AI Literacy Training Checklist for Companies

In this article

1. What the Law Requires Before You Start
2. What changed in Article 4
3. What the Commission has confirmed
4. The AI Literacy Training Checklist
5. How to use this AI literacy training checklist
6. Phase 1: Know your AI systems
7. Phase 2: Know your people
8. Phase 3: Decide the measures
9. Phase 4: Deliver and record
10. Phase 5: Keep it current
11. The AI Literacy Training Checklist at a Glance
12. Extra Items for High-Risk AI Systems
13. What Article 26 adds
14. Items to add to your AI literacy training checklist
15. Common Gaps in an AI Literacy Training Checklist
16. One all-hands session treated as finished
17. Contractors left out
18. Records not tied to systems.ms
19. No update after a change
20. Training run once, then forgotten. ten
21. How to Work Out Who Is In Scope in Practice
22. A Note for Employers in Germany
23. Works council involvement
24. Who enforces it in Germany?
25. How AnnexOps Helps
26. Ready to move this AI literacy training checklist into one workflow?
27. Author: Nitin Grover

An AI literacy training checklist for companies should cover five things: which AI systems you use, who works with them, what each group needs to know, what training or guidance you deliver, and how you keep that record current. Article 4 of the EU AI Act does not prescribe a format, so this AI literacy training checklist follows the four-step approach in the European Commission’s own AI Literacy Q&A, last updated on 27 July 2026.

It is written for compliance, HR, and product teams who need something they can work through this month, not a general explanation of the law. For the full legal background, read our complete guide to AI literacy training under Article 4. If you are still deciding which groups are covered, start with who needs AI literacy training under the EU AI Act.

What the Law Requires Before You Start

What changed in Article 4

Article 4 has applied since 2 February 2025. The Digital Omnibus amendment, Regulation (EU) 2026/1744, removed earlier wording that required a “sufficient level” of AI literacy. The duty itself stayed: providers and deployers must still take measures to support the AI literacy of their staff and other people who operate or use their AI systems on their behalf.

What the Commission has confirmed

Three points from the Commission’s Q&A decide what your AI literacy training checklist can leave out:

• No certificate is required. An internal record of training or other guidance is enough.
• Article 4 does not require an AI officer or any specific governance structure.
• Supervision and enforcement rules apply from 3 August 2026.

Penalties are set under national law and must be proportionate to the infringement. The Commission also notes that proof of an incident linked to inadequate training or guidance makes enforcement action more likely. That is the practical reason to keep records.

The AI Literacy Training Checklist

How to use this AI literacy training checklist

Work through the five phases in order. Each phase ends with a record you should be able to show later. The Commission’s four steps are: build a general understanding of AI, confirm your role, assess the risk of each system, then build literacy actions from that analysis. Phases 1 and 2 cover the first three steps. Phases 3 to 5 cover the fourth.

Phase 1: Know your AI systems

Phase 1 of the AI literacy training checklist builds the inventory that everything else depends on:

• List every AI system in use or in development, including third-party tools and AI features inside software you already pay for
• Record the business purpose and the internal owner of each system
• Mark your role for each system: provider (you built it and placed it on the market) or deployer (you use it under your own authority)
• Run an EU AI Act risk assessment on each system and flag candidates for the high-risk category
• AI risk classification tool EU AI Act check: use a structured classification step, not a guess, for any system used in hiring, credit, education, biometrics, or other Annex III areas
• Keep the inventory in one place, so the later phases can point back to it

Many teams use an EU AI Act Compliance Checker as a first screen, then move the unclear systems into a fuller classification. Keeping the result in AI compliance software, rather than in a loose spreadsheet, means the records from Phases 2 to 5 can point back to it.

Phase 2: Know your people

Phase 2 of the AI literacy training checklist maps people to systems:

• Identify the employees who operate or rely on each system
• Add contractors, freelancers and service providers who use or operate your AI systems on your behalf. Article 4 covers other persons dealing with AI systems on behalf of the provider or deployer.
• Note each group’s technical knowledge, experience, education and training. Article 4 asks you to take these into account.
• Note who is affected by the system’s output, such as candidates or customers. Article 4 requires providers and deployers to consider the persons or groups on whom the AI systems are used when determining appropriate AI literacy measures.s

Phase 3: Decide the measures

This phase of the AI literacy training checklist turns your analysis into decisions:

• Write down what each group must understand: what the system does, where it fails, and which risks matter. The Commission’s own example is staff using ChatGPT for advertising copy or translation, who need to know about hallucination.
• Choose the format. A short briefing, a role-based session, written guidance,e or e-learning are all acceptable, because the Act fixes none of them
• Do not rely on the provider’s instructions for use alone. The Commission says that is often not enough
• Add basic legal and ethical content, including what the AI Act means for your role
• Give technical staff organisation-specific content too. A background in AI does not replace knowing what your deployed system does

