How to build an AI literacy program under Article 4: a practical checklist
Temja·July 7, 2026· 8 min read
the short version
- →Article 4 has applied since February 2025. You need a working AI literacy program now, not a plan for later.
- →There is no syllabus or guaranteed individual level in the law. Measures take knowledge, experience, context, and affected people into account.
- →A training video can be one measure. Practical work and clear records make the programme more useful and easier to review.
- →Follow the order below: map, tier, train for behaviour, keep the record, re-test. Start small and make it real.
Article 4 does not hand you a curriculum, and that trips people up. They wait for an official checklist that never comes. The amended law is deliberately open: take measures that support AI-literacy development and adapt them to people and context. This post turns that duty into a concrete order of operations you can start this week. It is a practical guide, not legal advice, and Temja is not a certification body.
First, know the clock you are working against
Before you build anything, get the timeline straight, because it shapes how much urgency each part deserves. Article 4 is already live, and national supervision and enforcement apply from 2 August 2026. Here is how the key dates line up.
AI literacy applies
The Article 4 duty to take AI-literacy measures starts to apply.
Tap a point.
You are not waiting for 2026
Article 4 has applied since 2 February 2025. If you have no literacy program yet, you are already behind the duty, not preparing for a future one.
Step 1: Map who uses AI and what they can reach
You cannot adapt measures to context if you do not know who is in scope. Start with an honest inventory. As a programme-design rule, greater system reach and consequence justify deeper support and practice.
- 1List every AI touchpointChatbots, copilots, agents, embedded features in tools you already pay for. Include the ones people adopted without asking.
- 2Note the accessFor each use, write down what the AI can reach: which data, which systems, which actions it can take.
- 3Include people acting on your behalfArticle 4 reaches contractors and service providers who run AI for you. Do not stop at your payroll.
Step 2: Tier your people by risk
A data scientist and a finance clerk do not face the same risks, so identical training may not help them equally. Sort people into a few tiers based on what their AI use can affect. This is a practical way to apply the contextual factors Article 4 names.
- Light users: occasional AI for low-stakes tasks. They need the basics: what AI is good at, where it fails, and when to stop and ask.
- Regular users: AI is part of the daily job and touches real data. They need to handle prompt injection, verify outputs, and know their limits.
- High-risk overseers: people who oversee Annex III systems like hiring or credit. They carry the deeper Article 26 duty and need training plus the authority to intervene.
Proportionate, not equal
Article 4 allows measures to reflect knowledge, experience, training, use context, and affected people. Over-training everyone wastes goodwill; under-supporting consequential roles leaves a real gap. Tier deliberately.
Step 3: Train for behaviour, not attendance
This is where many programmes quietly fail their own purpose. A slide deck and a completion tick prove someone was present. They do not show how the person acts when a convincing threat appears mid-task. Article 4 does not mandate a behavioural test, but practice makes the measure more useful.
A completion certificate says a person sat through something. A drill record says a person met a live threat and either caught it or learned what it would have cost.
- 1Use hands-on drillsPut people in front of realistic scenarios: a poisoned document, an agent that suddenly wants to send an email. Let them practise the response.
- 2Teach the reflexes that matterDistrust content an agent reads, verify before real actions, limit access, notice the sudden turn. These generalise across tools.
- 3Make failure safe and instructiveSomeone who falls for a drill and learns from it is worth more than someone who passed a quiz and never felt pressure.
Step 4: Keep evidence you can show
The duty is to take supportive measures; Article 4 does not prescribe a specific evidence file. The Commission says organisations can keep internal records of training and other guiding initiatives. Build that record as you go so you can explain what happened later.
| Record this | Why it matters |
|---|---|
| Who was trained | Shows coverage across the roles you mapped |
| On which content version | Shows what people learned and when the standard changed |
| With what result | Behaviour, not just attendance: did they catch the threat? |
| When they were re-tested | Shows literacy is maintained, not one-and-done |
Step 5: Re-test on a cycle
Knowledge fades and tools change every few months. Article 4 sets no fixed retest interval, but a programme that never adapts loses practical value. Set a risk-based rhythm and add practice when a significant new AI tool appears.
A quick check before you start
Three short questions to see if the core ideas landed. If you get them, you are ready to shape a program.
1. When did the Article 4 AI-literacy duty start to apply?
2. What does amended Article 4 require?
3. For a high-risk system, human oversight must be done by someone who is:
The one line to remember
Demonstrated competence beats demonstrated attendance. Build a program that produces evidence people can act safely, versioned and ready to show, and you have met the spirit of Article 4.
take these with you
- 01Article 4 is live now, so a working program beats a perfect plan for later.
- 02Map who uses AI and what they can reach, then tier people by risk so training stays proportionate.
- 03Train for behaviour with hands-on drills, not slides, and make safe failure part of learning.
- 04Keep a versioned, tamper-evident record and revisit measures on a risk-based cycle.
Questions people ask
Where do I even start an AI literacy program?
Map every place AI touches your work and who operates it, including contractors. That inventory shows who is in scope and the context your literacy measures should address.
Does Article 4 tell me exactly what to teach?
No. There is no official syllabus or guaranteed individual level. Measures take existing knowledge, experience, education, training, use context, and affected people into account.
How often should we re-test?
There is no fixed legal interval, but literacy decays and tools change fast. Many teams re-run drills quarterly or twice a year, and after adopting any significant new AI tool.
Can Temja run this program for us?
Temja provides the drills, scenarios, and evidence trail to build and maintain an Article 4 program. It supports your compliance work but does not give legal advice or certify compliance.
from reading to reflex
See what trained behaviour looks like.
The drill takes about eight minutes. No sign-up, no card. Meet the poisoned invoice and find out if you reach STOP in time.
keep reading