Staff, and anyone else who deals with the operation and use of AI systems on the organisation's behalf. Article 4 of the EU AI Act places the duty on both providers and deployers, so it reaches employees, contractors, temporary workers and outsourced teams who run or use those systems for you. It does not require you to train your customers.
Who is inside the scope?
The obligation follows the work, not the employment contract. Ask one question of each person or group: do they operate or use an AI system for us? If yes, they are in scope.
| Group | In scope? | Why |
|---|---|---|
| Employees who use or review an agent's work | Yes | They deal with the system on the organisation's behalf |
| Employees who build, configure or own agents | Yes, at a deeper level | Their decisions shape what the agent does |
| Contractors and temporary staff working in the queue | Yes | They act on the organisation's behalf, whatever their contract |
| An outsourced team running a process with your agents | Yes | The work is yours even if the people are not |
| Senior managers and the board who approve deployments | Yes | They make decisions about the system's use |
| Customers who interact with the agent | No | They are not acting on your behalf; separate transparency duties apply |
| Staff with no contact with AI systems | Not under this article | Many organisations still give them a short introduction |
The outsourced and contractor rows are the ones organisations miss. If a supplier's staff approve your agent's held actions, their literacy is part of your compliance, so the contract should say how it is evidenced.
How much literacy does each group need?
The Act asks for a sufficient level, taking into account people's knowledge, experience and the context in which the systems are used. That points to a role-based approach rather than one course for all. Someone reading an agent's summary needs less than someone approving its held payments. An AI literacy needs assessment template helps you map each role to a level.
For agents that act, a sensible minimum for anyone in scope covers what the agent may do, what a held, refused or withheld verdict means, where its facts come from, and how to escalate. Reviewers and approvers need applied skill: reading the record, finding which bound decided, and approving, editing or declining with a reason.
Does the sector change who is in scope?
The test is the same everywhere, but the population differs. In retail, store and contact centre staff who handle agent-drafted refunds or promotions are often the largest group; see EU AI Act Article 4 AI literacy for AI agents in retail. In insurance, claims handlers and underwriters approving agent decisions sit alongside actuaries who rely on agent-prepared data; see EU AI Act Article 4 AI literacy for AI agents in insurance. Where an agent supports a high-risk use, such as creditworthiness assessment or life and health insurance pricing, Article 14 human oversight and the deployer duties in Article 26 also bear on who must be competent.
An example: drawing the boundary
Take an EU lender with 300 staff that uses agents to prepare credit files and draft customer letters. Its scope list includes 60 credit and operations staff who review agent output, eight people in the team that builds and owns the agents, the executive committee, and a 15-person outsourced collections team that approves the agent's held payment plans. It excludes facilities and most of HR, though they get a brief introduction.
The outsourced team is the hard case. The lender writes the training level into the outsourcing contract and asks for certificate numbers it can check at source. Whether the Act requires formal training, rather than literacy by other means, is covered in does the EU AI Act require AI literacy training. The practical build is in how to set up an AI literacy programme under the EU AI Act.
What evidence should you keep?
Keep the scope decision itself, with the reasoning for each group; the level required per role; and a record per person of what they completed and when it lapses. Join the training record to approval rights, so you can show that the people approving held actions had the literacy the policy says they need. The guide to AI literacy and certification for people who work with agents sets out the levels.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does Article 4 apply to small organisations?
The article does not carve out small organisations. What is sufficient will reflect the size of the deployment and the risks involved.
Do we need to train staff of our AI supplier?
Their literacy is mainly the supplier's duty as provider. If their people act on your behalf in your processes, write the expectation into the contract.
Is a one-off course enough?
Rarely. Systems, agents and roles change, so literacy needs refreshing when they do, and people moving into review roles need more than they had before.