How to Create an EU AI Act AI Literacy Program

In this article

1. What an AI Literacy Program Has to Achieve Legally
2. What Article 4 requires
3. What an AI literacy program does not need
4. The Commission’s Four Steps as the Basis of Your AI Literacy Program
5. Step A: Build a general understanding of AI
6. Step B: Establish whether your organisation is a provider or deployer
7. Step C: Consider the risks of each AI system
8. Step D: Turn the analysis into appropriate measures
9. How to Build the Program, Step by Step
10. 1. Define the scope and assign an owner
11. 2. Design learning measures by role
12. 3. Choose formats that suit the audience
13. 4. Create system-specific guidance
14. 5. Add relevant safeguards and human-oversight training
15. 6. Include relevant contractors and service providers
16. 7. Keep records and review the measures
17. What the European Commission Does in Its Own AI Literacy Program
18. Use the Commission’s Resources
19. The living repository of AI literacy practices
20. Support for SMEs
21. Enforcement and Timing
22. A Note for Employers in Germany
23. How AnnexOps Helps
24. Ready to manage your AI literacy program in one workflow?
25. Author: Nitin Grover

To create an AI literacy program under the EU AI Act, start with the four considerations outlined in the European Commission’s AI Literacy Q&A: build a general understanding of AI, establish whether your organisation acts as a provider or deployer, assess the risks associated with the systems you use or develop, and design appropriate measures for the people involved.

Article 4 requires providers and deployers to take measures to support AI literacy among their staff and other people who operate or use AI systems on their behalf. The measures should reflect people’s technical knowledge, experience, education and training, as well as the context in which the systems are used and the people affected by them.

Following the amendments introduced by Regulation (EU) 2026/1744, the obligation does not require organisations to guarantee a specific level of AI literacy for every individual. Article 4 also does not prescribe a particular training format, certificate or minimum number of training hours.

This guide explains how to turn the Commission’s four-step approach into a practical AI literacy program, while distinguishing legal requirements from recommended implementation practices.

For the legal background, read our complete guide to AI literacy training under Article 4. To decide who is covered, see who needs AI literacy training under the EU AI Act. For a task list, use our AI literacy training checklist.

What an AI Literacy Program Has to Achieve Legally

What Article 4 requires

Article 4(1) of the EU AI Act, as amended, requires providers and deployers to take measures to support the development of AI literacy among their staff and other people who deal with the operation and use of AI systems on their behalf.

When deciding what measures to take, organisations must consider:

• The technical knowledge and experience of the people involved.
• Their education and training.
• The context in which the AI systems will be used.
• The people or groups of people on whom the systems will be used.

Article 4 entered into application on 2 February 2025. Regulation (EU) 2026/1744 subsequently amended the obligation, clarifying that organisations do not have to guarantee a specific level of AI literacy for every individual.

The practical implication is that organisations should develop measures suited to their circumstances rather than assume that one standard training course will meet every need.

What an AI literacy program does not need

The European Commission’s AI Literacy Q&A, updated on 27 July 2026, explains several limits of Article 4.

• No mandatory certificate: Article 4 does not require a certificate. Organisations can keep internal records of training and other initiatives.
• No mandated AI officer or governance board: Article 4 does not require organisations to appoint a particular officer or establish a dedicated board.
• No guaranteed level of individual literacy: The amended provision expressly states that organisations do not have to guarantee a specific level of AI literacy for each person.
• No prescribed training format: Article 4 does not set a mandatory course format, minimum number of hours or universal training syllabus.

These points do not remove the legal obligation to take measures supporting AI literacy. They give organisations flexibility to choose measures appropriate to their systems, people and operational context.

The Commission’s Four Steps as the Basis of Your AI Literacy Program

The European Commission recommends considering at least four steps when developing AI literacy measures. They provide a useful structure for an organisation’s AI literacy program, but they are not a mandatory four-part course.

Commission consideration	Question to address	Suggested program component
Step A	What is AI, how does it work, and what systems does the organisation use?	General AI literacy
Step B	Is the organisation developing AI systems or using systems built by others?	Provider and deployer role mapping
Step C	What should people know about each system, including its risks and safeguards?	System-specific guidance
Step D	How should measures reflect people’s knowledge, the context of use and affected people?	Role-based learning and support

Legal and ethical considerations should run throughout the program. Organisations should also consider relevant AI governance principles and the obligations that apply to their systems.

Step A: Build a general understanding of AI

Start with a shared foundation. People should understand what AI is, which tools their organisation uses and how those tools may affect their work.

Depending on the role, this could include recognising AI-generated content, understanding system limitations, checking outputs and knowing when human judgement is necessary.

