Since the Article 4 AI literacy obligation came into application, a small market of training-related fear has flourished: "mandatory" courses, urgent packs with a diploma included, generic training priced like a master's degree. It's worth saying something that market would rather not mention: Article 4 doesn't require you to buy anything. It requires measures that support the development of AI literacy among the staff operating AI systems, proportionate to the context — and a good part of the material those measures can draw on is public, free, and good quality.
The resources that already exist
AESIA — Spain's AI Supervision Agency, in its facilitation role — promotes free AI literacy resources. Among the best known is Elements of AI, the open course of Finnish origin available in Spanish, which covers the fundamentals — what AI is and isn't, how it learns, where it fails — pitched exactly at the non-technical audience Article 4 has in mind. On top of that there are the agency's and the European Commission's guides and outreach materials, plus the documentation from the providers of the systems your company actually uses.
With that material on the table, the right question stops being "which course do I buy?" and becomes a far more useful one: what does my team need to know, about which systems, and how do I demonstrate it?
Adequate means adapted
The most common mistake in solving Article 4 with a generic course is forgetting half the obligation. The rule doesn't ask for "AI training" in the abstract: it asks for measures that take the context into account — the specific systems in use, the people they're used on, the role of whoever operates them.
A general course like Elements of AI covers the common baseline well: what a model is, why it gets things wrong, what a hallucination is, why you don't paste confidential information into a public tool. What no generic course can cover is the layer specific to your company: how your CRM uses AI, what to do when your diagnostic system produces an anomalous result, what your use policy says about personal tools. The formula that works for an SME is the sum of both layers: a free common baseline plus an internal session specific to the systems in the inventory. The second one can be a well-prepared hour; that's enough to start, and it's what turns training into adequate.
Demonstrable, or it doesn't exist
And here's the part that decides everything, because it's what separates diligence from good intentions: for the purposes of Article 4, training that leaves no record doesn't exist. The day someone asks — an authority, a client running an audit — the answer can't be "we did a course." It has to be a record:
- Who: each person trained, with their role and the systems they operate.
- What: the specific content (the baseline course, the internal session, the provider's material).
- When: the date of each training action and the planned refresher date.
- With what outcome: the completion record the resource itself issues, or the attendance sign-off from the internal session.
Four columns. A maintained table is worth more, in any review, than a framed diploma — because it documents a living process, not an isolated event. That record is, quite simply, the evidence we always talk about, applied to training.
Two honest caveats
First: AESIA promoting a resource means it's recognised, quality material — not that completing it "discharges" the Article 4 obligation. No course, free or paid, grants that on its own, because the obligation is contextual: you establish it yourself, with your record and your adaptation to your own case.
Second: literacy isn't a one-off, founding event — it's maintenance. The systems in the inventory change, new people join, agents arrive with risks the 2025 course didn't cover. A light, recorded annual refresher keeps the evidence alive — and, in the process, the real competence, which was the point all along.
Article 4 is probably the AI Act obligation with the best effort-to-value ratio for an SME: free material, one internal session, one record table. In the visibility module we treat it exactly that way — not as a course to pass, but as evidence to build. Start there: it's the cheapest entry point into serious governance.
This article is for informational purposes only and does not constitute legal advice.