AI literacy under Article 4: why a memo is not enough

In many companies, the AI literacy obligation was handled with a circular email: a one-page memo with five rules, a read receipt, a check mark in a list. That is understandable, because the provision is short and names no number of hours, and since the 2026 amendment it no longer demands a specific level at all. A memo still falls short, and the reason is in the wording.

What Article 4 requires

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

The obligation has applied since February 2, 2025, the date on which Chapter I of the Regulation entered into application under Article 113. It sits in Regulation (EU) 2024/1689 and is aimed expressly not only at makers of AI systems but at every deployer. Since July 27, 2026, it has applied as amended by Regulation (EU) 2026/1744. Before that, it required measures to ensure, to the best extent possible, a sufficient level of AI literacy among staff (as of October 2026).

Three phrases carry the weight. “Measures” means more than an announcement. The measures follow knowledge, experience, and the context of use, so a single memo for everyone does not meet the standard. And “other persons” pulls in contractors, temporary staff, and service providers who operate the systems on your behalf.

Why the absence of a fine changes nothing

Article 4 does not appear in the list of fines in Article 99, and the amended version no longer demands a specific level. Concluding that the obligation is toothless mistakes where it bites: it comes up in every supervisory inquiry, in every assessment of a high-risk AI system, and in every dispute about a decision that rested on a machine recommendation. At that point the question is not whether you trained anyone. It is what you can show.

What this means in practice

Competent does not mean everyone has to be able to explain a model. It means every person can judge the systems they work with. Four abilities cover it.

• Judging what a system is good for and what it is not.
• Recognizing a wrong answer before it gets used downstream.
• Knowing which data may go in and which may not.
• Knowing when a person has to decide and when they do not.

The second one is the hardest, because a fabricated answer usually sounds better than a correct one. It cannot be acquired by listening. It is acquired by working through cases where the system gets it wrong.

Five levels, matched to roles

A training path needs levels, because a board member and a software engineer are not asking the same question. Five levels cover the usual roles.

• Decision-makers: the model landscape, use cases by business unit, risks. For executives, department heads, and supervisory bodies, about two hours.
• Data protection and language models: processing agreements, classifying your own use cases, redacting personal data. For data protection officers and compliance, about four hours.
• Workspace for heavy users: skills, tools, your own connectors, reading audit entries. For the people who work with it every day, about one day.
• Engineering: from the first system prompt to a skill in production, testing, and continuous integration. About two days.
• In-depth level with a final exam: architecture, custom tools, compliance and audit logging, applied to a case of your own. About five days.

There is currently no open program with fixed dates. SIMO GmbH arranges training as part of a client engagement, within its enablement service; how the SIMO Academy works is described on simo-online.com.

Which level for whom

A workable rule of thumb: whoever decides needs level one. Whoever works with the output daily needs level three. Whoever classifies use cases or owns contracts needs level two. Levels four and five concern few people, which is exactly why it pays to hold that knowledge in house rather than renting it indefinitely.

The purpose is capability, not dependency. The benchmark is a team that shapes its own roles and tools after the training without having to call anyone.

How to document where you stand

An attendance list on its own will not satisfy an inquiry. Four documents will.

• A mapping of which role in the company needs which level, with the reasoning.
• Per-person evidence of the level attended, with date and content.
• A rule for new hires and for service providers operating systems on your behalf.
• A date for the refresher. What was learned in 2025 describes a model landscape that no longer exists.

If you already keep an audit trail of AI use, part of this comes for free: it shows who uses which system and how, which makes training needs visible instead of assumed.

What training does not replace

It does not replace architecture. A well-trained team working with a system that names no sources and logs no calls cannot apply its competence at all. You can only judge what you can trace.

Which is why the two topics belong together. The technical side is covered in the article on orchestration for midsize companies; where the line between preparation and decision runs in daily work is shown in the field reports from the Lab.