Article 4 of the EU AI Act became enforceable in February 2025. It requires every company that deploys or uses AI systems to ensure “a sufficient level of AI literacy” among its staff. That obligation is real, it applies now, and the document that satisfies it is an AI literacy policy.
This article explains what Article 4 actually requires, what an AI literacy policy must contain, and the most common mistakes companies make when writing one.
What Article 4 says
The exact text of Article 4 requires providers and deployers of AI systems to “take measures to ensure, to the best of their ability, a sufficient level of AI literacy of their staff and other persons dealing with the operation of AI systems on their behalf.”
Three things to notice:
- The obligation falls on deployers (companies using AI tools), not just providers (companies building AI systems). If your company uses ChatGPT for customer support, GitHub Copilot for development, or any AI hiring tool, you are a deployer.
- “Sufficient level” is not defined precisely. The Act says it should be appropriate to the person’s role, their technical background, and the context in which the AI system is used.
- The obligation extends beyond direct employees to anyone operating AI on the company’s behalf, including contractors and external consultants.
Who counts as a “person dealing with AI”
This is broader than most companies assume. It includes:
- Anyone who uses an AI tool as part of their job, even occasionally
- Managers who review AI-generated outputs or recommendations
- IT staff who configure, deploy, or maintain AI systems
- HR staff who use AI tools in recruiting or performance assessment
- Customer service agents who interact with AI-assisted workflows
It does not require every employee in the company to undergo training. A marketing coordinator who never touches an AI tool is not in scope. But anyone who does, even if AI is a small part of their role, is.
What the policy must contain
The Act does not prescribe a specific format. A workable AI literacy policy covers four areas:
1. Scope and purpose Which AI systems the policy covers, which roles it applies to, and what the policy is trying to achieve. Be specific: list the actual tools in use, not just “AI systems in general.”
2. Training requirements by role Different roles need different training. A developer fine-tuning a model needs to understand bias and data provenance. A customer service agent using an AI recommendation tool needs to understand its limitations and when to escalate to a human. The policy should map training content to role categories, not apply one-size training to everyone.
3. Review schedule AI systems change. Policies should too. A review schedule of at least once per year, or when a new AI system is introduced, satisfies the Act’s expectation that literacy measures are kept current.
4. Responsibilities Who owns AI literacy in the organisation. Typically this is a named HR manager or a designated AI Officer, but it can be distributed across department heads. The policy should say who is responsible for each part: updating the document, tracking completions, and handling exceptions.
Common mistakes
Writing a training policy, not a literacy policy. Training is one way to achieve AI literacy, but not the only one. The policy should describe the outcome (what staff need to understand) and then the means (how the company ensures they get there). A policy that just says “all staff complete a 2-hour training course annually” is incomplete.
Listing tools without explaining why they are included. The policy should note, for each tool or category of tool, why it creates an AI literacy obligation. This is especially important for Article 6 high-risk systems where the stakes are higher.
Ignoring contractors. Article 4 explicitly covers persons acting on the company’s behalf. If you use an external recruitment agency that runs AI screening tools, your literacy obligations extend to how you oversee that process.
No version history. Regulatory inspections are document-heavy. An undated policy that cannot show when it was last reviewed is weaker than one with a clear update trail.
What it does not need to be
It does not need to be long. A well-written AI literacy policy can cover all required ground in 4 to 6 pages. Padding it with legal boilerplate that nobody reads does not improve compliance.
It does not need to be expensive to produce. A compliance lawyer can review it, but a lawyer does not need to write the first draft. The substance of the policy, the actual content of what your staff learn and how, comes from people inside the organisation who understand what AI tools are in use.
Generate your AI Literacy Policy in 30 minutes
Answer 20 questions about your company and AI systems. Get a complete, prefilled AI Literacy Policy ready for adoption — in 11 EU languages.
Check my compliance →The Article 4 deadline has passed
The AI literacy obligation became enforceable on 2 February 2025. If your company does not yet have an AI literacy policy, you are already out of compliance. National AI authorities are still building their enforcement capacity, but that window will not stay open indefinitely.
The next deadline, for most high-risk AI deployers, is 2 August 2026. That one requires a broader set of documentation, including a risk classification and, where applicable, a usage policy and disclosure notice.
Getting the AI literacy policy in place now means one less document to manage under time pressure when August 2026 approaches.