For example, employees who use generative AI to draft customer communications should understand that outputs can contain inaccurate information, unsupported claims or inappropriate content. The level of detail should reflect how they use the system.

Step B: Establish whether your organisation is a provider or deployer

Record the organisation’s role for each AI system.

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, subject to the definitions and conditions in the Act.

A deployer uses an AI system under its authority, except where the system is used in the course of a personal, non-professional activity.

An organisation may act as a provider for one system and a deployer for another. Its role should therefore be assessed system by system rather than assigned once to the entire business.

This mapping helps determine which legal obligations and practical guidance are relevant to the people involved.

Step C: Consider the risks of each AI system

Review each system’s intended purpose, limitations, potential effects, and relevant EU AI Act requirements before deciding what people need to learn.

A structured AI risk classification tool can help teams identify systems that may fall into a high-risk category or require additional safeguards. An EU AI Act Compliance Checker can also serve as an initial screening aid, provided its results are verified against the applicable legal requirements.

Do not assume that Article 4 itself requires a formal, documented risk assessment for every AI system. Other provisions of the EU AI Act, and other applicable laws, may impose specific assessment, documentation or risk-management duties depending on the system and the organisation’s role.

The training plan should reflect the risks that are relevant to the people using or overseeing each system.

Step D: Turn the analysis into appropriate measures

Use the preceding considerations to decide what support each group needs.

A person who uses an AI assistant for routine drafting may need guidance on accuracy, confidentiality, and appropriate use. A manager approving AI-supported decisions may need a deeper understanding of oversight and escalation. A technical team may require more detailed guidance on system limitations, testing and applicable obligations.

The right approach depends on people’s existing knowledge, their responsibilities, the context of use, and the people affected by the AI system.

How to Build the Program, Step by Step

1. Define the scope and assign an owner

Start with an AI inventory. Record each system, its purpose, its internal owner, its users, and any relevant contractors or service providers.

Use the inventory to identify where AI literacy measures are needed and which groups should be covered.

Article 4 does not require a dedicated program owner. However, assigning a person to coordinate the work is a practical recommendation. An owner can maintain the inventory, coordinate training activities and schedule reviews when systems or working practices change.

2. Design learning measures by role

Different groups may need different levels of detail. The European Commission’s own staff initiatives distinguish between generalists, managers and developers, illustrating how learning can be adapted to responsibilities.

An organisation could use three groups as a starting point:

• Everyday AI users: People who use approved AI tools for writing, research, translation or analysis.
• Managers and decision-makers: People who approve AI use, supervise workflows or rely on AI-supported outputs.
• Technical teams: People who build, configure, integrate, test or maintain AI systems.

These are suggested categories, not statutory classifications. A smaller organisation may need only one or two groups, while a larger organisation may require more detailed segmentation.

People with an existing AI background may need less introductory material. They may still benefit from guidance about the organisation’s own systems, the risks associated with their use and the relevant legal and ethical considerations.

3. Choose formats that suit the audience

An AI literacy program can combine briefings, workshops, written guidance, demonstrations and e-learning. Article 4 does not prescribe one format for every organisation.

Choose a format that helps people understand the systems they encounter in their work. A practical demonstration may be more useful for regular users than a lengthy presentation about AI terminology.

The Commission cautions that simply providing a system’s instructions for use may not be effective on its own. Supplement those instructions with context-specific guidance where appropriate.

4. Create system-specific guidance

For each AI system, explain what it does, what it cannot reliably do and which risks users should recognise.

For a generative AI tool, guidance could cover hallucinations, confidential information, biased outputs and the need to verify important claims. For a recruitment or decision-support system, the relevant issues may include the intended purpose, limitations, human involvement and potential effects on people.

The Commission uses examples such as employees using ChatGPT for advertising text or translation to illustrate why guidance should reflect actual use.

Avoid giving every employee the same generic material if their responsibilities and exposure to risk differ significantly.

5. Add relevant safeguards and human-oversight training

Some AI systems require more than general literacy measures.

Article 26 establishes specific obligations for deployers of high-risk AI systems, including requirements concerning human oversight and the competence, training and authority of people assigned to carry it out.

Where these requirements apply, organisations should address them separately in their implementation plans. Relevant training may explain who is responsible for oversight, how to interpret outputs, when to intervene and how to escalate concerns.

Do not treat completion of a general AI literacy course as proof that all separate high-risk system obligations have been met.

6. Include relevant contractors and service providers

Article 4 covers staff and other people who deal with the operation and use of AI systems on an organisation’s behalf. The scope is not necessarily limited to direct employees.

Consider contractors, outsourced teams and service providers who operate or use relevant systems for the organisation. Determine what guidance is appropriate based on their tasks, their access to the system and the risks involved.

