AI literacy for employees: what companies need after EU AI Act Article 4

Article 4 of the EU AI Act concerns AI literacy for people who use AI systems in a company context. For organizations using ChatGPT, Copilot, Gemini or other AI tools in daily work, this is a practical management issue.

It does not create a universal mandatory certificate. It does not mean a simple course guarantees legal compliance. It does mean AI use can no longer remain only informal experimentation.

If people use AI on behalf of the company, the company needs reasonable measures that help them understand responsible use, limits, risks and verification.

The Unlearning School treats AI literacy as part of AI adoption. Not as a decorative certificate. Not as a legal scare tactic. As practical preparation for real work: roles, tasks, rules, checks and documented evidence.

What AI literacy means inside a company

AI literacy does not mean every employee becomes an AI expert. Most business teams do not need model architecture, mathematics or coding.

An employee needs to know:

• what AI can help with in their role;
• what AI does poorly;
• which data should not be entered;
• how to provide context;
• how to check an output;
• when AI can create a first draft;
• when human validation is required;
• when AI should not be used;
• how AI use should be documented;
• who remains responsible for the final result.

That is applied AI literacy. It is not theory. It is not a certificate stored in a folder.

For a company, AI literacy becomes useful only when connected to real work. HR has different risks than sales. Sales has different examples than operations. Customer support has different pressures than management. That is why training should be role-based.

Why Article 4 matters for companies already using AI

Many companies think the AI problem starts only when they buy an official tool. In reality, AI use may already exist through employees using public tools or personal accounts for work.

That creates a gap. The company thinks it is still observing, but employees are already using AI. Someone may summarize internal documents. Someone may draft customer emails. Someone may use AI for hiring material, research, reporting or internal communication.

If there are no rules, every person decides alone. That is not adoption. It is shadow AI.

Article 4 matters because it pushes companies to treat employee preparation as part of responsible AI use. It is not enough to have the tool. It is not enough to tell people to be careful. Concrete measures are needed.

Those measures can include training, guidance, internal rules, role-based examples, human review protocols, attendance records and materials employees can use after the session.

What Article 4 does not mean

It is important not to exaggerate.

Article 4 is about AI literacy. It is not high-risk system certification. It does not define one standard certificate for every employee. It does not say a vendor training guarantees legal compliance. It does not turn every workshop into legal protection.

A serious company should clarify these limits before buying a program.

A good program can:

• provide documented training;
• explain responsible use by role;
• define internal rules;
• show tool limits;
• create examples on real tasks;
• introduce human verification;
• produce materials that can be kept as operational evidence.

It cannot promise guaranteed legal compliance, complete risk removal or a transfer of responsibility from the company to the vendor.

That clarity builds trust. Serious buyers do not need magical promises. They need a provider that understands the difference between training, compliance and operations.

What an AI Literacy File can contain

AI literacy should leave traces. It is not enough for people to attend a session and say it was interesting.

A practical AI Literacy File can include five layers.

1. Role-based competency matrix

The company should know what level of AI literacy each role needs. A manager who approves work has different responsibilities than a junior using AI for drafts. HR handles sensitive data. Sales handles commercial promises. Support can influence customer experience.

The matrix shows what each role category needs to understand.

2. Active task delegation register

This register defines which tasks can use AI, which tasks require verification and which tasks should not be delegated.

Examples:

• first draft of an internal email, allowed;
• synthesis of a public document, allowed with verification;
• personal candidate data in a public tool, not allowed;
• draft of a commercial offer, allowed with commercial validation;
• final decision about people, not delegated to AI.

The register reduces improvisation.

3. Human-in-the-loop protocol

AI literacy does not mean blind trust in AI. It means knowing how to check.

The protocol sets simple steps: verify facts, compare with source material, look for invented details, check sensitive data, require human review for external outputs and mark uncertainty.

4. Data confidentiality work standards

Employees need clear examples of what data can and cannot be entered into AI tools.

"Protect data" is too abstract. People need concrete rules:

• do not enter candidate personal data into public tools;
• do not upload confidential contracts without approval;
• do not enter client lists;
• do not copy sensitive financial information;
• anonymize data before processing;
• use company-approved tools.

5. Practical performance proof

The company should show that people worked on real tasks, not only theory.

Evidence can include before and after examples, role-based prompts, verification checklists, internal templates, attendance reports, structured feedback and simple time or quality observations.

This is where AI literacy connects with adoption.

How employee AI literacy training should look

A useful program should be short, clear and applied.

Recommended structure:

1. What Article 4 asks for and what it does not ask for.
2. What AI literacy means for the company.
3. Which tools employees already use.
4. Which risks appear in daily work.
5. Which tasks fit AI.
6. Which data should not be entered.
7. How outputs should be checked.
8. How rules differ by role.
9. What internal guidance remains after training.
10. How progress is measured.

Participants should work on examples, not only listen.

An HR employee can work on a job description with bias checks and data rules. A sales person can work on an email with checks for promises and accuracy. A manager can work on a decision draft with clear limits around AI.

Why HR, IT, Legal and Operations need to work together

AI literacy is not only an HR issue.

HR can organize training and documentation. IT can clarify approved tools, access and technical risk. Legal can validate rules and limits. Operations can identify where AI creates value in real tasks. Managers can support the change inside teams.

If AI literacy remains only an HR course, it will be treated as an administrative obligation. If it is connected to work, it becomes an adoption instrument.

This matters especially in companies where AI already entered informally. People do not wait for the perfect policy. They use what is available. The company needs simple rules that can catch up with reality.

Frequently asked questions

Does Article 4 require mandatory training?

Article 4 requires companies using AI to take measures for sufficient AI literacy. It does not define a universal mandatory certificate. Training is one practical measure, especially when it is role-based and documented.

Does training guarantee legal compliance?

No. Training is not legal advice and does not guarantee legal compliance. It can produce documented measures and evidence of employee preparation.

Who should be trained?

Personnel and other people using AI on behalf of the company, based on role, exposure and task type. Not everyone needs the same level.

What documents remain after training?

Documents may include a role competency matrix, task register, human-in-the-loop protocol, data rules and practical examples.

Is a webinar enough?

For awareness, it can be a start. For applied AI literacy, it is weak. Companies need role-based examples, rules and documentation.

Next step

The next step is not buying a generic AI literacy course. The better first step is to check which measures are missing and what should go into the company’s AI Literacy File.

Useful next pages:

• AI training for companies
• ChatGPT for companies
• AI training for managers

Conclusion

AI literacy is not a trend and not only a legal topic. It is the base for responsible AI use in daily work.

Companies that treat Article 4 as a box to tick will buy certificates and keep the same risks. Companies that treat it as an adoption opportunity will build rules, practices and useful evidence.

The Unlearning School works at that level: people, roles, tasks, verification and documentation.