AI literacy under Article 4 of the EU AI Act: role-based training and the records that prove it

Who this guide is written for.

• Boards and buyers who sign AI statements in customer security questionnaires and tender documents
• Process owners running a purchased AI system, that is deployers under the Regulation
• People operating AI systems day to day and carrying human oversight duties
• Engineering teams building AI features or integrating vendor models
• HR, compliance and procurement teams that have to show who was trained, on what programme and when
• Companies outside Poland whose EU footprint pulls them into the obligation

What Article 4 actually requires

Article 4 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of those systems on their behalf. The article names what has to be taken into account: technical knowledge, experience, education and training, the context the systems are used in, and the people or groups the systems are used on. It also states that the obligation does not require guaranteeing any specific level of AI literacy of any individual.

There is no hour count in the text, no named course and no requirement for an external certificate. The test is fit to role, so an auditor or a customer looks at two things: whether the programme matched what that person actually does with the AI system, and whether you can show it.

The personal scope is the widest in the whole Regulation. It reaches people who are not your employees but act on your behalf: contractors, agencies and subcontractors operating your systems.

The obligation has applied since 2 February 2025 and that date was not moved. What the 2026 omnibus package did change, from 27 July 2026, is the wording of Article 4 itself. The original text required measures to ensure, to the best extent, a sufficient level of AI literacy; the new one requires measures that support its development and states that no specific level has to be guaranteed for any individual. New paragraphs oblige the Commission and the member states to support these efforts, particularly in SMEs, with practical examples published by the Commission, and the AI Board to adopt recommendations. The obligation still applies from 2 February 2025, and the records have to show the measures you took.

Mapping roles to the level of AI understanding they need

This is where paper compliance is manufactured. One course for everyone ticks the box and changes nothing about how people work with the system. Below is the starting layout we bring in, then adapt to your systems and roles.

The evidence column is the one that matters later. It answers the question that arrives months after the training: what will you show to prove that this person received a programme matched to their role.

What training does not cover

Article 4 is one obligation among many and on its own it makes no system compliant. We say so plainly, because the usual problem after training is not missing knowledge, it is overestimating what the training covered.

• Training does not replace an inventory or a risk classification of AI systems: that is separate work with a separate artifact
• Training does not produce the technical documentation required for high-risk systems
• A training certificate is not a declaration of conformity and must not be presented as one in questionnaires or tenders
• Training does not discharge human oversight: oversight is an architectural requirement with a named owner, not a state of mind
• The legal reading of the article, and what it means for your situation, is signed by counsel, not by us

How this reads outside Poland

Article 4 comes from the Regulation, so it applies across the Union in the same wording. What differs country by country is the national supervision layer and the funding attached to training.

In Poland, market surveillance sits with the Commission for the Development and Security of Artificial Intelligence, established by the Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026 item 1003). The Act entered into force on 11 August 2026; Articles 8-18 and Chapters 3-5, 8 and 9, which carry the inspection regime and the penalties, enter into force on 28 October 2026.

Public training money in Poland also runs on its own rules: since 1 January 2026, training funded by labour offices and the National Training Fund is delivered by providers listed in the Baza Usług Rozwojowych register, and Priority 3 of the 2026 National Training Fund names AI explicitly, though it is aimed at new processes, technologies and work tools in companies, particularly where those factors threaten jobs. If your Polish entity intends to co-fund the training, that path has to be settled before dates are fixed, and we settle it with you.

For a group operating in several member states, the practical answer is one role map and one evidence format, with local annexes where a national regulator or a funding body asks for something extra.

Where this goes wrong, and what we do about it.

1. 1
   The training happened, the evidence did not

   One webinar goes out to everyone, the attendee list stays inside the meeting tool, the recording lands on a shared drive. Six months later a customer security questionnaire asks who was trained, on what programme and when. Nobody can reconstruct a named list or show that the scope matched the role, so the answer becomes "we run training", which in a questionnaire counts for nothing.

   What we do about it

   We start from the list of people who touch AI systems and diff it against the list of people trained, so you see the gaps as named individuals before the first session. After each group we issue a dated register, the per-role programme and named certificates, and we confirm outcomes with a test and a practical exercise rather than with attendance. Register completeness is checked again when the project closes.

   What stays with you: dated register of trained people, per-role programme and a validation record of learning outcomes
2. 2
   One programme for everyone

   A generic "AI for business" course is bought once and pushed through the whole organization, because that is cheaper and easier to account for. Engineers get an hour on what a language model is, and the person who approves or rejects cases on that system never sees a single example from their own screen. The box is ticked, daily practice does not move, and the first questionable output finds nobody who knows what to do with it.

