AI literacy under Article 4: how to show compliance
LAST UPDATED ·
What Article 4 requires
Article 4 of Regulation 2024/1689 is brief. Providers and deployers of AI systems must take measures to ensure, as far as possible, a sufficient level of AI literacy among staff and others using AI on their behalf. They must consider technical knowledge, experience, education, the context of use, and the people affected by the system.
In plain English: make sure people understand the tools they use. Match that knowledge to their work.
Who it covers, including Copilot and ChatGPT
The duty covers every organization using AI systems, regardless of size. It does not start only with high-risk applications.
- Does your office team use Copilot in Outlook? They need AI literacy.
- Does marketing draft copy with ChatGPT? They need AI literacy.
- Does automation read orders from PDFs? People reviewing its output need AI literacy.
- Does a tool assess applicants? AI literacy and high-risk requirements both apply.
A June 2025 study by the Dutch Chamber of Commerce found that 30% of business owners used ChatGPT or Copilot. Only 2% to 3% were preparing for the AI Act. Many businesses already fall under Article 4 without realizing it.
What sufficient means for each role
The law specifies neither training hours nor a curriculum. The right level depends on the role. We use this structure:
| Role | What they need to know | Format |
|---|---|---|
| Directors and management | What the AI Act and GDPR require, permitted tools, ownership, and high-risk uses | 2-hour management session producing a policy and register |
| Employees using AI for email, copy, or summaries | Capabilities, failure modes, permitted data, and checking answers | 3-hour workshop with their own examples |
| Employees operating automation | The workflow, review screen, exceptions, and error reporting | 1- to 2-hour onboarding at launch |
| IT and application management | Model hosting, agent permissions, logs, and supplier agreements | Technical handover during setup |
The principle stays the same: AI makes mistakes, people check, and data has rules.
Documenting compliance: register, attendance, assessment, and policy
The law does not require a certificate. It requires you to show that you took measures. Four documents are enough:
- AI register. Record tools, automations, purposes, owners, and risk levels.
- Attendance and content. Record who attended, when, and what the training covered.
- Short assessment. Ten questions after the workshop. Nobody fails; it shows that the knowledge was transferred.
- AI policy. One page: what is allowed, what is not, who approves, and where to report an error. Signed by management.
Keep all four together. They provide a clear answer when a client, insurer, or regulator asks.
In-house workshop versus e-learning
Both can work. The difference is what people retain.
E-learning is inexpensive per person and easy to schedule. The downside: its examples are general, and the questions employees actually have (“Can I paste this client file in here?”) never come up.
An in-house workshop uses your processes and tools. Employees practice with real emails and documents. Their questions expose the issues that matter. It costs the team half a day and usually produces a list of use cases as well as literacy.
For a company of 10 to 100 employees, a workshop in two or three groups is, in our experience, the more practical route. See our workshop formats for what we offer. Open seminars in The Hague are available on request.
What the regulator has said
The Dutch Data Protection Authority and RDI are preparing Dutch oversight of the AI Act. They have urged organizations to start on AI literacy now instead of waiting until oversight is in place. Check autoriteitpersoonsgegevens.nl for updates. Their message is consistent: inventory your AI use, decide what each group needs, and record what you do. Exactly the four documents above.
Note the wording: Article 4 is a best-efforts obligation (“as far as possible”). A business that can show it thought about this seriously and trained its people is in a strong position. One that did nothing is not.
Six-step plan
- Inventory. Find every AI tool and automation in use, including the unofficial ones. Ask around; you will find more than you expect.
- Group people by role: management, users, operators, and IT.
- Write a one-page policy, or create it during a management session.
- Train each group with its own examples. Record attendance and content, then use a short assessment.
- Put everything in the register: tools, training, policy, and owner.
- Repeat annually and whenever you introduce a new tool or automation. Literacy is not a one-time duty.
As a diagram: Inventory → Policy → Training by role → Register → Annual review. The highlighted block is the training: that is where the literacy itself lives. The rest is the evidence around it.
Example
An accounting firm with 55 employees used personal ChatGPT accounts without a policy. One management session, three 3-hour workshops, attendance records, assessments, and a one-page policy gave all 55 employees documented basic AI knowledge. Figures are illustrative. Read the accounting firm example case.
FAQ
FAQ
Is an AI literacy certificate mandatory?
No. Article 4 requires sufficient knowledge among your people. You can document this with attendance records, training content, a short assessment, and a policy.
Does the AI literacy duty apply to a company with 15 employees?
Yes. There is no size threshold. The duty applies to every provider and user of AI systems. Training can still match each role and type of use.
When did Article 4 take effect, and who enforces it?
Article 4 has applied since February 2, 2025. In the Netherlands, the Dutch Data Protection Authority and RDI are preparing oversight. Check autoriteitpersoonsgegevens.nl for updates.
