This article describes the content of the regulation. It is not legal advice and not an assessment of your specific case. Whether and how a provision applies to your company is a legal question.
Most companies associate the AI Act with high risk systems, conformity assessments and deadlines that feel far away. The provision that became practically relevant first is unspectacular by comparison, and it concerns almost every business: Article 4, AI literacy.
It has applied since 2 February 2025 and requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff and other persons dealing with these systems on their behalf. No form, no notification, no authority issuing anything. That is precisely what makes it easy to overlook.
Who the provision addresses
The AI Act distinguishes providers, who develop an AI system and place it on the market, from deployers, who use a system in the course of their professional activity. The second group is the large one: it covers every company using AI tools in daily work.
In practice that often means more than management assumes. The chatbot on the website. The writing tool marketing uses for drafts. The CRM feature that prioritises quotes. Translation in the mail client. Much of this was never decided as an AI rollout; it arrived quietly.
What sufficient literacy means
The text names three reference points: the technical knowledge and experience of the people involved, their training, and the context in which the systems are used. That is not a curriculum but a yardstick. Someone sending customer data through an AI tool needs different knowledge than someone generating draft text.
From consulting practice, the need can be tested with three questions that should be answered honestly inside the business:
- Does everyone using an AI tool know which data they may enter and which they may not?
- Is it understood that results can be wrong, and is it clear who checks them before use?
- Is it settled who decides whether a new tool may be used at all?
If one of these questions is left hanging, that is not only a training gap but an organisational one. Literacy without responsibility fizzles out.
What evidence can look like
Because the regulation prescribes no form, what matters is traceability. Usable evidence answers without follow up questions: who, when, which content, for which tools. In practice a maintained list plus the materials actually used is enough.
- 1.Inventory: which AI tools are actually in use, including those never formally introduced.
- 2.Mapping: which roles work with which tool, and with which data.
- 3.Content: fundamentals for everyone, deeper content for roles handling data or customer contact.
- 4.Record: date, participants, content, materials used, kept like other personnel records.
- 5.Repetition: for new tools and new staff, not on a rigid calendar.
The most common mistake
The most common mistake is generic training with no link to the business. A talk about artificial intelligence does not serve the purpose if it does not say which tools are used here, which data may go into them, and who decides here. The yardstick in the regulation is explicitly the context of use.
The second most common mistake is skipping the inventory. Without knowing which tools are in circulation, you can neither train nor document. That inventory rarely takes more than one or two days and is the basis for everything else.
If you want to know which AI tools are actually in use in your business and what follows from that, the inventory is the right first step. We carry it out and record the result so that it serves as the basis for training and documentation.