   What we do about it

   We map roles to the level of understanding each one needs and build a separate programme per group, on material taken from your systems rather than from slides. The starting level is checked with a short test before the session, the result with a practical exercise in your environment. A group that lands below the threshold repeats the module, not the course.

   What stays with you: role map with an assigned level, and a dated programme per role
3. 3
   Training misses the AI nobody registered as AI

   Scope is set around the tool the company adopted deliberately, a coding assistant or an internal chat. Left outside are the AI features built into software bought years ago: summaries in the ticketing system, candidate ranking in the recruitment platform, drafted replies in support. Those are exactly where deployer duties sit, and people use them daily without ever calling them AI.

   What we do about it

   Before the programme is fixed we run a short inventory of actual use: the application list from SSO sign-ins, a direct question to vendors about features added in updates, and a survey inside teams. What we find enters the training scope, and what falls outside training goes onto a list of systems to classify, handed over as a separate result.

   What stays with you: list of tools with AI features in real use, marked for what enters the programme
4. 4
   Scope written around a funding deadline instead of around roles

   A funding body's calendar sets the date, so the scope bends towards whatever can be accounted for inside that window rather than towards who needs what. The paperwork is then assembled after the fact, from memory, and that is when a missing signature, a missing outcome record or a mismatch between the declared and delivered programme shows up.

   What we do about it

   We build the programme around roles first and only then look for a window, not the other way round. Documentation is produced alongside the sessions: attendance, the validation record of learning outcomes and the certificates are finished on the day the training runs. Before anything is submitted we check the pack against the funder's requirements.

   What stays with you: complete funding pack closed on the last day of training
5. 5
   A certificate mistaken for conformity

   After the training somebody writes, in good faith, that the company is AI Act compliant, in a customer questionnaire or a tender response. A training certificate says nothing about system classification, technical documentation or oversight, so the mismatch surfaces during the first serious due diligence, which is the worst possible moment: mid transaction or mid procurement.

   What we do about it

   The materials and the register state plainly what the training covers and what it does not. On top of that we issue a one-page scope note written in the language of a customer questionnaire, so the person filling in the form has a true sentence ready instead of improvising one. The note is reviewed with your legal team before it is issued.

   What stays with you: one-page scope note for questionnaires and tenders, reviewed by your legal team

What stays with you.

• Register of trained people: name, role, date, programme, validation result
• Role map with the level of AI understanding required for each role
• Per-role training programme, dated and scoped, ready to show on request
• Validation record of learning outcomes: knowledge test plus a practical exercise on your system
• Named certificates of participation
• List of tools with AI features in real use, split into training scope and classification backlog
• Scope note stating what the training covers and what it does not, for use in questionnaires
• Complete funding documentation where public money pays for the training

How we work.

1. 1
   1. Role map and inventory of actual use

   We establish who touches AI systems and in what role, and which tools people actually use, including AI features built into software bought earlier.

   Week 1
2. 2
   2. Per-role programme and funding path

   We build a separate programme per group on material from your systems. In parallel we settle whether and how the training is to be co-funded, and what that means for dates and paperwork.

   Week 1-2
3. 3
   3. Delivery

   Sessions run per group, each on its own programme. Operational and engineering groups work in your environment, not on slide examples.

   Week 2-4, depending on the number of groups
4. 4
   4. Validation and evidence pack

   Outcomes are confirmed with a test and a practical exercise; we issue the register, the validation record and the certificates, and close the funding documentation.

   Week 4
5. 5
   5. Review

   We return after a systems change or after a year: the role map is updated, new people and new tools are added, and the programme is refreshed where scope moved.

   Every 12 months or after a material change

The rest of this cluster.

Where this turns into a service.

What this page is, and what it is not.

We are an engineering and training team, not a law firm. This page describes how to perform the obligation and how to evidence it, not how the article should be read for your situation. The legal reading and any assessment of liability are signed by counsel: yours, or our legal partner. Dates and instrument numbers are published together with their sources so you can verify them without asking us for an opinion.

Where the dates and numbers come from.

• Regulation (EU) 2024/1689 (AI Act), consolidated text on EUR-Lex
• Polish Ministry of Digital Affairs: what changed in the AI Act on 2 August 2026
• Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026 item 1003)
• Baza Usług Rozwojowych replaces the training institution register from 2026
• FERS 1.3 call: automation competences for digital transformation
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), text on EUR-Lex
• 2026 National Training Fund priorities set by the minister for labour