AI Literacy 2026
From the Article 4 obligation to suitable measures and internal records. Based on the amended legal text and Dutch DPA guidance.
1. Executive summary
Article 4 has applied since 2 February 2025. Since 27 July 2026, providers and deployers must take measures to support the development of AI literacy among staff and other persons operating and using AI systems on their behalf. The law does not require a specific individual level, standard course or certificate.
The Dutch Data Protection Authority published guidance in March 2025 with four practical steps: identify, set goals, execute and evaluate. This method can help organisations review their approach periodically.
This handbook translates the legal obligation into a workable plan. It includes a role matrix, a 12-month implementation plan, practical indicators and an internal review checklist.
- Compliance officers and legal advisors responsible for Article 4 compliance
- HR and learning managers tasked with setting up training programmes
- Board members and executives ultimately accountable for AI governance
- IT managers who manage and procure AI systems
2. The legal context
The EU AI Act introduced AI literacy as one of its first obligations. Regulation (EU) 2026/1744 amended Article 4 with effect from 27 July 2026.
Article 4: key points
Enforcement timeline
Article 4 has no separate fixed fine amount. From August 2026, national market surveillance authorities may apply proportionate sanctions or other enforcement measures under national law and based on the circumstances of the case.
3. Practical model from Dutch DPA guidance
The Dutch DPA provided a practical model. The guidance "Getting started with AI literacy" from March 2025 describes a four-step cycle that organisations can use for their own approach.
Map which AI systems are in use, by whom, for what purpose. Including shadow AI and procured tools with AI components. Without this inventory, targeted training is impossible.
Define suitable learning goals and measures per role group. An end user has a different context from a compliance officer or executive. Record the rationale in competence profiles.
Develop and deliver training that matches the established goals. Combine methods: e-learning for foundational knowledge, workshops for depth, practical exercises with your own AI tools. Document participation and results.
Review whether measures still fit roles, systems and risks. Assessments, practical tests and feedback can help. Article 4 does not prescribe a fixed refresh interval.
Source: AP guidance "Getting started with AI literacy", March 2025.
Key point: a certificate is not the legal finish line. A periodically reviewed approach with roles, measures and internal records makes decisions easier to explain.
4. Role matrix: who needs to know what?
Article 4 does not require a specific individual level. Measures should still fit the role and context. The matrix below offers a starting point for competence profiles per role group.
- AI Act essentials and liability
- Risk appetite and governance structure
- Fine exposure and reputational risk
- Decision-making on AI investments
- In-depth article knowledge (Art. 4, 9, 14, 26, 50)
- FRIA and DPIA execution
- Incident reporting and escalation
- Interaction with supervisory authorities
- Establishing competence profiles
- Training plan and administration
- Certificate management and progress monitoring
- Shadow AI policy and onboarding
- AI system inventory and classification
- Data quality and bias monitoring
- Model governance and version management
- Vendor assurance and SLA monitoring
- Correct use of AI tools
- Output verification and bias recognition
- Generative AI do's and don'ts
- When and how to escalate
- Provider vs deployer roles
- Art. 50 transparency in contracts
- Audit rights and vendor declarations
- Identifying AI components in SaaS
5. The 12-month implementation plan
This plan distributes implementation across four quarters. Each quarter builds on the previous, from inventory to review and internal records.
Inventory and baseline
- AI register of all systems in use
- Role matrix: who uses what, with what impact
- Baseline AI literacy measurement per team
- Gap analysis: current knowledge and suitable learning goals per role
Goals and policy
- AI literacy plan adopted by board
- Competence profiles per role group
- Policy on shadow AI, procurement and generative AI
- Ownership and governance: who monitors this plan?
Roll out training at scale
- Role-targeted training modules rolled out
- Sector and function-specific case studies
- Progress monitoring via dashboard or registration
- Interim assessments per employee
Evaluate and embed
- Review whether measures still fit role and context
- Internal overview: who, what, when and follow-up
- Evaluation report for the board
- Embed in onboarding and periodic updates
A structured training platform can save time during Q3 and Q4. Modules, assessments, certificates as supporting records and reports can support delivery. A platform is not a legal requirement.
6. Measuring and documenting
Article 4 prescribes no fixed evidence format. The European Commission says organisations can keep internal records of training and other guiding initiatives. The indicators below are practical choices, not a statutory minimum set.
Quantitative indicators
- Completion rate per role and department
- Assessment scores and improvement trends
- Time-to-competency for new employees
- Number of AI incidents reported (increase may indicate better awareness)
- Reduction in AI-related policy violations
Possible internal records
- Training programme design document with learning objectives
- Participation records with dates and completion status
- Assessment and exam results per employee
- Certificate records with timestamps
- Update log: how the programme adapted to new developments
- Evidence of board involvement and resource allocation
7. Common mistakes
Based on DPA guidance and practical experience, these are the five most common pitfalls:
A workshop may be too limited when roles, systems or risks change. Plan a suitable review and adjustment cycle.
The proportionality principle exists for a reason. A developer needs different knowledge than a receptionist. Uniform training wastes resources and fails to build real competence.
Consider all relevant persons operating and using AI systems on the organisation's behalf. Depending on actual use, this may include management, HR, legal, procurement and customer-facing roles.
Internal records help explain which measures were taken and why they fit the context. A standalone certificate does not provide that broader rationale.
Other persons operating and using AI systems on the organisation's behalf may also be covered. Look at the actual task and AI use.
8. Internal Article 4 checklist
Use this checklist for an internal review of your Article 4 approach. It is a practical set, not a legally required checklist.
Inventory
- All AI systems inventoried (including SaaS with AI features)
- Per system documented: purpose, users, data, impact on affected people
- Shadow AI policy established and communicated
Competence profiles
- Suitable learning goals and measures established per role group
- Competence profiles approved by management
- Profiles linked to job descriptions
Training
- Training programme designed per role group
- Multiple learning methods deployed (e-learning, workshop, practical)
- Relevant employees are linked to suitable measures
- External persons using AI on the organisation's behalf are considered
Assessment and certification
- Assessments conducted per employee
- Results recorded with timestamps
- Certificates or completion records available
- Open knowledge gaps and suitable follow-up are recorded
Governance and embedding
- AI literacy plan adopted by board
- Programme owner appointed
- Evaluation cycle established (minimum annually)
- Programme embedded in HR onboarding
- Update process established for new AI systems and regulations
9. Next step
This handbook provides the framework. The next step is execution. Start with the Q1 inventory — without a clear picture of your AI landscape, targeted action is impossible.
For organisations looking to accelerate execution, LearnWize offers a ready-made training environment aligned with the four-step model in this handbook. With role-targeted modules, sector-specific case studies, a progress dashboard and per-employee certification.
About Praxikon
Praxikon is the leading knowledge platform for the EU AI Act. We publish analyses, practical guides and tools that help organisations implement responsible AI. Our work is based on official EU legislation, DPA guidelines and practical experience.
LearnWize is a practical environment for role-based AI literacy with modules, assessments, records and certificates as supporting evidence.
Sources
- Regulation (EU) 2026/1744, amended Article 4European Union
- AI Literacy, Questions & AnswersEuropean Commission
- Regulation (EU) 2024/1689 — EU AI ActEuropean Parliament & Council
- Getting started with AI literacy (guidance)Dutch Data Protection Authority
- AI Impact Barometer / RAN-6 reportDutch Data Protection Authority
- AI Act — Regulatory framework for AIEuropean Commission
- Public Consultation Implementation Act AI RegulationDigital Government NL