EU AI Act Article 4: what L&D actually has to do

Who this is for

This is for the L&D, HR, risk, or transformation lead who has been asked, often with little notice, to evidence workforce AI literacy. Legal has usually already confirmed that the organisation deploys AI systems. Someone then forwards Article 4 and asks for a plan. The useful answer is not a slide titled "we are compliant." It is a record of who was trained, on what, to what standard, and how that maps to the work they actually do.

Experrt trains those cohorts live. This note is the briefing we would rather a sponsor read before they buy anything, including from us.

The business problem

Most organisations can show that they bought AI tools. Fewer can show that the people using those tools were trained in a way that matches their role and the risk of the work. That gap is now an L&D problem with a legal overlay, not a learning-design preference.

McKinsey reported in 2025 that 88% of organisations use AI in at least one function, while only about a third have scaled past pilots. The Conference Board reported in 2026 that only 33% of workers received employer AI training in the last six months. TalentLMS reported in 2025 that 49% of workers say AI is moving faster than their company's training. Those figures describe a workforce that is already using the tools, often without a shared standard for what good use looks like.

L&D is then asked to close that gap with a generic e-learn, a lunchtime webinar, or a vendor certificate. None of those automatically satisfy Article 4. They may still be useful. They are not the same thing as measures supporting literacy among staff, and they rarely produce a record an auditor can read.

Why this is live now

Article 4 of the EU AI Act requires providers and deployers to take measures supporting AI literacy among staff. National market surveillance authorities began supervising on 2 August 2026. That date is why this landed on L&D desks this month rather than remaining a 2025 planning item.

Be precise about what the article does and does not say. It requires measures supporting literacy. It does not require a certificate. It does not name a course. It does not say that completing a vendor module makes an organisation compliant. A single generic programme for every role is a weak reading of "supporting literacy," because literacy for a claims handler is not the same as literacy for a model owner or a line manager who approves AI-assisted work.

If legal counsel is already involved, they will want to know what you can produce when a market surveillance authority, an internal audit, or a customer security questionnaire asks what measures you took. "We rolled out Copilot" is not an answer. "We bought 400 licences for a MOOC" is not much better. "These roles completed this facilitated training, attendance was taken, work was graded, and here is the export" is the shape of an answer.

What good looks like

A workable Article 4 programme has four parts. Miss one and the others become decoration.

1. Scope by role and risk, not by headcount. Decide who deploys or uses AI in a way that can affect customers, staff, or regulated decisions. A receptionist who summarises meeting notes and a credit analyst who uses a model output in a lending file do not need the same measures. World Economic Forum reporting in 2025 found that 63% of employers name skill gaps as the top barrier to transformation. Treating the whole workforce as one audience is how those gaps survive a training budget.

2. Train against the work, not against a product demo. Staff need to know what may go into a tool, when a person must review the output, and how to record that AI was involved. That is literacy in the sense Article 4 is pointing at: the ability to use the systems the organisation has actually deployed, with judgement. Responsible AI Use at Work is the course Experrt runs for that daily judgement. It is delivered against the organisation's own policy, not a generic acceptable-use poster.

3. Keep a record as the training runs. Attendance per session, submissions against the modules, facilitator credentials, and a grade or observed outcome. A certificate of attendance without those fields is a badge. A dated export that names the cohort, the course, the dates, and the people is a measure you can describe. Sponsoring an AI Literacy Programme is the session for the executive or senior L&D lead who has to commission that work and answer for it later.

4. Do not overclaim. You can say you took measures supporting literacy for the roles you trained. You cannot say the organisation is "Article 4 certified" because no such certificate exists in the article. You cannot point at one two-hour webinar and call the duty discharged for every deployer role. Precision here protects L&D when a later review asks what the slides meant.

McKinsey has also reported that only 39% of organisations see any EBIT impact from AI, and that leaders with highly AI-fluent teams are 3.9 times more likely to capture enterprise value. Literacy is not only a legal hygiene task. It is the difference between licences that sit unused and teams that can use the tools without creating avoidable errors. Article 4 is the floor. Fluency is the reason the training should still be good.

What to insist on when you buy

If you are commissioning this rather than building it internally, write the following into the brief before anyone quotes.

• A named mapping from roles to courses, not one course for the whole company.
• Live facilitation, because literacy includes asking a question about a real file, not only watching a video.
• Attendance, submissions, and grades held by the organisation, not trapped in a vendor portal.
• An export you can file: who, what, when, by whom.
• A written limit on what the programme claims. If a vendor's proposal says "EU AI Act compliant training," send it back.

Experrt will not tell you that a course makes you compliant. We will run the cohorts, take the register, grade the work, and give you the pack. That is the product.

What to do this quarter

Start with the roles that already use AI on customer or regulated work. Assess them if you have not, so the training answers a measured gap. Book a literacy cohort for those roles and a sponsor session for the people who will have to describe the measures later. Put the export location in the same folder as the AI policy, not in someone's inbox.

If you need a conversation about scope, dates, and what the record should contain, contact Experrt. Bring the list of roles and the tools they already use. That is enough to start.