AI literacy: what Article 4 of the AI Act asks of businesses

If your team uses AI tools at work, Art. 4 of the EU AI Act applies to you. You have to make sure, to your best extent, that the people using them understand them well enough. There is no prescribed course or certificate, but you should be able to show what you did.

The EU AI Act, Regulation (EU) 2024/1689, entered into force in August 2024. Most of its rules apply later and concern providers of high-risk systems. Two parts, however, have applied since 2 February 2025: the bans on certain AI practices and the duty of AI literacy in Article 4. The latter concerns almost every business.

Who is affected

Article 4 applies to providers and to deployers of AI systems. A deployer is anyone who uses an AI system in a professional context. If your staff write texts with a chatbot, have emails translated or use AI features in accounting or design tools, your business is a deployer.

What “sufficient” means

The regulation does not set a fixed level. It asks for measures that fit the technical knowledge, experience and training of the people involved and the context in which the AI is used. Someone who has a chatbot draft marketing texts needs different knowledge than someone who uses AI to pre-sort job applications.

Five practical steps

1. List the tools. Which AI tools are used, by whom and for what? Include features built into existing software.
2. Set rules. A short internal AI policy: which tools are allowed, which data may go in, and that results are checked before use.
3. Train by role. Basics for everyone: how these tools work, where they make mistakes, what not to enter. More depth for those with sensitive tasks.
4. Document it. Who was trained when and on what. A simple list is enough.
5. Review it. New tools come quickly. Look at the list and the policy at least once a year.

Where the GDPR comes in

As soon as personal data goes into an AI tool, for example customer emails or applications, the GDPR applies as well. Then you need a legal basis, a data processing agreement with the provider and, for transfers outside the EU, suitable safeguards. Your internal AI policy is the right place to say which data must not go into which tool.

How we can help

We run practical AI literacy training for small teams and write the internal AI policy with you, aligned with your data protection documentation. See our services or write to us.