How to build an AI literacy program under Article 4: a practical checklist
Temja·July 7, 2026· 8 min read
the short version
- →Article 4 has applied since February 2025. You need a working AI literacy program now, not a plan for later.
- →There is no syllabus in the law. Sufficient is proportionate to each person's role and risk.
- →The deliverable is not a training video. It is evidence that your people can use AI safely and that you can show it.
- →Follow the order below: map, tier, train for behaviour, keep the record, re-test. Start small and make it real.
Article 4 does not hand you a curriculum, and that trips people up. They wait for an official checklist that never comes. The law is deliberately open: make your people AI literate in proportion to their role, and be ready to show it. This post turns that open duty into a concrete order of operations you can start this week. It is a practical guide, not legal advice, and Temja is not a certification body.
First, know the clock you are working against
Before you build anything, get the timeline straight, because it shapes how much urgency each part deserves. Article 4 is already live. Enforcement powers arrived in August 2025. The larger wave of high-risk obligations lands in August 2026. Here is how the key dates line up.
AI literacy applies
Article 4 is in force. Staff who use AI need a basic, role-fit understanding of it.
Tap a point.
You are not waiting for 2026
Article 4 has applied since 2 February 2025. If you have no literacy program yet, you are already behind the duty, not preparing for a future one.
Step 1: Map who uses AI and what they can reach
You cannot train proportionately if you do not know who is in scope. Start with an honest inventory. The rule of thumb: the more an AI system or agent can do on someone's behalf, the more literacy that person owes.
- 1List every AI touchpointChatbots, copilots, agents, embedded features in tools you already pay for. Include the ones people adopted without asking.
- 2Note the accessFor each use, write down what the AI can reach: which data, which systems, which actions it can take.
- 3Include people acting on your behalfArticle 4 reaches contractors and service providers who run AI for you. Do not stop at your payroll.
Step 2: Tier your people by risk
A data scientist and a finance clerk do not face the same risks, so they should not sit through the same training. Sort people into a few tiers based on what their AI use can affect. This is what proportionate means in practice.
- Light users: occasional AI for low-stakes tasks. They need the basics: what AI is good at, where it fails, and when to stop and ask.
- Regular users: AI is part of the daily job and touches real data. They need to handle prompt injection, verify outputs, and know their limits.
- High-risk overseers: people who oversee Annex III systems like hiring or credit. They carry the deeper Article 26 duty and need training plus the authority to intervene.
Proportionate, not equal
The law wants training matched to role and risk. Over-training everyone wastes goodwill; under-training your high-risk people leaves a real gap. Tier deliberately.
Step 3: Train for behaviour, not attendance
This is where most programs quietly fail. A slide deck and a completion tick prove someone was present. They do not prove the person can act safely when a real, convincing threat appears mid-task. The test the law cares about is behavioural, so your training should be too.
A completion certificate says a person sat through something. A drill record says a person met a live threat and either caught it or learned what it would have cost.
- 1Use hands-on drillsPut people in front of realistic scenarios: a poisoned document, an agent that suddenly wants to send an email. Let them practise the response.
- 2Teach the reflexes that matterDistrust content an agent reads, verify before real actions, limit access, notice the sudden turn. These generalise across tools.
- 3Make failure safe and instructiveSomeone who falls for a drill and learns from it is worth more than someone who passed a quiz and never felt pressure.
Step 4: Keep evidence you can show
Doing the training is not the duty. Being able to show it worked is the duty. If an auditor or regulator asks, doing nothing more than a stack of slides will not answer. Build the record as you go, not in a panic later.
| Record this | Why it matters |
|---|---|
| Who was trained | Shows coverage across the roles you mapped |
| On which content version | Shows what people learned and when the standard changed |
| With what result | Behaviour, not just attendance: did they catch the threat? |
| When they were re-tested | Shows literacy is maintained, not one-and-done |
Step 5: Re-test on a cycle
Literacy decays and the tools change every few months. A program that trains once and stops is not a defence. Set a rhythm, quarterly or twice a year, and re-run drills so competence stays current. New AI tool in the business? New drill.
A quick check before you start
Three short questions to see if the core ideas landed. If you get them, you are ready to shape a program.
1. When did the Article 4 AI-literacy duty start to apply?
2. Article 4 asks you to prove which of these?
3. For a high-risk system, human oversight must be done by someone who is:
The one line to remember
Demonstrated competence beats demonstrated attendance. Build a program that produces evidence people can act safely, versioned and ready to show, and you have met the spirit of Article 4.
take these with you
- 01Article 4 is live now, so a working program beats a perfect plan for later.
- 02Map who uses AI and what they can reach, then tier people by risk so training stays proportionate.
- 03Train for behaviour with hands-on drills, not slides, and make safe failure part of learning.
- 04Keep a versioned, tamper-evident record and re-test on a cycle. Evidence is the deliverable.
Questions people ask
Where do I even start an AI literacy program?
Map every place AI touches your work and who operates it, including contractors. That inventory tells you who is in scope and how much literacy each person owes, which shapes everything else.
Does Article 4 tell me exactly what to teach?
No. There is no official syllabus. The duty is proportionate to each person's role and risk, so you design training that matches what their AI use can affect and keep evidence it worked.
How often should we re-test?
There is no fixed legal interval, but literacy decays and tools change fast. Many teams re-run drills quarterly or twice a year, and after adopting any significant new AI tool.
Can Temja run this program for us?
Temja provides the drills, scenarios, and evidence trail to build and maintain an Article 4 program. It supports your compliance work but does not give legal advice or certify compliance.
from reading to reflex
See what trained behaviour looks like.
Run the 3 minute drill. No sign up, no card. Meet the poisoned invoice and find out if you reach stop in time.
keep reading