A team lead at an engineering firm finds an invitation in the calendar: AI Act training, two hours, mandatory for all staff. In his team of forty, thirty people use Copilot for emails and reports, four colleagues in procurement assess suppliers, and two people in recruitment have just started working with a tool that pre-sorts applications. He wonders whether those three groups fit into the same two hours.
They do not have to, and the law does not ask for it. Article 4 of the AI Act asks for measures towards a sufficient level of AI literacy, matched to knowledge, experience and the context in which someone uses AI. One course for everyone is one way to fill that in, but it is not the standard. What Article 4 says exactly, and who supervises it, is set out in AI literacy in 2026. This piece is about the question that comes next: who needs what?
What does Article 4 ask of a team?
The provision is addressed to the organisation, not to the individual employee. It is the employer who takes measures, and who takes into account what people already know, what they do, and on whom the system is used. The Digital Omnibus of July 2026 turned it into an obligation of effort: take measures that support the development of AI literacy.
The word "matched" is the core. An employee who uses a chatbot to make a report more readable does not need to understand how a language model is trained. Someone who pre-sorts applicants with a system does need to understand what that system weighs and when to deviate from it. The same training for both is too much for the first and too little for the second.
What does apply to everyone who uses AI?
Three things, and they fit on one page.
Which tools the organisation has allowed, which it has not, and where to look that up. Which data does not belong in a prompt: personal data of customers and colleagues, confidential documents, anything covered by a duty of confidentiality. And that an AI answer is a draft that someone checks before it leaves the building. What can and cannot go into a prompt is worked out in what not to share with AI.
That basis belongs to everyone who works with AI, including contractors who work with the organisation's systems. Article 4 speaks of staff and other persons who use AI systems on the organisation's behalf. Someone who only uses a calculator and the phone is, strictly speaking, outside it. In practice more and more ordinary software has something with AI in it, so a short basic explanation for the whole organisation is the simplest route.
Who needs more than the basis?
Three groups turn up in almost every organisation.
| Group | What is added | Which form fits |
|---|---|---|
| Uses a chatbot for text work (most people) | Nothing beyond the basis | A short explanation, and the decision per tool visible at the moment of work |
| Uses AI in decisions about people (recruitment, appraisal, customer acceptance, care) | How the system reaches an outcome, what it misses, when to deviate, who oversees it | An instruction per system, taught by someone who knows the system |
| Assesses or buys AI tools (IT, procurement, privacy) | Vendor, country, training policy, data processing agreement, risk | A questionnaire and the register of assessed tools |
| Sets the policy (management, team leads) | The statuses per tool, the line between allowed and not, their own responsibility | The policy itself and the decisions in it |
The second row is the heaviest, and also the one the AI Act says most about. AI for recruitment, appraisal, promotion or dismissal is listed in Annex III as high-risk, and from 2 December 2027 the duties of Article 26 come with it, including human oversight by people with the competence and the authority to intervene. Whoever holds that oversight has to know the system. You do not arrange that with a general course; you arrange it per system. What else applies to that group is in the EU AI Act for employers.
What does that look like in the team of forty?
Back to the engineering firm. The team lead puts the invitation next to his own list. The thirty Copilot users get the basis: fifteen minutes in the team meeting, the list of allowed tools, and the agreement about client data. The four buyers get the questionnaire the firm uses to assess tools, and walk through it once with the privacy officer. The two colleagues in recruitment get something else: an instruction from the vendor about what the pre-sorting tool weighs, and the agreement that a person looks at every rejection.
Two months later an inventory shows that ChatGPT and a meeting transcription tool are in use alongside Copilot. Nobody ever decided on the transcription tool. That is not proof that the explanation failed. It shows that the list of allowed tools from the team meeting is already out of date, and that the basic explanation needs a place where people can look up the decision at the moment they are unsure.
Why is the explanation only half of it?
A course changes what people know. What they do on a Thursday afternoon, under a deadline, is shaped more by habit than by knowledge. Why that is so is explained in awareness training makes people aware, it does not change their behaviour. For Article 4 it means that the explanation is the first half.
The second half is that the organisation's decision is present at the moment someone opens an AI tool. Not as a block, but as a reminder: this is what was decided about this tool, this is the approved alternative, and sensitive data in your text gets a highlight before you send. Then nobody has to remember the team meeting of three months ago, and the team lead does not have to send the list round again every month.
