of a certified result: it asks for adequate measures, not a uniform diploma. Second, the text sets no minimum hours, standard content or mandatory certificates. Anyone presenting requirements of this kind as prescribed by article 4 is adding something the rule does not say.

Who the AI literacy obligation applies to

Article 4 addresses providers and deployers of AI systems. The scope is wider than often assumed:

• it also applies to companies that simply use third-party tools, such as generative assistants and AI features built into software;
• it does not depend on the risk level of the system: it covers minimal-risk uses too;
• it covers employees and also other people acting on the organization's behalf, for example contractors and consultants using these tools.

For the provider and deployer roles and the regulation's general framework, see EU AI Act obligations for companies.

What it means in practice: a sufficient level, not the same for everyone

"Sufficient" is a relative concept. A person using an assistant to summarize documents needs different skills from someone configuring an agent connected to company data or someone deciding which use cases to approve. The text itself asks to consider context and the recipients of the effects.

So the useful question is not "did we run a course?", but "is each role's level of competence adequate to the tools and use cases it handles, and can we show what we did to achieve it?".

How to set up role-based training

A reasonable setup starts from three levels, to be adapted to the organization.

• Basic, for all users. What a generative model does and does not do, limits and possible errors, correct use of data, internal policy rules, prohibitions, how to report problems. The operational reference is the company AI policy.
• Intermediate, for those using AI in processes affecting people or customers. Critical checking of outputs, human oversight, traceability of decisions, relationship with data protection.
• Advanced, for those who govern and decide. Function heads, compliance and IT contacts: classification of use cases by risk, provider and deployer roles, vendor management.

The decisive step is linking pathways to real use cases. An up-to-date register, like the one described in AI use case register, shows who uses what and therefore which training each person needs.

How to track training and which evidence to keep

The regulation does not prescribe a documentation format. To be able to demonstrate the measures taken, it makes sense to keep:

1. Training plan by role, with objectives, recipients and the criterion used to define the adequate level.
2. Content delivered, with version and date, to reconstruct what was taught and when.
3. Participation, meaning completions or attendance, by role and department.
4. Learning checks, if any, such as quizzes or exercises on real cases.
5. Updates: when tools, uses or regulation change, a record of the content review and new training cycles.
6. Mapping between roles, tools and training, to show that those using a tool received relevant training.

A rule of method: training data should be read in aggregate by role or department. To demonstrate adequate measures, you need coverage of the pathways, not a ranking of people. Keeping it aggregated also protects trust with employees. On questions about monitoring work activity, see monitoring AI use and the Italian Workers' Statute.

An example of a roles and pathways matrix

To make the principle concrete, here is a hypothetical matrix for a company with 1,000 users of generative assistants. The basic pathway covers all users. A subset working with customer or employee data also follows the intermediate pathway, with attention to output checking and data protection. A small group of function heads, compliance and IT follows the advanced pathway. The numbers are only illustrative: the real split depends on the recorded use cases. When a team starts using an assistant for a new purpose, for example on customer data, the pathway assigned to that group should be reviewed, so the matrix stays aligned with how the tools are actually used.

For each group it helps to define three elements in advance: the tools and use cases it refers to, the minimum content of the pathway and the update cadence. This makes the criterion for setting the sufficient level demonstrable, which is the part the rule leaves to the organization.

How to coordinate AI literacy with other measures

Training alone does not govern the use of AI. It works when linked to a clear policy, a use case register and a channel for raising doubts. Without these elements, staff receive concepts but do not know how to apply them in daily work.

It should also be remembered that article 4 does not exhaust the obligations: training on personal data processing, for example, answers to GDPR principles, explored in GDPR and generative AI at work. A single coherent pathway beats several overlapping courses.

Frequent mistakes

• One generic course for everyone. It satisfies the form but ignores the role and context of use that the text requires.
• One-off training. Tools and uses change quickly: without updates the "sufficient" level erodes.
• No link to the tools actually used. If unauthorized use is widespread, training does not reach those who need it most. The topic is addressed in shadow AI, risks and how to manage it.
• Invented requirements. Minimum hours, certificates or certifications are not provided for in the text of article 4.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. On AI literacy, it helps track training pathways by role, link them to the tools and use cases actually in use and read coverage in aggregate by department. It is a support for documenting the measures taken and is not legal advice. For the full picture: AI compliance with Delphis.

Sources

• Regulation (EU) 2024/1689 (AI Act)