AI Act Article 4
AI literacy: what Article 4 asks of you, and a template for it
Article 4 of the EU AI Act expects every employer that uses AI to make sure its people understand what they are working with. It is not an exam and not a certificate: it is a duty of care that has to be documented. Here is the essence in three minutes, and a template you can fill in today.
What the obligation is
Under Article 4, providers and deployers of AI systems must ensure a sufficient level of AI literacy among their staff: understanding what the tool is good and bad at, what its risks are, and when a person has to decide. Since the Digital Omnibus this is explicitly an obligation of means: it asks for reasonable, proportionate and documented steps, not a particular outcome.
Who it applies to, from when
Every company that uses AI at work, with no size threshold and no SME exemption: the six-person agency as much as the corporation. The rule has applied since February 2025; from August 2026 market-surveillance authorities can check and sanction it.
What you need to be able to show
According to the European Commission’s Q&A on AI literacy there is no prescribed form; the company decides what is proportionate. The Dutch data-protection authority’s guide (Autoriteit Persoonsgegevens: Building AI literacy, 2025) suggests four steps: 1. an inventory of where and for what you use AI; 2. goals and risks; 3. training and house rules; 4. regular evaluation. All of it in writing, dated, with an owner.
How we do it in Stafeta
The Scan’s task inventory doubles as the Article 4 inventory, and the platform itself keeps track of who works with which agent and what training they received. The template below is the manual version of the same thing.
The record template
Seven columns, one row per AI system or use case. Copy the table into a Google Sheet (the button puts it on the clipboard) or download it as CSV. The three example rows belong to a six-person events company; overwrite them.
| System | Purpose | Who uses it | Risk | Training given | Date | Owner |
|---|---|---|---|---|---|---|
| Claude (Stafeta mail-triage agent) | Labelling incoming email, reply drafts | Office, 3 people | Low: every outgoing email is approved by a person; personal data in emails | Stafeta System, approver workshop (2 h) | 2026-11-24 | Managing director |
| Canva Magic Write | Social post copy drafts | Marketing, 1 person | Low: public content, finalised by hand | Internal demo (1 h) | 2026-10-15 | Head of marketing |
| ChatGPT (free, personal account) | Translation, brainstorming | Anyone | Medium: no client data may be pasted in; house rule 2 | House-rules training (30 min) | 2026-11-10 | Managing director |
UTF-8, comma-separated; Google Sheets and Excel open it.
Sources
- European Commission: Q&A on AI literacy (AI Act, Article 4)
- Autoriteit Persoonsgegevens: Building AI literacy (October 2025)
- AI Act (EU 2024/1689) Article 4, as amended by the Digital Omnibus (2026/1744)