The managing director of a building services company with eighty staff receives an email from a training provider: AI literacy is a legal requirement, the organisation must be able to prove it complies, and a two-hour course with a certificate will take care of that. She forwards the email to the privacy officer with one question: is this right?
The first part is. The second is not, at least not in the form the email suggests. Article 4 of the AI Act has applied since 2 February 2025 and asks organisations to take measures aimed at a sufficient level of AI literacy among the people who work with AI systems on their behalf. It says nothing about a course, a certificate or a number of hours.
What does the law say?
Providers and deployers take measures to secure, to their best extent, a sufficient level of AI literacy among their staff and other persons using AI systems on their behalf. In doing so they take into account those people's technical knowledge, experience, education and training, the context in which the systems are used and the persons on whom they are used.
That is the whole provision. It is deliberately open-ended, because the same text has to apply to a medical software maker and to a building services company with eighty people. The Digital Omnibus of July 2026 turned it into a best-efforts obligation: take measures that support the development of AI literacy. The obligation remained, and the form is still up to you. What did and did not change is set out in the AI Act timeline after the Digital Omnibus.
Who does it apply to?
To whoever makes AI systems and to whoever uses them under their own responsibility. That second group is larger than it sounds. A hospital with a triage system is a deployer, and so is an office where people use a chatbot to write a quote or a report. And "on their behalf" extends to contractors and suppliers who work with the organisation's systems. What else the AI Act asks of an employer is covered in the EU AI Act for employers.
So the building services company is covered, with its thirty people who use Copilot for email and the five office staff who prepare quotes with a chatbot. Not because the company builds AI, but because it uses it.
What is not required?
The training provider's email mixes up what the law asks with what a training company sells. Separated out:
| What is often assumed | What the text says |
|---|---|
| Everyone has to take a course | Take measures, matched to role and context; a course is one possible measure |
| You need a certificate | No certificate and no formal test; your own records are enough |
| There is a minimum number of hours | No minimum hours |
| One course for the whole organisation is enough | What is sufficient differs by role; what is enough for one person is too little for another |
| It is about being able to program | It is about knowing what you use, what it cannot do and when not to take an output at face value |
The European Commission confirms in its questions and answers on Article 4 that a certificate is not required and that an organisation can rely on its own record of the measures it has taken. Our main article on the subject, AI literacy in 2026, links to that page and looks more closely at what the Commission says.
What does "sufficient" mean?
Enough to use AI knowingly in your own role. For most people it comes down to knowing three things: which tools the organisation has allowed and where to look that up; which data does not belong in a prompt; and that an AI answer is a draft to be checked. Anyone using AI in decisions about people, in recruitment or customer onboarding for instance, needs to know more: how the system reaches an outcome and when to override it. Anyone assessing or buying tools needs something different again.
Those differences between roles are exactly what the organisation records. Not "we ran a course", but "this group needed to know this, this is what we did about it and this is what was decided about each tool". Which groups an ordinary organisation has and what each needs is covered in our article on whether every employee needs AI training.
Who supervises it?
National regulators have had supervisory powers since 2 August 2026. The regulation sets no penalty specifically for Article 4; it is up to member states to decide on sanctions. In the Netherlands that is being done through the AI Act Implementation Act, which is not yet final. Exactly which regulator supervises Article 4, and with what powers, therefore remains open. That is no reason to wait, but it is a reason not to write certainties into your own policy that do not yet exist.
In practice the question "can you show it?" rarely comes from a regulator first. It comes from a client in a tender, from the auditor, from the works council or after a data breach in which an employee pasted a file into a chatbot. What you put on the table then, and why an attendance list is not enough, is covered in our article on demonstrating AI literacy.
What does that look like at the building services company?
The privacy officer replies: mandatory, yes; in this form, no. She proposes something else. Fifteen minutes in the team meeting for everyone who uses Copilot, covering the three basic rules. A short briefing for the five staff who write quotes on what can and cannot go from customer files into a prompt. And a register with the decision on each tool, so people can look it up when they are unsure.
While the register is being drawn up, an inventory shows that ChatGPT, Perplexity and a meeting transcription tool are in use alongside Copilot. Nobody ever made a decision on the transcription tool. That is not an incident, nor proof that the briefing is pointless. It shows that a course is a single moment, and that the organisation's decision also has to be there when someone opens a tool that did not exist on the day of the course.
