AI literacy is mandatory: what Article 4 really asks of your organisation since 2025

Translated with AI. This article was translated by an AI model from an article by Twentynext in another language, and the translation was checked automatically against the original. Verify figures and sources before acting on them. See our disclaimer.

Since 2 February 2025, AI literacy has been a legal obligation under the European AI Act. A short e-learning course for all staff is an understandable first response. Whether that is enough depends on what the obligation actually asks of your organisation.

The text of Article 4 is short, and since the amendment in July 2026 it calls for measures that support the development of AI literacy. That leaves room, but it also means you have to determine for yourself which measures suit your people, your systems and your context. Below you will read what the text does and does not say, where organisations in our experience get stuck, and how to set up an approach that will still hold up in two years’ time.

What Article 4 does and does not say

The core is simple. In its original wording, which applied from 2 February 2025, Article 4 required organisations that develop or use AI systems to ensure that their employees are AI-literate, as the Autoriteit Persoonsgegevens (AP, the Dutch Data Protection Authority) summarises it. This concerns knowledge, skills and understanding of the technical workings of AI systems and of their social, ethical and practical aspects.

Article 4 is addressed to providers and deployers of AI systems. The text was amended in 2026: according to the questions and answers from the European Commission, that amendment entered into force via the Digital Omnibus (Regulation (EU) 2026/1744) in July 2026. The obligation remains, but now calls for measures that support the development of AI literacy among staff and among others who use AI systems on behalf of the organisation.

According to the same source, the amended text does not prescribe a specific or “sufficient” level per person. The measures should, however, fit the technical knowledge, experience and training of the people involved and the context in which the systems are used, as Praxikon summarises the amended text. Nor, according to that summary, does the law prescribe a standard course or certificate.

According to the Commission, the supervision and enforcement rules have applied since August 2026.

Three things stand out. It is an obligation to take measures, and you determine for yourself what is appropriate. The group covered is staff and others who use AI systems on behalf of your organisation; whether contractors fall within it depends on whether those people work with the systems on your behalf. And what is appropriate depends on role and context.

That is why our advice is to look beyond a single generic training course for everyone.

Who is covered: wider than the AI team

The first misconception we encounter in conversations: “We do not develop AI, so this does not affect us.” According to the European Commission, Article 4 is also addressed to deployers. A chat function in customer service, a predictive model in planning, an AI assistant in office software: for each of those systems the question is whether you have that role. That depends on how you use the system and requires an assessment per system.

The second misconception: “This is about our data scientists.” The amended text refers to staff and other persons who use AI systems on behalf of the organisation, as Praxikon puts it; that group can be wider than the AI team. Think of the employee who adopts AI-generated advice in a decision, the manager who purchases an AI tool, the lawyer who assesses a contract in which AI output plays a role, and the contractor who works with the system on your behalf.

A practical rule of thumb for the inventory, separate from the legal delineation: include everyone who sees, influences or purchases AI output. Then determine per group whether they fall under Article 4 and what they need to know.

What is appropriate differs per role

As Digitale Overheid (the Dutch government’s Digital Government platform) describes it, AI literacy is an umbrella term for knowledge and skills: knowing at a basic level how the technology works, where the opportunities lie and which risks are attached to it. How deep that goes depends on what someone does with the system.

We ourselves use a division into four levels. It is not in the Act; it is a tool for differentiating what you offer:

• Basic: everyone who encounters AI systems or their output in their work. Offering this level broadly is a practical choice; the legal group is limited to staff and others who use AI systems on your behalf. What is AI, what can it and can it not do, when is it better not to rely on it, how do you handle the data you enter.
• Users of specific systems: how does this system work, what are its known weaknesses, how do you recognise an unreliable outcome, to whom do you report it.
• Decision-makers and process owners: which risk category does this system have, what responsibilities does that entail, how do you safeguard human oversight in the process.
• Builders and administrators: technical knowledge of models, data, monitoring and documentation.

The difference between levels one and two deserves attention. Someone who uses a predictive model daily to prioritise waiting lists gains little from a general introduction to AI. That person needs to know which data that particular model was trained on and in which types of cases it is known to perform poorly.

Why a completed e-learning course is not evidence

An obvious approach: purchase an e-learning course on AI, roll it out to all staff and report the completion rate to the board. Ninety per cent have completed the module, so the organisation is AI-literate.

Whether the customer service employee therefore knows that the summarising tool he uses is AI is not demonstrated by that percentage. Nor whether the communications adviser realises that the image library has recently gained generative functions. Or whether the buyer asks, for a new SaaS tool, where the AI is and who is responsible for the notification.

Precisely those questions have no longer been theoretical since August 2026, now that the transparency obligation of Article 50 also applies. If a supervisory authority or a critical citizen asks why an AI interaction was not recognisable as such, “everyone has done the training” is not an answer. The answer must be: we knew this system existed, we determined what was needed for it, and this is who monitors that.

Making AI literacy measurable in four steps

A useful four-step framework comes from a guidance document of the Autoriteit Persoonsgegevens, as summarised by ICT law firm Legalz: identify the AI systems in the organisation, determine per role which level of AI literacy is desired, take action and evaluate periodically. That sounds simple. The work lies in how you make each step measurable.