Phase 4: Deliver and record

Phase 4 of the AI literacy training checklist produces the evidence:

• Deliver the measures to each group you identified in Phase 2
• Record the date, the group, the content covered, and who delivered it
• Link each record to the AI system it relates to, not to a general HR folder

Phase 5: Keep it current

An AI literacy training checklist is only useful if it is revisited:

• Review when a system changes, a vendor is added or replaced, or a person changes role
• Set a fixed review date. The Act sets no interval, so this is our recommendation, not a legal requirement
• Brief new joiners and new contractors before they start using AI tools
• Watch for recommendations from the AI Board under Article 4(3) and for guidance from your national authority

The AI Literacy Training Checklist at a Glance

Phase	Main action	Evidence to keep
1. Know your AI	Inventory, role, risk assessment	AI inventory with role and classification
2. Know your people	Map staff, contractors, affected persons	List of groups per system
3. Decide the measures	Define content and format per group	Written rationale for each measure
4. Deliver and record	Run training, log it	Dated training records linked to systems
5. Keep it current	Trigger-based and scheduled review	Review log and change history

Extra Items for High-Risk AI Systems

What Article 26 adds

Article 4 applies broadly to AI systems covered by the Regulation. Where you deploy a system classified as high-risk, Article 26 adds a separate duty: deployers must assign human oversight to people who have the necessary competence, training and authority. The Commission has confirmed that this obligation is distinct from the Article 4 AI literacy requirement.

Items to add to your AI literacy training checklist

For high-risk AI systems EU AI Act obligations, add these items on top of the checklist above:

• Name the person or people responsible for oversight of each high-risk system
• Record training specific to that system: how to read its output, its known limits, and when to intervene or stop it
• Keep these records separate from the general Article 4 literacy records

Common Gaps in an AI Literacy Training Checklist

One all-hands session treated as finished

Article 4 ties the measures to each group’s starting knowledge and to the system in use. A single generic presentation rarely shows that.

Contractors left out

Teams build the list from the payroll and forget freelancers and service providers who use or operate company AI tools on the organisation’s behalf.

Records not tied to systems.ms

A training log that does not say which AI system it concerns cannot support the four-step reasoning the Commission describes.

No update after a change

A new vendor or a new use of an existing tool can change the risk, and the training should follow.

Training run once, then forgotten. ten

The duty to take measures remains in place. If nobody owns the review date, the record ages quietly until an authority or an incident asks for it.

How to Work Out Who Is In Scope in Practice

Knowing the legal categories is one thing. Applying them across a real organization is another. A workable sequence starts with the AI inventory: list every AI system in use, then record who operates each one, including contractors and service providers where they are using or operating AI systems on the organization’s behalf, not just employees on the payroll.

From there, an AI risk classification tool for the EU AI Act can help identify which systems may fall into a high-risk category, which tells you where the separate Article 26 human oversight requirements also need to be considered. Some teams use an EU AI Act Compliance Checker at this stage as a first-pass screen, then move systems requiring closer review into a fuller assessment.

The output of this exercise should be a simple mapping: system, role of the organization (provider or deployer), people operating or using it on the organization’s behalf, and the AI literacy measures planned for each relevant group. This approach aligns with the Commission’s practical guidance and is easier to maintain in AI compliance software than in a spreadsheet that goes stale the next time a vendor, contractor, or team changes.

A Note for Employers in Germany

Works council involvement

Training measures in Germany can involve the works council. Legal commentary on Article 4 from the law firm Noerr points to co-determination rights under Section 96 of the Betriebsverfassungsgesetz (Works Constitution Act). This is a German employment-law consideration separate from the EU AI Act itself. Involve the works council early, before the programme is announced to staff and before the AI literacy training checklist is rolled out.

Who enforces it in Germany?

The Bundesnetzagentur is the default market surveillance authority under KI-MIG, alongside sector regulators such as BaFin. See our guide to Germany’s EU AI Act competent authorities for the split.

How AnnexOps Helps

An AI literacy training checklist works until you have more than a handful of systems, three departments, and a changing contractor list. AnnexOps AI Governance Platform keeps the inventory, the risk classification, the people, and the training records in one place, so each checklist item points to evidence instead of an email thread. As an EU AI Act compliance platform, it also shows your EU AI Act readiness across the other obligations, not only Article 4. AnnexOps supports compliance operations. It does not replace legal advice.

Author: Nitin Grover

Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.