The EU AI Act is setting clear rules for how companies should handle AI, especially when it comes to ensuring their people understand it.
A crucial part of this is Article 4, which focuses on AI literacy. In simple terms, this article says that companies using or providing AI systems must make sure their staff and anyone else working with these systems on their behalf have enough knowledge about AI.
For generic AI tools such as Copilot or ChatGPT this means, that employees should have a basic understanding about biases, possible mistakes, prompting, copyrights and human oversight.
Even if a company doesn’t officially provide AI tools, many employees already use systems like ChatGPT in their daily work. Under the EU AI Act, the responsibility still lies with the company: staff must receive appropriate training to ensure they use AI safely and responsibly. The obligation applies whether the tools are company-provided or privately adopted for work tasks.
Article 4 of the EU AI Act is the central provision establishing the AI literacy obligations for providers and deployers. It states:
“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”
The law is short, but not always easy to read. To make it more practical, our legal team went through the text line by line and compared it with what it means in practice.
Below you’ll find a side-by-side table: what the law says, how we interpret it legally, and a plain language version anyone can follow.
| What Article 4 says | Our interpretation | Plain language version |
|---|---|---|
| Providers and deployers | This clearly assigns the primary responsibility for ensuring AI literacy to those entities that develop AI systems and place them on the market, and those that use AI systems in their operations. | If your company uses general AI tools such as ChatGPT or Copilot, you are a deployer (as meant by the AI Act). Even if you do not actively provide these systems but your employees use their own tools while working, you are a deployer and therefore the obligations apply. |
| take measures | This phrase imposes an active obligation. It is not enough to assume literacy; organizations must proactively plan, implement, and maintain initiatives designed to foster AI literacy. This implies a need for a structured approach and documented efforts. | You must provide AI training to your employees according to the level of their AI use. If your employees use generic tools such as ChatGPT or Copilot, you need to provide them with training covering basic skills, knowledge, and understanding. You must also document the process and be able to demonstrate that each employee has completed the training. Training must be repeated whenever major changes happen or when the tools advance significantly. |
| to their best extent | This introduces a degree of flexibility, acknowledging that the specific measures may vary. However, it is also a demanding and vague standard, requiring organizations to make genuine and proportionate efforts. What constitutes “best extent” will likely be assessed based on the organization’s size, resources, the nature and risks of the AI systems involved, and the potential impact on individuals. This necessitates careful justification and robust documentation. | The bigger your organization, the more you are expected to do. Whatever you do, you should document your efforts. For AI literacy, you should document which training opportunities you have offered and when employees have completed them. |
| sufficient level | Similar to “best extent,” this is a context-dependent and outcome-oriented standard. A “sufficient level” of AI literacy must be adequate for the specific roles individuals perform and the AI systems they interact with. The emphasis is on achieving competence, not just offering training. | You must provide AI training to your employees according to the level of their AI use. If your employees use generic tools such as ChatGPT or Copilot, you need to provide them with training covering basic skills, knowledge, and understanding. If they use other tools, you must ensure they have received enough training to use them in a compliant manner. It is not enough to make training accessible—you must show that people have taken it and reached the required understanding. |
| staff and other persons dealing with the operation and use of AI systems on their behalf | This broadens the obligation beyond direct employees. It seems to include contractors, consultants, third-party service providers, and others who operate or use AI systems on behalf of the provider or deployer. This has implications for third-party risk management, as organizations must extend AI literacy considerations to vendors and partners. | You must ensure sufficient AI literacy beyond your own employees. This includes consultants, contractors, and third-party service providers if they use AI services while working for you. If these people have access to your organization’s AI tools, they should be offered the same training as employees. |
| taking into account their technical knowledge, experience, education and training | This mandates a tailored approach to AI literacy programs. A one-size-fits-all solution is unlikely to be compliant. Organizations must consider baseline knowledge and adapt training accordingly. For example, all relevant personnel should take at least basic AI literacy training, while developers and IT staff should take more advanced training. | One size does not fit all. Offer all personnel basic compliance training, with role-specific training on top. For example, software developers should take more advanced training. |
| context the AI systems are to be used in | AI literacy needs vary depending on the application. Office personnel using AI for general purposes have different requirements than those working with high-risk systems, such as in critical infrastructure or health data. Training must match use cases and roles. | For most office workers, training covering basic skills, knowledge, and understanding is enough. |
| considering the persons or groups of persons on whom the AI systems are to be used | This links AI literacy to the impact on individuals and their rights. Staff must understand potential biases, fairness issues, and the rights of those affected. For example, HR staff using AI for recruitment must be aware of risks of discrimination. | This clarifies the need for training in knowledge and understanding, not just tool skills. |
We are solving the literacy issue for organizations, see how we can help you solve AI literacy.
