When did Article 4 begin to apply?

The Commission says Article 4 entered into application on 2 February 2025. Its current Q&A says supervision and enforcement rules apply from 2 August 2026. Organizations should check current EU and national materials with counsel because the Commission also describes amendments made through the 2026 Digital Omnibus process.

Does every employee need the same AI training?

The Commission's guidance points in the opposite direction. Measures should reflect technical knowledge and experience, along with education and training. System context and affected people also matter. A common foundation can help, but role-specific modules and exercises should address the systems and decisions each person handles.

Is an AI literacy certificate required?

The Commission says there is no need for a specific certificate. An organization can preserve internal records of training and other guiding initiatives. The useful evidence connects the person and role to a named system, assigned material, version, applied check, remediation, and review trigger.

Does human review satisfy Article 4?

Human review creates a role that needs appropriate system-specific skill. The reviewer should understand known limitations and source checking, along with data handling and authority. The role also requires documentation and escalation. A "human in the loop" label says nothing about those capabilities by itself.

Can runtime logs prove AI literacy?

Runtime logs can support the program by showing governed use and policy outcomes, including repeated error patterns. They cannot prove comprehension or competence. Join those records to training assignments and applied assessments through role and system identifiers, while preserving privacy and access limits.

EU AI Act Article 4 AI Literacy Needs Role-Specific Evidence

EU AI Act Article 4 applies to the people who operate and use AI systems on behalf of providers and deployers. The European Commission's current guidance tells organizations to consider technical knowledge, experience, education, training, and the context in which each system is used. It also says the obligation has applied since 2 February 2025, with supervision and enforcement rules applying from 2 August 2026.

A single annual slide deck gives every employee the same vocabulary, but Article 4 asks for a closer fit between the person and the system, with attention to the risk. I would build the evidence around that fit.

TL;DR

Article 4 covers staff and other people who operate or use AI systems for a provider or deployer.
The Commission expects measures shaped by role, prior knowledge, system context, risk, and affected people.
No certificate or prescribed governance body is required. An internal record of training and guidance can document the program.
Runtime HTTP records can reveal where guidance needs revision. Training delivery and human competence remain outside a gateway.

Article 4 starts with people and system context

The European Commission's Article 4 questions and answers describes the obligation in operational terms. Providers and deployers must take measures that support AI literacy for staff and other people dealing with AI system operation and use on their behalf. The design should account for their technical knowledge and experience, along with their education and training. It should also account for the context in which the systems are used.

That creates a bounded population. Start with employees who configure or supervise an AI system, including those who approve or use it, then add contractors and service providers who perform those functions on the organization's behalf. Record the role they perform and the system they touch. A software engineer administering a model endpoint needs different knowledge from a recruiter reviewing a ranking, even if both work for the same deployer.

The Commission also says an organization whose employees use ChatGPT for advertising copy or translation should inform them about specific risks such as hallucination. Low-consequence use still creates an Article 4 population.

The role-to-system matrix

The first useful artifact is a role-to-system matrix, rather than a course catalogue. Give each row a named AI system, provider or deployer role, affected business process, user group, prior competence assumption, known risks, required behavior, and evidence owner. Include the people affected by the system's output.

The Commission's minimum-content guidance asks organizations to establish a general understanding of AI and identify their role as provider or deployer. They should then consider system risk and build literacy actions from that analysis. The guidance specifically points to differences in knowledge and training, as well as system context and the people or groups affected.

For a customer-support summarizer, the user may need to recognize hallucinated account facts and handle personal data. The user must also know when to reopen the source ticket. An engineer operating the same system needs knowledge of route configuration and model changes, plus evaluation and incident handling. A manager needs to understand the review boundary and escalation path.

This matrix should link to the AI model inventory and name an owner. The inventory identifies what exists, while the literacy matrix assigns the operational knowledge required around each system.

Curriculum should teach observable decisions

Generic AI definitions belong in a foundation module. The next layer should use the organization's actual systems, approved routes, prohibited data, human-review points, and escalation channels. Staff should practice the decision they will face at work.