Contractual requirements may be useful in some arrangements, but Article 4 does not impose one universal contract clause for all external parties. Decide what is appropriate for each relationship and applicable legal obligation.

7. Keep records and review the measures

Maintain records that help demonstrate what the organisation has done to support AI literacy. Depending on the program, these may include:

• The AI systems and user groups covered.
• Training materials and guidance issued.
• Dates and audiences for learning activities.
• Attendance or completion records, where relevant.
• Changes made after a system, vendor or use case changes.

Article 4 does not prescribe a universal record format or review interval. Keeping these records is a practical way to organise the program and explain the measures taken if questions arise.

Set a review date and consider additional reviews when the organisation introduces a new system, changes how an existing system is used or identifies a new risk. These are recommended management practices rather than fixed deadlines imposed by Article 4.

What the European Commission Does in Its Own AI Literacy Program

The Commission’s Q&A describes initiatives for its own staff. They offer examples of how a large organisation can organise AI learning.

Its approach includes an internal competency framework, learning packages for generalists, managers and developers, tool-specific training, a community of practice and a network of AI Champions.

Smaller organisations do not need to reproduce this structure in full. They can adapt the underlying idea by defining relevant audiences, providing suitable learning resources and updating guidance as their use of AI changes.

The Commission’s approach is an example of implementation, not a template that automatically establishes compliance for another organisation.

Use the Commission’s Resources

The living repository of AI literacy practices

The AI Office maintains a living repository of AI literacy practices to support learning and the exchange of examples. It includes initiatives from companies and public-sector organisations, such as e-learning, workshops and other learning activities.

These examples can help organisations choose suitable approaches for their own circumstances. However, copying an example from the repository does not automatically establish compliance or create a presumption of compliance.

Article 4 also provides for the Commission to publish practical examples on the Single Information Platform to support providers and deployers.

Support for SMEs

Article 4(2) requires the Commission and Member States to support and facilitate providers’ and deployers’ efforts, particularly those of small and medium-sized enterprises.

The European Digital Innovation Hubs, also referred to in the Commission’s materials as Experience Centres for AI, can be a useful starting point for organisations seeking help with AI adoption, skills development or training opportunities.

Available services vary by location. Check the relevant hub or national support service for current programmes and eligibility.

Enforcement and Timing

Article 4 entered into application on 2 February 2025. Its amended wording retains the obligation for providers and deployers to take measures supporting AI literacy while clarifying that they do not have to guarantee a specific level of literacy for every individual.

The European Commission’s AI Literacy Q&A states that supervision and enforcement rules for Article 4 apply from 3 August 2026. This is the date stated in the Commission’s specific Article 4 guidance and should not be confused with the general 2 August 2026 application date for other AI Act provisions.

National market surveillance authorities are responsible for enforcing Article 4 under the applicable framework. The assessment of an organisation’s measures will depend on the relevant legal requirements and circumstances. The Commission notes that evidence of an incident connected to inadequate training or guidance may be relevant to enforcement considerations.

Organisations should not assume that having a training course or completion record automatically resolves every compliance concern. The measures should be appropriate to the systems, people and context involved.

The AI Act can also apply to providers and deployers established outside the EU where the relevant territorial conditions are met. Whether it applies to a particular organisation requires an assessment of the Act’s scope and the facts of the case.

A Note for Employers in Germany

German employers should consider whether an AI literacy program engages works council consultation or co-determination rights.

Section 96 of the Betriebsverfassungsgesetz addresses the promotion of vocational training and consultation between employers and works councils. Section 97(2) may provide for co-determination in certain circumstances where planned or implemented measures change employees’ work and their existing knowledge and skills are no longer sufficient. Other provisions may also be relevant, depending on the measures involved.

These rules do not mean that every AI literacy program automatically requires works council approval before it is announced. The legal position depends on the programme’s design, its effects on employees and the circumstances of the workplace.

Employers should assess the applicable requirements and obtain German employment-law advice where necessary. The guide to Germany’s EU AI Act competent authorities provides further context on the national regulatory framework.

How AnnexOps Helps

Creating an AI literacy program is one task. Keeping its records aligned with AI systems, people and changing business practices is an ongoing operational challenge.

AnnexOps AI Governance Platform helps teams organise AI inventories, risk classifications, training records and related evidence in a connected workflow. Its AI Literacy Compliance Tracker supports the organisation of training activities and records, helping teams understand which systems and groups their measures relate to.

As an AI compliance software product and EU AI Act compliance platform, AnnexOps can also help teams organise wider AI governance activities. Its capabilities support compliance operations; they do not replace legal advice or guarantee compliance with the EU AI Act.

Author: Nitin Grover

Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.