Artificial intelligence is becoming part of everyday business operations. SaaS companies use AI for customer support, software development, recruitment, data analysis, and product features. As adoption grows, organisations need to understand not only how these systems work but also the risks and responsibilities associated with their use.
Article 4 of the EU AI Act addresses this through AI literacy. It requires providers and deployers of AI systems to take measures to support AI literacy among their staff and other people dealing with the operation and use of AI systems on their behalf.
For businesses, the challenge is turning this requirement into practical guidance that employees can apply in their daily work.
An effective AI literacy program connects the AI systems an organisation uses with the people who interact with them, the risks they may encounter, and the guidance they need.
1. Identify Where Your Organisation Uses AI
Before creating training materials, identify the AI systems used across your organisation.
AI may be embedded in customer relationship management software, recruitment platforms, coding assistants, customer support tools, analytics applications, or internally developed products. Employees may also use generative AI tools independently of formal company workflows.
Start by creating an inventory that records:
- The AI system and its intended purpose
- The department or team using it
- The internal owner responsible for the system
- The people who interact with its outputs
- Known limitations and potential risks
- Existing policies, guidance, and training materials
This inventory helps programme owners understand where AI literacy measures may be needed.
It also provides a foundation for deciding which teams require general AI awareness and which need more specialised guidance.
For a practical starting point, use the AnnexOps AI Literacy Training Checklist. It outlines the key areas organisations should consider when planning and reviewing AI literacy activities.
2. Determine Whether Your Organisation Acts as a Provider or Deployer
The EU AI Act distinguishes between AI providers and deployers. An organisation may occupy either role, or both, depending on the systems involved and the activities it performs.
A provider generally develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, subject to the Act's definitions.
A deployer uses an AI system under its authority, except for personal, non-professional use.
For example, a SaaS company developing and marketing its own AI-powered product may have provider responsibilities. The same company may act as a deployer when its employees use a third-party AI assistant for internal work.
These roles should be assessed in context rather than assigned once to the entire organisation.
Understanding the distinction helps businesses identify relevant responsibilities and design guidance for the people involved.
Read the AnnexOps guide on AI literacy training under Article 4 for more detail on the obligation and what employers should consider.
3. Identify Who Needs AI Literacy Measures
AI literacy should not be limited to employees who develop machine learning models or work directly in AI engineering.
Article 4 also refers to other people dealing with the operation and use of AI systems on behalf of a provider or deployer. The appropriate measures depend on factors such as people's technical knowledge, experience, education, training, and the context in which the systems are used.
Consider the different groups within your organisation:
Everyday AI users: Employees using AI assistants for writing, research, summarisation, or routine tasks may need guidance on verifying outputs, protecting confidential information, and recognising inaccurate or misleading results.
Product and engineering teams: Developers and product managers may need more specialised guidance on system limitations, testing, intended purpose, documentation, and relevant risk controls.
Managers and decision-makers: People relying on AI-generated
recommendations may need to understand the limits of automated outputs, the importance of human judgement, and when concerns should be escalated.
Compliance and legal teams: These teams may need a deeper understanding of AI governance responsibilities, applicable regulatory requirements, and the records used to manage the organisation's AI systems.
These are practical examples rather than fixed categories prescribed by Article 4.
For a closer look at the people who may fall within scope, read Who Needs AI Literacy Training Under the EU AI Act?.
4. Tailor Training to the AI Systems People Use
A general introduction to artificial intelligence can help establish a baseline, but it may not address the risks employees encounter in specific workflows.
Training should reflect how people actually use AI.
For example, employees using generative AI tools may need to understand hallucinations, inaccurate references, bias, data confidentiality, and the need to verify important outputs.
Teams using AI in recruitment or other sensitive business processes may require guidance on the system's intended purpose, relevant limitations, applicable safeguards, and the potential effects on individuals.
Developers integrating third-party models into software may need guidance on model evaluation, system documentation, monitoring, and the risks associated with changes to the underlying technology.
The European Commission's AI literacy guidance highlights the importance of considering the systems involved, people's existing knowledge and experience, and the context in which AI is used.
Organisations should therefore connect their learning measures to real tasks rather than relying exclusively on generic awareness presentations.
5. Choose Appropriate Training Formats
Article 4 does not prescribe one mandatory training format, a universal syllabus, or a minimum number of training hours.
Organisations can choose measures that fit their size, operations, and AI use cases.
