If your company uses AI systems and you're looking at how to meet the Article 4 AI literacy obligation, which has applied since 2 February 2025, it's easy to come across courses presented as "mandatory", urgent packs with a diploma included, or generic training at a high price. It's worth saying something before you buy: Article 4 doesn't require you to buy anything. It requires taking measures to support the development of AI literacy of staff and other persons dealing with the operation and use of AI systems on the company's behalf, taking into account their knowledge and the context of use; and it does not require any specific level of AI literacy to be reached by any individual — and a good part of the material those measures can draw on is public, free, and good quality.
The resources that already exist
Article 4(2) requires the Commission and the Member States to support and facilitate companies' efforts, in particular SMEs', and the Commission to publish practical examples of how to comply on the single information platform. In Spain, AESIA — the Spanish AI Supervision Agency — promotes free AI literacy resources. Among the best known is Elements of AI, the open course of Finnish origin available in Spanish, which covers the fundamentals — what AI is and isn't, how it learns, where it fails — pitched at non-technical staff, whose technical knowledge Article 4 requires to be taken into account. On top of that there are the agency's and the European Commission's guides and outreach materials, plus the documentation from the providers of the systems your company actually uses.
With that material on the table, the right question stops being "which course do I buy?" and becomes a far more useful one: what does my team need to know, about which systems, and how do I demonstrate it?
Adequate means adapted
The most common mistake in solving Article 4 with a generic course is forgetting half the obligation. The rule doesn't ask for "AI training" in the abstract: it asks for measures that take the context into account — the technical knowledge, experience, education and training of whoever operates the systems, the context the systems are to be used in, and the persons or groups of persons on whom they are to be used.
A general course like Elements of AI covers the common baseline well: what a model is, why it gets things wrong, what a hallucination is, why you don't paste confidential information into a public tool. What no generic course can cover is the layer specific to your company: how your CRM uses AI, what to do when your diagnostic system produces an anomalous result, what your use policy says about personal tools. The formula that works for an SME is the sum of both layers: a free common baseline plus an internal session specific to the systems in the inventory. The second one can be a well-prepared hour; that's enough to start, and it's the layer that takes into account the context of use Article 4 requires you to consider.
Demonstrable, or it doesn't exist
And here's the part that decides everything, because it's what separates diligence from good intentions: for the purpose of demonstrating Article 4, training that leaves no record doesn't exist: the article doesn't require a record, but without one there's no way to show the measures taken. The day someone asks — an authority, a client running an audit — the answer can't be "we did a course." It has to be a record:
- Who: each person trained, with their role and the systems they operate.
- What: the specific content (the baseline course, the internal session, the provider's material).
- When: the date of each training action and the planned refresher date.
- With what outcome: the completion record the resource itself issues, or the attendance sign-off from the internal session.
Four columns. A maintained table is worth more, in any review, than a framed diploma — because it documents a living process, not an isolated event. That record is, quite simply, the evidence we always talk about, applied to training.
Two honest caveats
First: AESIA promoting a resource makes it a good starting point — it doesn't mean that completing it "discharges" the Article 4 obligation. No course, free or paid, exhausts it on its own, because it is an obligation of means and a contextual one: you set the measures yourself, with your record and your adaptation to your own case.
Second: literacy isn't a one-off, founding event — it's maintenance. The systems in the inventory change, new people join, agents arrive with risks the 2025 course didn't cover. A light, recorded annual refresher keeps the evidence alive — and, in the process, the real competence, which was the point all along.
Article 4 is probably the AI Act obligation with the best effort-to-value ratio for an SME: free material, one internal session, one record table. In the visibility module we treat it exactly that way — not as a course to pass, but as evidence to build. Start there: it's the cheapest entry point into serious governance.
Content in line with Article 4 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.