AI Literacy Is Now an Organisational Responsibility: What Article 4 of the EU AI Act Means in Practice

Artificial intelligence is already part of everyday professional life. Staff use tools such as ChatGPT for writing, research, translation, analysis, planning and communication, often before their organisations have developed clear guidance on how those tools should be used.

Article 4 of the European Union Artificial Intelligence Act changes the question organisations need to ask. The issue is no longer simply whether staff are using AI, but whether they have the knowledge, judgement and support to use it responsibly.

What does Article 4 require?

Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy among staff and other people using AI systems on their behalf. These measures should consider people’s existing knowledge and experience, the context in which AI is used, and the individuals or communities who may be affected.

The obligation has applied since February 2025, and enforcement began in August 2026. Following the 2026 AI Omnibus amendments, the Act does not prescribe a fixed level of AI literacy that every individual must achieve. The responsibility to take appropriate, context-sensitive measures nevertheless remains.

Importantly, Article 4 is not limited to technology companies or specialist AI teams. The European Commission specifically confirms that an organisation whose staff use ChatGPT for tasks such as writing or translation should address the relevant risks, including inaccurate or fabricated outputs.

For organisations within the Act’s territorial scope, everyday professional AI use therefore matters.

AI literacy means more than learning to write prompts

Much of the current conversation about AI literacy focuses on technical confidence and productivity. These skills are useful, but they are not enough.

Meaningful AI literacy includes understanding:

• what AI systems can and cannot do;
• how inaccurate, fabricated or biased outputs can arise;
• when information should not be entered into an AI system;
• how AI can affect confidentiality, intellectual property and data protection;
• how to verify and interpret AI-generated outputs;
• when human expertise and professional judgement must take priority; and
• who remains accountable for decisions and published work.

The required approach will differ across roles and sectors. A communications officer using AI to draft social media content does not face the same risks as a researcher analysing sensitive interviews, an educator assessing learners, or a safeguarding professional working with confidential disclosures.

This is why generic training alone may not be sufficient. AI literacy needs to reflect how an organisation actually works, which tools it uses, what information it handles and who could be affected when something goes wrong.

What should organisations do now?

Organisations do not need to appoint a dedicated AI officer or obtain a particular certificate under Article 4. They should, however, be able to demonstrate that they have taken AI literacy seriously.

A practical starting point is to:

1. identify which AI systems are already being used and for what purposes;
2. determine which staff, consultants and service providers use them on the organisation’s behalf;
3. assess the risks associated with each use and the people who may be affected;
4. provide training and guidance appropriate to different roles;
5. establish clear rules for confidentiality, verification and human oversight; and
6. maintain records of training and other AI literacy measures.

This should not be approached merely as a compliance exercise. Weak AI literacy can create misinformation, confidentiality breaches, biased decisions, poor-quality work and serious reputational risks. Strong AI literacy helps organisations benefit from AI without surrendering human judgement, accountability or professional standards.

How CTDC supports responsible AI use

CTDC supports institutions to move from informal or fragmented AI use towards responsible, context-sensitive and accountable practice. Our support can include AI-use and Article 4 readiness assessments, compliance assessment, alignment of policies and practices with relevant legislation, tailored training and mentorship, institutional access to CTDC Academy’s CPD-certified course, and implementation support.

For individual professionals, CTDC Academy provides a CPD-certified self-paced course in Arabic and English , with the option to add one-to-one mentorship and coaching focused on applying responsible AI principles within a particular role, sector or professional context.
Certified learning can provide useful evidence of professional development, but certification alone does not establish institutional compliance. CTDC therefore connects learning with governance, organisational systems, human judgement and responsible implementation.  

Further readings

• European Commission: AI literacy questions and answers
• EU AI Act implementation timeline
• European Commission: AI Omnibus enters into force