Possible approaches include:
- Short workshops using practical AI examples
- Written policies explaining acceptable and unacceptable AI use
- Role-specific learning sessions
- E-learning modules and internal learning resources
- Demonstrations showing how to verify AI-generated outputs
- Team discussions about risks and lessons from real workflows
A smaller business may begin with concise guidance and targeted sessions for employees who use AI regularly. A larger organisation may need different learning paths for technical, managerial, operational, and compliance teams.
The objective is to provide relevant guidance that reflects the people, systems, and circumstances involved.
Organisations should review their approach periodically and update it when their AI tools, workflows, or identified risks change.
6. Record AI Literacy Activities and Review Progress
An AI literacy program needs a practical way to track what the organisation has done and where further work may be needed.
Article 4 does not prescribe a specific documentation template or require a universal AI literacy certificate. However, maintaining useful internal records can help organisations review their activities and manage the programme over time.
Consider recording:
- The training or other AI literacy measures provided
- The teams or groups covered
- The topics and AI systems addressed
- The dates and formats of learning activities
- Feedback and identified knowledge gaps
- Planned updates or follow-up activities
These records help programme owners understand which measures have been delivered and identify areas that need attention. They should not be treated as automatic proof that all applicable legal obligations have been satisfied.
For organisations managing multiple teams and AI systems, a structured tracking process can reduce reliance on disconnected spreadsheets and manual follow-ups.
The AnnexOps AI Literacy Compliance Tracker is designed to support AI literacy tracking and related compliance evidence management. Organisations should assess its capabilities against their own operational and documentation requirements.
7. Connect AI Literacy With Wider AI Governance
AI literacy is one part of an organisation's broader AI governance process. Training alone does not replace the need to understand the systems in use, assess relevant risks, maintain appropriate documentation, or manage applicable responsibilities.
A connected approach helps organisations link their AI literacy activities with their wider governance work.
For example, when a business introduces a new AI system, it can review who will use the system, identify relevant risks, determine what guidance those people need, and record the measures provided.
Where appropriate, the organisation can also connect this work with its AI risk classification and compliance workflows.
The AnnexOps Risk Classification Engine supports classification against EU AI Act Annex III use cases and provides confidence scoring and legal-review flagging. Risk classification and AI literacy serve different purposes, but considering them together can help organisations develop guidance that reflects the systems they use.
For a broader operational perspective, see How to Build AI Risk Management Workflows for EU AI Act Compliance at Scale.
8. Review the Programme as AI Use Changes
AI literacy should not remain a one-time training exercise.
New tools, model updates, changes to business workflows, and new AI use cases can introduce different risks and learning needs. Organisations should therefore establish a review process that considers changes in their AI portfolio and feedback from the people using those systems.
A practical review can ask:
- Have new AI systems been introduced?
- Are employees using existing systems in new ways?
- Have relevant risks or limitations changed?
- Do employees understand the guidance provided?
- Are there teams that need additional support?
- Should internal policies or learning materials be updated?
The frequency of review should reflect the organisation's circumstances and the nature of its AI use.
Where high-risk AI systems are involved, additional requirements may apply. For example, Article 26 contains specific obligations for deployers of high-risk AI systems, including provisions relating to human oversight. General AI literacy activities should not be treated as a substitute for these separate obligations.
How AnnexOps Supports AI Literacy and Governance
AnnexOps is AI compliance software designed to support organisations managing EU AI Act and AI governance operations.
Its AI literacy tracking capability helps organisations organise training activities and related evidence. The wider product environment also supports AI system inventory, risk classification, obligation management, documentation, evidence storage, and ongoing monitoring.
These capabilities can help teams connect AI literacy activities with the broader governance processes surrounding their AI systems. Organisations should assess their specific needs and verify which product capabilities are appropriate for their workflows.
To explore the implementation steps in more detail, read the full AnnexOps guide: How to Create an EU AI Act AI Literacy Program.
Conclusion
Building an AI literacy program starts with understanding how AI is used across the organisation. Businesses can then identify the people involved, tailor guidance to relevant systems and responsibilities, record the measures taken, and review the programme as their use of AI evolves.
Article 4 provides flexibility in how organisations support AI literacy, but the approach should reflect their actual operating context.
By integrating AI literacy into wider AI governance activities, organisations can make their guidance more relevant to everyday work and easier to maintain as their AI systems change.
Top comments (0)