Article 4 AI Act requires appropriate measures, not a

You must now document, for each role and AI system your organisation uses, which competencies that role requires and confirm those competencies are present. A uniform certificate or general training course alone will not satisfy Article 4 of the AI Act.

The prompt is an analysis of 12 November 2026 of context- and risk-driven literacy measures under Article 4 of the AI Act, which argues that the European Commission has confirmed the requirement is tailored knowledge tied to role and system, not a standardised qualification. The analysis draws on the Commission's updated guidance on AI literacy obligations. In our assessment, this shifts the compliance burden from proving participation in training to proving that you have identified which competencies each role needs for each system and that those competencies are present.

What does Article 4 actually require?

Article 4 of the AI Act obliges both providers and deployers of AI systems to take measures that support AI literacy among staff and others who operate or use those systems. The obligation is not to achieve a uniform knowledge level across the organisation. Instead, you must tailor measures to the technical knowledge, experience, education and training already present in each role, the context in which the system is used, and the groups of people the system affects. The European Commission's guidance makes clear that a certificate or specific knowledge measurement is not mandatory, and that organisations may keep internal records of training or other support rather than producing external credentials.

Why is a general training course not enough?

A general AI course proves attendance; it does not prove that an employee can assess AI output in their own work, recognise errors, or know when to escalate a decision to a human reviewer. Academic research on task-oriented assessment of AI literacy shows that common, general measurement instruments align poorly with real decision-making in specific professions. A lawyer or doctor holding a generic AI certificate has not necessarily demonstrated the ability to spot a fabricated source or a hallucinated case reference in their own files. The compliance question is therefore not whether your organisation has run training, but whether the training you have chosen demonstrates competence in the actual work the person does.

What must you document to show compliance?

• Role-to-system mapping — record which roles work with which AI systems and what competencies each role needs for each system.
• Competency assessment — document how you have confirmed that the required competencies are present in each role, whether through training, prior experience, or other means.
• Context alignment — show how your literacy measures take account of the technical knowledge, experience and training already present, and the specific context in which each system is used.
• Review triggers — identify when changes to a model, supplier or work process require a review of whether existing competencies remain adequate.
• Feedback and escalation — establish channels where staff can report doubts about AI output or decisions without fear of consequences, and link human oversight of AI advice to measurable role responsibilities.

What concrete controls should you put in place?

1. Document each AI system and its purpose — record which model each workflow uses, the lawful basis for the data it processes, and which roles interact with it.
2. Define competency requirements per role — specify which AI-related capabilities each role must have: error recognition, output evaluation, escalation judgment, or tool operation.
3. Assess and record competency — confirm through training, scenario-based assessment, or documented prior experience that each role holds the competencies you have defined.
4. Build in scenario-based assessment — use examples from the person's own profession rather than abstract knowledge tests; for example, ask a clinician to spot a fabricated reference or a financial analyst to identify a plausible but false calculation.
5. Review competency when systems change — trigger a reassessment when the model, supplier or context of use changes materially, and update your records.
6. Maintain an escalation channel — document how staff can raise concerns about AI output or decisions, and how those concerns are handled.

What role does tooling play in this?

Software can help you track which roles have completed which training, flag when a system has changed and a review is due, and store records of competency assessments. What tooling cannot do is determine which competencies matter for your specific roles and systems, judge whether a person's understanding is adequate for their work, or decide when a change in context is material enough to require reassessment. Those judgements remain yours. The Commission provides the framework; you must work out how to apply it to your own organisation and be ready to explain that reasoning to a regulator.