For users, that may mean comparing an AI summary with its source and recognizing invented citations. It may also mean refusing to paste a customer record into a personal model account. For human reviewers, it may mean identifying when confidence language is unsupported, then documenting an override. Administrators may need to recognize a model substitution or a disabled control, as well as an unexpected destination. Incident responders need a request identifier and a preserved record, not a screenshot pasted into chat.

The Commission says a human-in-the-loop design still requires appropriate skills targeted to the system. Putting a person after the model leaves the literacy obligation intact because the reviewer must know what to inspect and what authority they hold.

One concrete exercise should end with an artifact. Put a synthetic loan explanation or hiring recommendation on a printed page alongside a support summary. Ask the reviewer to mark unsupported statements in red and circle the source references. The reviewer should then record a disposition and escalate through the real channel. The marked sheet exposes more than a completion badge.

Evidence should show participation and applied competence

The Commission says a specific certificate is unnecessary. Organizations can keep an internal record of training and other guiding initiatives. It also says Article 4 does not mandate an AI officer or AI governance board, nor does it require another particular structure.

A defensible record should include the mapped role and system, assigned material, delivery date, version, attendance or acknowledgement, exercise result, remediation, and reviewer. Preserve the risk analysis that explains why the organization chose that depth. Record the next review trigger. That could be a new model, expanded use, incident, control change, or material Commission guidance.

Course completion alone proves presence. An applied check shows whether the person could execute the required decision under the exercise conditions, so preserve both results separately. If a reviewer misses an invented source, assign focused remediation and repeat the check. The result supports the AI governance audit framework without pretending that one quiz predicts every production decision.

My opinion is that a 100% completion dashboard with no system names is compliance wallpaper. It measures calendar discipline while leaving competence untested.

The Commission repository is a reference, not a safe harbor

The Commission's living repository of AI literacy practices collects initiatives from organizations so providers and deployers can learn from one another. The Commission states that the examples are descriptive and do not automatically create a presumption of compliance.

Use the repository to compare program shapes. One organization may separate generalists and managers from developers and other technical staff. Another may combine e-learning and workshops with internal guidance and office hours. Copying the visible format without the underlying role and system analysis misses the reason the example exists.

Maintain a short rationale for every borrowed practice. Name the mapped risk and target population, then record the expected behavior and assessment method. If the practice has no connection to an identified system or user decision, remove it. The same rule applies to training added after an incident: link the change to the event and show how the revised exercise tests the failed behavior.

Runtime evidence can improve the literacy program

Production records can reveal repeated decisions that deserve training attention. A cluster of blocked requests containing customer data may show that one team misunderstands approved destinations. Repeated attempts to use an unapproved model can expose a stale tool list. A spike in responses sent for human review may show that reviewers need clearer criteria.

Use aggregated, access-controlled evidence. The literacy owner needs a pattern and affected role, not unrestricted access to every prompt. Define a review cadence and a threshold for reopening material. Record the analysis and approved curriculum change, then record the later result. The AI policy enforcement guide covers the runtime control side; Article 4 focuses on the people who operate around those controls.

This is also the DeepInspect boundary line. A gateway can observe governed HTTP requests and policy outcomes, but it cannot determine that a person understood a lesson or watched a workshop. It also cannot judge conduct outside that traffic. HR and learning owners retain those responsibilities alongside legal and compliance owners, as well as business owners.

DeepInspect

DeepInspect can support the runtime evidence around Article 4 for authenticated HTTP traffic between users or agents and LLM endpoints. It evaluates identity-aware policy and records the model destination and policy outcome, along with per-decision audit records. Aggregated patterns can help literacy owners identify a role that repeatedly sends restricted data or uses an unapproved route.

The Article 4 obligation remains a people and governance duty. DeepInspect does not deliver training or certify competence. It also does not assess human judgment or cover local and off-gateway activity. A defensible program joins role-specific learning records to bounded runtime evidence while keeping those responsibilities explicit.

Book a demo today.