Start from the systems, not the syllabus. List every AI system you provide or use and every person who operates or oversees one, including contractors. Group those people into tiers by what they do, train each tier for that work in its own context, and keep a record of who learned what, when, and how it was tested.
What does Article 4 ask for?
Article 4 of the EU AI Act asks providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others who operate or use AI systems on their behalf. "Sufficient" is judged against the people's technical knowledge, experience, education and training, and the context in which the systems are used, including the people affected by them.
Three points follow. It is a duty on the organisation, not on individuals. It covers people acting on the organisation's behalf, so contractors and outsourced teams are in scope. And it is context-dependent: a claims handler approving an agent's settlements needs different literacy from a board member approving the budget for it. The guide to AI literacy and certification for people who work with agents sets out the wider case.
Who owns the programme?
A named executive owns it, usually the chief risk officer, chief operating officer or whoever answers for AI governance. Learning and development runs delivery. Compliance confirms scope. Business heads own the role-specific content, because only they know what their people actually decide. A programme owned only by learning and development tends to become a course catalogue. One owned by the business tends to become a list of things people must be able to do.
What are the steps?
- Agent, depth 1: produces the inventory from the workspace. Every agent, every capability, its current depth, and who approves its held actions. Systems outside the workspace are added by hand.
- Person (compliance): confirms which systems and people are in scope. Including contractors and any outsourced review teams.
- Person (programme owner): defines the tiers. A workable set: everyone who uses or is affected by an AI system; people who review and approve agent work; people who design and certify agents; people who lead regulated, multi-agent deployments; the board.
- Person (business heads): write what each tier must be able to do. In their own operation. "Explain why the agent held this payment and decide it" is a literacy outcome; "understand AI" is not.
- Person (learning and development): choose delivery for each tier. Short foundations for everyone, practical assessment for reviewers, deeper work for builders and leaders.
- Agent, depth 2: drafts each person's training record. From course completions, test results and certificates, with expiry dates.
- Person (programme owner): reviews coverage quarterly. New starters, role changes, new agents and lapsed certificates.
- Person (board): receives a short coverage report. See why the EU AI Act made AI literacy a board question.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Inventory | Lists agents, capabilities, depths and approvers | 1 | Adding systems outside the workspace |
| Scope | Nothing | n/a | Confirming who is in scope |
| Tiers and outcomes | Nothing | n/a | Defining what each tier must do |
| Delivery | Nothing | n/a | Choosing courses and assessments |
| Training record | Drafts records from completions and certificates | 2 | Confirming accuracy |
| Coverage review | Flags gaps, lapses and new approvers | 1 | Deciding what to do about them |
How should the tiers differ?
Everyone in scope needs to know what the organisation's agents do, what they are not allowed to do, how to recognise a held or refused action, and where to raise a concern. A few hours is usually enough.
Reviewers and approvers need practical skill: reading the record, finding which bound decided, approving or declining with a reason, spotting when a declared fact is standing in for a verified one. This tier needs assessment on real work, not only a quiz. Who exactly falls into it is covered in who needs AI literacy under the EU AI Act.
Builders need to know how agents are qualified and certified, and why depth is earned rather than configured.
Leaders of regulated deployments need to connect literacy to the Act's other duties, such as human oversight under Article 14 and the deployer obligations in Article 26.
For the content of each tier in more detail, see what an AI literacy programme should cover.
What records should the programme keep?
Records are what show the measures were taken. Keep, per person: their tier, what they completed, how it was tested, the result, any certificate and its expiry, and the systems they are authorised to oversee. Keep, per system: who may approve its held actions and whether each of those people is currently trained.
A useful test is whether you could answer, for any approved action in the record, "was the person who approved this trained for it at the time?" If you can, the programme is working.
What usually goes wrong?
One course for everyone. A single e-learning module satisfies nobody. It is too long for the board and too shallow for reviewers.
Contractors left out. Outsourced review teams often approve the most agent actions and receive the least training.
Records with no expiry. Product versions change, agents gain capabilities, people forget. A completion record from long ago says little about today.
Sector context ignored. A bank's reviewers face different holds from a payment institution's; see the sector pieces on Article 4 for agents in banking and in payments.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy maps to these tiers: Foundations for anyone, Operator for reviewers, Builder for those who design agents, Architect for leaders of regulated deployments. Tests are set in the learner's industry and role. For teams, an admin view shows progress, results, certificates and expiry dates, which gives the programme its records. A free readiness assessment for teams of up to 25 people shows the gaps by concept.
Questions people ask
Does Article 4 require a certificate?
It requires measures to ensure sufficient literacy, not a particular certificate. A certificate that can be checked at source and that lapses is one strong form of evidence that the measures were taken and tested.
How often should training be refreshed?
Whenever the systems or the role change materially, and on a fixed cycle otherwise. A yearly cycle suits reviewers, since agents and their bounds change within that time; foundations material should be refreshed when the product it describes changes.
Do we need literacy measures if we only use, and do not build, AI systems?
Yes. Article 4 applies to deployers as well as providers. Using agents in your operation is enough to bring your staff into scope.