Article 4 of the AI Act requires appropriate measures, not a certificate

According to the European Commission, Article 4 of the AI Act requires organisations to take context- and risk-driven measures that support AI literacy among staff, but a uniform level of knowledge, certificate or general course is not required. Those wanting to demonstrate compliance record which knowledge each role, system and risk needs, and review this periodically.

In its updated question-and-answer document on AI literacy, the European Commission reiterates that both providers and deployers must take measures that support the AI literacy of staff and other persons dealing with the operation and use of AI systems on their behalf. In doing so, they must take account of technical knowledge, experience, education, training, the context of use and the persons or groups to whom a system is applied. The guidance also indicates that organisations may keep internal records of training or other support initiatives; it does not require a certificate or a specific knowledge measurement.

Our interpretation: the focus has thereby shifted. The question is no longer has everyone taken an AI course?, but has the organisation determined, for each role and work process, which AI competencies are needed and recorded that these are present? That difference, in our analysis, determines whether an organisation can convincingly substantiate its chosen measures and their alignment with its own context.

What exactly does the European Commission's updated Q&A say about Article 4?

In its guidance on the literacy obligation, the European Commission states that Article 4 requires providers and deployers to take appropriate measures, tailored to the context in which an AI system is used and to the people who work with it. The guidance does not prescribe a uniform knowledge level, certificate or specific knowledge measurement, and it leaves organisations to tailor measures to relevant knowledge, experience, training and context.

This guidance is official, but it is not a Dutch implementation manual and no guarantee that a particular approach delivers compliance. The Commission provides the framework; organisations must themselves determine how they work out and document the measures in their context.

Is a general AI course or an individual certificate enough to comply with Article 4?

In our assessment, no. In our assessment, a general course mainly proves that someone has taken part; on its own, such a course does not show that the person can assess AI output in their own work, recognise errors and know when escalation is needed. In our analysis, a uniform certificate on its own does not prove that the measures align with the relevant context and roles; moreover, the Commission does not make a certificate or specific knowledge measurement mandatory.

Recent academic work supports our distinction between participation in general training and demonstrated, context-specific competence. An arXiv study on task-oriented assessment of AI literacy argues that common, general measurement instruments align poorly with real decision-making, and advocates scenarios from one's own profession over abstract knowledge tests. The supplied preprint is consistent with treating AI-related work as involving changing capabilities and transition pathways; in our analysis, that supports training linked to output evaluation, error recognition and quality control rather than a one-off tool introduction. And a CHIWORK study on generative AI literacy in the workplace shows that literacy also requires feedback channels, psychological safety and room for critical reflection, not only individual prompting skills.

What does this obligation mean concretely for directors, lawyers and CISOs?

Our analysis: an organisation-wide e-learning record may be insufficiently convincing when it does not show how the measures align with roles, systems and risks. We therefore advise the person responsible for AI governance to record this quarter, for each AI system, which roles work with it and which competencies belong to them. Because the task-oriented study reports that general instruments can align poorly with practical decision-making, our analysis is that a general certificate for a lawyer or doctor would not, on its own, establish that the person can assess AI output in their file. Alongside or instead of generic testing, use scenarios from one's own profession, for example in which the employee must recognise an error or a fabricated source. Because our reading of The AI Skills Shift links changing roles and collaboration with AI to quality-control responsibilities, a one-off instruction may become inadequate when a tool or work process changes materially; the process owner therefore includes a review trigger for relevant changes of model, supplier or context of use. Our analysis: when employees cannot safely discuss AI use or doubts about it, that may limit insight into actual use; the organisation therefore sets up a feedback and escalation channel where doubts about AI output can be reported without consequences. It also helps to link making human oversight of AI advice measurable to the role profiles.

How do I set up a literacy programme that holds up as evidence under supervision?

Our proposed defensible programme is versionable and differentiated per role. Based on the sources named and our own practice, we see four building blocks that, in our analysis, can provide more substantive documentation than a paper declaration.

• System and risk register. Record for each AI system: purpose, users, data processed, risks and who bears the human responsibility.
• Role profiles. Translate that register into concrete competencies for end users, reviewers, managers, developers and external service providers; not everyone needs the same thing.
• Scenario-oriented instruction. Practise with realistic work actions in which employees assess output, recognise errors and fabricated sources, protect confidential information and decide when they stop or escalate.
• Recording and review. Record which measures have been taken, who has taken part, which material was used, which exceptions applied and at which triggers the programme is reviewed.

Those who maintain these four elements can, in our analysis, better document how the literacy measures are aligned with the actual systems and risks and when they were reviewed; that offers no guarantee about a supervisor's assessment. That is precisely the difference from a standalone certificate. For the legal context, it helps to see which AI Act obligations apply per risk level. Those wanting to structure the evidence will find concrete examples in our overview of documenting types of audit evidence defensibly. The broader framework is set out in our hub with an overview of EU AI Act and compliance.

Sources: The article draws on the European Commission's updated AI Literacy Q&A and on three recent academic studies about task-oriented literacy, changing skills and literacy in the workplace.