What is the short answer?
The EU AI Act requires providers and deployers of AI systems to take measures that support the AI literacy of staff and other people operating or using AI on their behalf.
That is broader than buying one generic training course. The measures should reflect people’s knowledge and experience, the context in which the AI is used, and the people who may be affected.
The European Commission says the Article 4 obligation has applied since 2 February 2025. Following the 2026 amendments, no single fixed or “sufficient” level of literacy is prescribed. See the Commission’s current AI literacy policy page and AI literacy questions and answers.
Does every employee need the same training?
No. A person occasionally using an approved writing assistant does not need the same instruction as someone procuring, configuring, monitoring, or relying on an AI system in a high-impact process.
A practical programme can be role-based:
- ordinary users learn approved tools, prohibited information, output limitations, and escalation routes;
- managers learn when approval and human review are required;
- technical teams learn testing, monitoring, security, and system limitations;
- privacy, legal, compliance, and risk teams learn how their existing responsibilities apply to AI use.
Is a written AI policy enough?
Not by itself if people cannot apply it.
A policy is useful evidence of governance, but literacy means people understand the relevant risks and know what to do. A long document that nobody can translate into daily decisions does not solve that operational problem.
Combine the policy with examples, short instruction, an approval route, and a way to check proposed uses before information is shared or an output is relied upon.
Do we need to keep records?
The Commission’s Article 4 material does not prescribe one universal certificate or record format. Still, keeping proportionate evidence is sensible. An organisation may record:
- who received which role-based guidance;
- the policy version and approved-tool list in force;
- when material was reviewed or updated;
- recurring questions and how the organisation answered them;
- approvals or safeguards for higher-risk uses.
The point is not to produce paperwork for its own sake. It is to show that the organisation took the duty seriously and adapted its measures to actual use.
What should a small company do first?
Start with the AI use already happening. Name approved tools and accounts, explain which information must stay out, define human review, and give employees a real contact for uncertain cases.
Then make the policy easy to use at the moment of work. If someone needs to read twenty pages before summarising a document, the operational layer is missing.
Can a workplace checker replace training?
No. It can reinforce training and policy by applying the rule to a real task, but it does not replace awareness, role-specific instruction, professional advice, or sector requirements.
Can I Use AI? helps a team publish its workplace AI policy and guide employees through task-specific questions. Each completed check preserves the answer and exact policy version used, making the policy easier to apply and improve.
This article is general information, not legal advice. Organisations should assess the AI Act and other applicable duties in their own context.