Skip to content
NL Plan a start sprint

Compliance and security

AI literacy: what Article 4 asks of your organisation

Jan Brusse · · 3 min read

The short answer

Article 4 of the AI Act asks every organisation that uses AI to take measures so that the people who work with it know enough about it, to the level their role needs. There is no fixed exam or mandatory certificate. What counts is that you can show what you did: who was trained, on what and when.

What does Article 4 say?

Article 4 is a short article with a wide reach. It asks providers and deployers of AI systems to take measures for the AI literacy of their staff, and of others who work with AI on their behalf. In doing so, you take into account their knowledge, experience and education, the context in which the AI is used and the people the AI affects.

The article has applied since 2 February 2025. The Digital Omnibus (Regulation (EU) 2026/1744) amended the wording as of 27 July 2026. Organisations must now take measures that support the development of AI literacy, and the law adds that you do not have to guarantee a particular level per person. The obligation to act on it remains.

Who does it apply to?

Everyone who works with AI or makes decisions about it. That includes organisations that only use ChatGPT, Copilot or an AI feature in existing software. What counts as “enough” differs per role:

RoleWhat they need to know
ManagementWhere AI sits in the organisation, which risks that brings, which role the organisation has under the AI Act
Staff who use AIWhat the tool is good and bad at, what may and may not go into a prompt, how to check an answer
IT and developersHow the system works, where the data goes, logging, oversight and security
HR and procurementWhich AI is high risk (such as AI in recruitment), what to ask of a supplier

What is “enough” in practice?

Role-based and demonstrable. A workable approach in five steps:

  1. Inventory: which AI is used, and by whom.
  2. Level per role: what each group needs to know, based on the table above.
  3. Training: basic knowledge for everyone, more depth for those who set up, manage or decide.
  4. Records: who was trained on what and when, and which agreements apply.
  5. Repetition: for new tools, new roles and new people.

How do you show it?

With your own records: who took part, on which topics, on which date, and which agreements are in your AI policy. In its questions and answers on Article 4, the European Commission writes that external certification is not needed and that organisations record their measures themselves.

The certificate we hand out after our training is a practical tool for that. It shows what each participant covered.

What we see most often in trainings

In the trainings we have given since 2019, to more than 1,000 professionals at organisations including the Dutch House of Representatives, the Nationale Postcode Loterij, Envalior, Hanze University of Applied Sciences, Banijay and Prosus, the same questions keep coming back:

  • What may go in? People often do not know whether customer data, contracts or HR information may go into an AI tool. A simple split into data classes helps straight away.
  • Is the answer right? An AI answer sounds convincing, even when it is wrong. Checking it is part of the job, just as you would review a colleague’s draft.
  • Is this real? A demonstration with a generated video or voice shows at once why generated content deserves a critical look.
  • Who is responsible? The person who uses the result. That realisation changes how people handle AI.

Arrange it yourself or have your team trained?

Both work. If you have your own learning department and use only a few different tools, you can set up a basic programme yourself. A training is faster when you want to reach many people in a short time, when tools with sensitive data are in use, or when you want records that are in order straight away. Our AI literacy training runs on location or live online, from €2,500 per half day.

When we build for you

If we build an AI application for you, we train the team that will work with it on that system, on the job. That is one of the four parts of every build, and it counts for Article 4.

Sources

Frequently asked questions

Is AI literacy mandatory?

Yes. Article 4 of the AI Act has applied since 2 February 2025 to every organisation that provides or uses AI. Since 27 July 2026 the wording is slightly different: you must take measures that support the literacy of your people, without a guaranteed level per person.

Does it apply if we only use ChatGPT or Copilot?

Yes. That makes you a deployer, and the obligation applies to you. For ordinary office use a basic training with agreements about data is usually enough.

Is there an official certificate?

No. According to the European Commission's questions and answers, external certification is not needed; your own record of what you did is enough. The certificate we hand out after our training is a tool for that record.

How often should you repeat it?

The law sets no interval. Repeat it when you introduce new tools, when roles change or when new people join. A yearly refresher is a reasonable rhythm for most organisations.

What happens if you do not arrange it?

The AI Act sets no separate fine for Article 4. It still matters: if something goes wrong with an AI application, a regulator will look at whether your people knew what they were working with. In the Netherlands, supervision will be set out in the implementation act for the AI regulation, which is still being prepared in October 2026.

How long does a training take?

A basic training for a team fits into a half day. People who buy, set up or manage AI systems need more. See the AI literacy training.

Want to cover it with a training? In our AI literacy training your team learns to work with AI responsibly, with a certificate for your records.

See the AI literacy training

Further reading