AI literacy
An employer duty under Article 4
AI literacy is the ability to understand what an AI tool can do, where it gets things wrong, and how to work with it safely. It is not a programming skill — it is knowing what must not go into the tool, how to verify its output, and when a human has to decide. Article 4 of the EU AI Act requires employers to ensure it among people who work with AI.
What it actually means
Literacy here is not knowledge of models or prompting tricks. It is a sober picture of the fact that a language model generates probable text rather than verified fact — and therefore that hallucination is a property to plan around, not a defect to wait out.
The other half is about data. Staff have to know that customer personal data, health records, trade secrets and credentials do not belong in a public tool. This is where most real damage originates, not in the quality of the output.
- Knowing where the tool reliably helps and where it invents.
- Knowing what data must never go into it.
- Verifying output before it reaches a customer.
- Understanding where the decision has to stay with a person.
How the duty is met in practice
The regulation prescribes neither a format nor a certificate, so nobody needs accredited paperwork. It prescribes an outcome and the ability to evidence the measures taken. In practice that means three things: training, a written AI usage policy, and a record that both exist.
The depth should scale with risk. A team having marketing copy rewritten needs a different level from a team using AI to screen CVs or to inform decisions affecting customers. The detail is on the EU AI Act page.
Need the duty covered and evidenced?
See the training and AI policyFrequently asked questions
Since when has the AI literacy duty applied?
Since 2 February 2025. It was among the first parts of the EU AI Act to take effect, and it is the one that reaches the largest number of companies.
Who in the company does it cover?
People who encounter AI as part of their work — which is not only IT. Typically marketing, sales, support, HR, administration and engineering. How much is appropriate depends on how riskily that team uses AI.
How often should training happen?
The regulation sets no interval. In practice that means when new people join and whenever the tools in use change materially. What matters more than frequency is being able to show when training last happened and what it covered.