AI literacy is an obligation, not a training course

The Record, written in October 2026. A retrospective. This piece covers the spring of 2025, when Article 4 had been in force for a few months, and was written afterwards from the documents. Nothing here was published at the time.

Of everything in the AI Act, Article 4 is the shortest and the least discussed. It requires providers and deployers to take measures to ensure a sufficient level of AI literacy among their staff, and among anybody else dealing with AI systems on their behalf, taking into account their technical knowledge, training and context.

It has applied since 2 February 2025. It has no certification, no notified body, no template. And in two years of asking associations to show me their evidence for it, I have seen it produced once.

Why it gets skipped

It reads like a nudge rather than a duty. There is no threshold, no number, no filing. Compared with the prohibitions, which have the word prohibited in them, Article 4 looks like the Act being polite.

The trap is the word sufficient. Sufficient is not defined, which means it will be assessed after something has gone wrong, by somebody asking what the person who made the decision actually understood. That is the worst possible moment to discover that the answer is "they attended a webinar in 2023".

What sufficient looks like in an association

Three groups, three different answers. Treating them as one audience is what produces a course nobody remembers.

The board and the executive. They do not need to operate a model. They need to be able to hold a supplier to account: what the system does, what it does not do, who is accountable when it is wrong, and what the association's own obligations are as a deployer. Two hours, once, with a document they signed.

The people who use the tools. They need to know what the tool is for, what it is not for, what happens to the data they put into it, and how to escalate a case that looks wrong. This is the group where the gap between what a supplier's training covers and what the Act asks for is widest, because supplier training teaches the product and Article 4 asks about the obligation.

The IT team. Technical literacy is not the problem. The problem is that the IT team is usually the only group that has read anything, and is therefore assumed to cover the other two.

The evidence problem

Suppose an association did all of that in 2025. What would it have to show?

Not a certificate. What it would have to show is a record: who was in the room, what they were told, what they were tested on, and when it was refreshed. The same evidentiary shape as health-and-safety training, and for the same reason — the obligation is about a state of knowledge, and the only way to demonstrate a state of knowledge after the fact is to have documented the attempt to create it.

Most associations already have that machinery. They run CPD for members. They certify competency. They issue certificates that mean something in their sector. They simply never pointed it at themselves.

What it would have cost

A day of somebody senior's time to write the material, because the material is the Act and the association's own tool inventory. Two hours per group. A register with names and dates in it. Refresh annually, or when a tool changes.

Call it three days of work in total, spread across a quarter, in a year when the alternative was doing nothing and hoping the word sufficient never came up.

The part that is actually useful

Here is the argument that gets Article 4 approved by a board that has cut every discretionary project: it is the only AI obligation that makes the organisation better rather than merely safer.

An association whose staff understand what the tools do makes better procurement decisions, writes tighter supplier contracts and wastes less money on features nobody uses. The compliance artefact and the commercial benefit are the same artefact. That is rare enough in regulation to be worth pointing out — and it was true in the spring of 2025, when almost nobody was pointing it out.

---

The Record · ← What the prohibitions actually banned · The day the model became somebody else's problem →

---

Running an association? The AI Act for associations — what your body must actually do sets out the whole thing on one page: whether you are a provider or a deployer, the four duties that reach a membership body, the dates that matter, and the five items of evidence a board will ask for.