A team lead at an engineering firm finds an invitation in his calendar: AI Act training, two hours, mandatory for all staff. In his team of forty, thirty people use Copilot for emails and reports, four colleagues in procurement assess suppliers and two people in recruitment have just started using a tool that pre-sorts applications. He wonders whether those three groups really belong in the same two hours.
They do not, and the law does not require it. Article 4 of the AI Act asks for measures aimed at a sufficient level of AI literacy, matched to knowledge, experience and the context in which someone uses AI. One course for everyone is one way to meet that, but it is not the benchmark. What Article 4 says exactly, and who supervises it, is covered in AI literacy in 2026. This piece deals with the next question: who needs what?
What does Article 4 ask of a team?
The provision is addressed to the organisation, not to the individual employee. It is the employer who takes measures, bearing in mind what people already know, what they do and who the system is used on. The Digital Omnibus of July 2026 turned it into a best-efforts obligation: take measures that support the development of AI literacy.
The key word is "matched". An employee who uses a chatbot to make a report more readable does not need to understand how a language model is trained. Someone who pre-sorts applicants with a system does need to understand what that system weighs up and when to override it. The same training for both is too much for the first and too little for the second.
What does apply to everyone who uses AI?
Three things, and they fit on one page.
Which tools the organisation has allowed, which it has not and where to look that up. Which data does not belong in a prompt: customers' and colleagues' personal data, confidential documents, anything covered by a duty of confidentiality. And that an AI answer is a draft that someone checks before it leaves the building. What can and cannot go into a prompt is set out in more detail in what not to share with AI.
Everyone who works with AI needs these basics, including contractors who use the organisation's systems. Article 4 refers to staff and other persons who use AI systems on the organisation's behalf. Strictly speaking, someone who only uses a calculator and the phone falls outside it. In practice more and more ordinary software has AI built in, so a short briefing for the whole organisation is the simplest approach.
Who needs more than the basics?
Three groups turn up in almost every organisation.
| Group | What they need on top | What form works |
|---|---|---|
| Uses a chatbot for writing (most people) | Nothing beyond the basics | A short briefing, with the decision on each tool visible while they work |
| Uses AI in decisions about people (recruitment, appraisal, customer onboarding, care) | How the system reaches an outcome, what it misses, when to override it, who oversees it | Instruction on each system, given by someone who knows it |
| Assesses or buys AI tools (IT, procurement, privacy) | Vendor, home country, training policy, data processing agreement, risk | A questionnaire and the register of assessed tools |
| Sets the policy (management, team leads) | The status of each tool, where the line between allowed and not allowed lies, their own responsibility | The policy itself and the decisions in it |
The second row is the most demanding, and also the one the AI Act says most about. AI used for recruitment, appraisal, promotion or dismissal is listed as high-risk in Annex III, and from 2 December 2027 the obligations in Article 26 apply to it, including human oversight by people with the competence and authority to intervene. Whoever provides that oversight has to know the system. A general course will not achieve that; it has to be done system by system. What else applies to this group is covered in the EU AI Act for employers.
What does that mean for the team of forty?
Back to the engineering firm. The team lead compares the invitation with his own list. The thirty Copilot users get the basics: fifteen minutes in the team meeting, the list of allowed tools and the rule on client data. The four buyers get the questionnaire the firm uses to assess tools and go through it once with the privacy officer. The two colleagues in recruitment get something else: a briefing from the vendor on what the pre-sorting tool weighs up, and the rule that a person reviews every rejection.
Two months later an inventory shows that ChatGPT and a meeting transcription tool are in use alongside Copilot. Nobody ever made a decision on the transcription tool. That is not proof that the briefing failed. It shows that the list of allowed tools from the team meeting is already out of date, and that the basics need a place where people can look up the decision when they are unsure.
How do people take the basics into their work?
The briefing lays the foundation. Then the work starts, with a deadline, a new tool or a text in which one sensitive detail is easy to miss. How training and support complement each other at that point is covered in our article on turning AI training into careful everyday work.
For Article 4, that means the basic briefing works well alongside a decision that reappears when someone opens an AI tool: this is what was decided about this tool and this is the approved alternative, and sensitive data in your text is highlighted before you send. People can then check the decision when they are unsure, and the team lead does not have to send the list round every month.
