The EU AI Act and mandatory AI training: what employers need to know
Article 4 of the EU AI Act requires employers to ensure 'AI literacy' among their staff. What does that mean in practice?
Since 2 February 2025, Article 4 of the EU AI Act has been in force: employers are required to ensure that staff working with AI systems are "sufficiently AI literate". A lot of organisations ask us the same thing: "What does that actually mean — and do we now have to buy in training?"
Here is what you need to know, without the legal jargon.
What does Article 4 actually say?
"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf."
In plain language: if your employees use AI tools for their work — and that includes ChatGPT, Copilot, Gemini and Claude — you as the employer are responsible for making sure they are literate in using them.
What counts as 'sufficiently AI literate'?
The law deliberately leaves this open, but the Commission and regulators work with a rough guideline:
- An understanding of what AI is and how it works. In broad strokes — no technical depth required.
- A sense of what AI can and can't do. Including where it gets things wrong.
- Awareness of the risks. Privacy, bias, hallucinations, intellectual property.
- Knowledge of responsible use within your own organisation. Which tools are allowed, which aren't, and for what data.
For high-risk AI applications — recruitment, credit decisions, medical diagnosis — the requirements are stricter and more specific.
Are you obliged to buy in training?
Formally, no: the law doesn't prescribe a specific course. What you do have to do is be able to demonstrate that you took reasonable measures. That can be through:
- Internal training, if you have it
- External workshops, such as ours
- E-learning modules
- Clear internal guidelines and support
What definitely doesn't count: 'we sent round an email'.
The pragmatic minimum we'd advise
For most small and mid-sized organisations in the Netherlands, this is a workable route:
1. An AI literacy session for everyone (1–2 hours)
Basic understanding, the risks, and your internal ground rules. Our AI Inspiration Session covers this.
2. Deeper training for people who work with AI regularly (3–4 hours)
Think marketing, HR and customer service. Our Prompt Engineering Sprint is built for this.
3. Internal guidelines and someone to ask
Who may use which tool, what are your privacy agreements, and who do people go to with questions?
4. Documentation
Keep a record of who followed which training and when, who read what, and which guidelines exist. That record is your defence if a question ever comes.
What you can do today
- Make a list of the AI tools people in your organisation already use, shadow use included
- Write a simple internal guideline ('which data is and isn't allowed', 'which tools are approved')
- Put an AI literacy session in the calendar for the next quarter
How we help
Together, our AI workshops cover the core of Article 4. On request we can document which topics were covered during your day — useful for your compliance file.
Book an intake and we'll talk through which route suits your organisation.
This article is general information, not legal advice. For high-risk AI applications we'd recommend consulting a lawyer with AI expertise.