One Rule Explained: AI Literacy
EU Act Article 4
“We meant to” won’t hold up in an audit.
There’s a rule in the EU AI Act that’s easy to skim past because it doesn’t sound like a rule. Article 4 requires “AI literacy.” Supervision and enforcement kick in on August 2, and it doesn’t get a lot of press compared to the high-risk stuff.
Here’s what it actually means.
If your organization uses AI in the EU, in any capacity, you have to take steps so the people using it (staff, plus contractors and vendors acting on your behalf) actually understand what the tool does, what it gets wrong, and what harm it could cause. This isn’t limited to high-risk systems. A marketing team using a chatbot counts. A support desk using a copilot counts.
The tricky part is that the law doesn’t say how. No mandated training hours, no certification body, no requirement to hire an AI compliance officer. Just “to their best extent.” That flexibility sounds convenient until you realize it hands regulators discretion to judge your effort after something’s already gone wrong, not before.
Worth documenting whatever training you’re doing now. “We meant to” won’t hold up in an audit.