One caveat first. Article 4 does not oblige you to measure employees’ AI knowledge, as the European Commission explains. The indicators below are internal management information with which you keep a grip on your approach; they are not legal evidence of compliance.

Step 1: take stock, and measure completeness

Start with a list of all AI applications that communicate with people or generate content for publication. So also the AI functions that have appeared in existing software without anyone having purchased them.

Making it measurable: have departments draw up their own list independently and compare it with what IT and procurement know. The difference between those lists is your first indicator. A large gap is a signal that the organisation does not have a clear picture of its AI use, regardless of how many training courses have been completed; that signal does not count as a legal yardstick, but it does as internal management information.

Step 2: determine per role what “appropriate” means

A board member does not need to know how a language model works. He does need to know which decisions in his portfolio are supported by AI and what goes wrong if that is not transparent. A customer contact employee needs to know which tools he uses and what he says to a citizen who asks whether he is talking to a human.

Making it measurable: formulate three to five concrete questions per role that someone must be able to answer. For example, “can indicate which systems in his process use AI and where the notification is”. That is testable, unlike “understands AI risks”.

Step 3: choose measures that fit the role

Training courses are one instrument. Appointing an AI officer or coordinator, drawing up work instructions and adjusting the procurement procedure are others. The AP points to documents such as Aan de slag met AI-geletterdheid (Getting started with AI literacy) and Verder bouwen aan AI-geletterdheid (Building further on AI literacy) with examples and tips.

Making it measurable: link each measure to one of the questions from step 2. A measure that does not answer a question is probably for form’s sake.

Step 4: evaluate on behaviour at work

Annual surveys, audits and periodic reports are forms of evaluation that Legalz mentions. The pitfall is that they again measure participation.

Making it measurable: test whether employees can actually answer the questions from step 2. On a sample basis, briefly, without prior notice. Also check whether new AI applications that have appeared in the past year have ended up in your inventory. In our view, the latter is the most honest practical yardstick, although it is not a legal definition of AI literacy: an organisation that has a clear picture of its AI use can notice new applications sooner.

Where organisations get stuck in practice

In conversations on this subject, we encounter a number of patterns. These are our own observations, not research findings.

The first pattern is the stand-alone training course. HR purchases an e-learning course, everyone completes it, and nobody links the content to the systems that are actually in use. The risk is then that the knowledge remains detached from daily use.

The second pattern is the unknown inventory. In our experience, the overview held by the ICT department and the picture held by the departments themselves quite often diverge, and AI functions in browsers and office software are easily overlooked in the process. Our advice is therefore to start with the departments themselves and compare the ICT overview with that.

The third pattern is the one-off action. AI literacy was dealt with in the spring of 2025, but since then new tools have been taken into use, people have changed roles and external staff have been hired. The systems and the people keep changing; the approach was a one-off.

The fourth pattern is the absence of an owner. Compliance points to HR, HR points to ICT, ICT points to the business. It does not have to be a full-time position, but it does have to be someone’s task.

An approach that remains sustainable

A workable set-up consists of four components that you tackle in this order.

Take stock of systems and roles

Map which AI systems are in use, including functions in standard software, and who works with them. Record per system what it does, which decisions it influences and who the owner is. This inventory also helps you with the question of which other obligations under the AI Act may apply per system.

Differentiate the learning offer

Link the levels from the previous section to the roles from the inventory. Keep the basic level short and the same for everyone. Make the system-specific knowledge concrete, by contrast: which model, which data, which known limitations, which escalation route. The latter is in many cases difficult to buy in ready-made; it requires input from the people who built or administer the system.

Embed in existing processes

Include AI literacy in onboarding, in the procurement process for new software and in the agreements with contractors and suppliers. Whoever takes a new AI system into use arranges the knowledge for the users as part of the implementation. That way the approach keeps moving with new systems and new people.

Record what you have done

The Act calls for measures that support the development of AI literacy, as the European Commission describes it. It stands to reason that you should be able to show them: which measures have been taken, for which groups, linked to which systems, and when you repeat that. How a supervisory authority weighs this is best checked against the current information from the Autoriteit Persoonsgegevens. A simple register that you maintain is a practical starting point.

What you can realistically expect

How much time a first cycle of taking stock, determining levels and rolling out the basic offer takes depends on the number of systems and departments. In our experience, the inventory often takes the most time, although that differs per organisation. The system-specific layers follow afterwards, per system, at the pace at which owners are available.

Do not expect a moment when it is finished. Do expect the work to be easier to distribute once the approach is part of onboarding and procurement.

An approach that is linked to the systems can, moreover, deliver more than compliance. Our expectation is that employees who know where a system is weak are more alert to that in their work. That is also an argument for keeping the approach in place when attention for the Act wanes.

Start with the inventory, this week

The most useful first action is also the least exciting: ask each department to supply, within two weeks, a list of all AI functionality they use, including functions in existing software and tools that people use on their own initiative. Appoint one person to merge the lists and record an owner per system.

With that list in hand, you can assess per system whether Article 4 applies, which level seems necessary per group and where you give attention first. Everything that follows, from learning offer to registration, can only be designed once this overview exists. If you would like to discuss how to approach that inventory or how to determine the levels for your organisation, we at Twentynext are happy to think along with you.