Step 6
By the end you will have a dated record of which measures you took, for which people and on what criteria you sized them.
AI literacy means the measures you take so that the people who use AI systems on behalf of your organisation know enough to use them with sound judgement: what each tool does, where it fails, which data must not go in and when a result needs checking. This step is not about organising a course, but about deciding which measure suits each profile and writing it down.
What the rule says, paragraph by paragraph, is on this site’s Article 4 page, and the free resources you can use as measures are in the article linked at the end. This chapter does not repeat them: it focuses on the record of measures, which is what you will have to show if someone asks what you did.
It builds on what the earlier steps left you. The inventory from Step 1 says who uses what; the policy from Step 5, what the rule is. The literacy measure connects the two: each person knows the rule as it applies to the tools they actually use.
Article 4 of Regulation (EU) 2024/1689 has required providers and deployers, since 2 February 2025, to take AI literacy measures for their staff and for other persons dealing with the operation and use of AI systems on their behalf. Since 27 July 2026 it has applied as amended by Regulation (EU) 2026/1744. It is a legal obligation with an explicit mandate, and it is not limited to high-risk systems: it reaches any deployer of AI systems.
As currently worded, it is a measures-based obligation, not one of result. The article itself makes clear that it does not require providers or deployers to reach any specific level of AI literacy for any individual. What your organisation can be asked is which measures it took, for whom and on what criteria; not what score each person got. That is why what you document here is measures, never levels or results.
The criteria for sizing them are set by the same paragraph 1, and it is worth copying them as they stand into your record: people’s technical knowledge, experience, education and training, the context each system is to be used in, and the persons or groups of persons on whom it is used.
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
The controls in the Alethexis catalogue that correspond to this step, each with its nature: legal obligation, good practice or internal control.
Adapt AI literacy measures to staff's technical knowledge, experience, education and training, to the intended context of use of each system and to the persons on whom it is used, as Article 4 requires.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.
With the inventory in front of you, form groups according to what each person does with AI: those who use a writing assistant, those who work with a system that proposes or decides something about customers or patients, those who configure or oversee it. Include the external people who use systems on behalf of your organisation. Coverage follows function, not job category, and one profile can bring together people from different departments.
For each group, the specific measure: a session on the use policy, a guide to a tool’s limitations, a hands-on exercise with cases from your sector, the policy acknowledgement. Next to it, the criterion you chose it by, using the Article 4 factors: what these people know, the context they use the system in and on whom. The why is what turns a list of courses into a decision you can defend.
For each measure keep the material with its date and version, which profile it was aimed at and when it was delivered or sent. Date the review: once a year and whenever a new system comes in or one of those you use changes. A measure taken on tools that are no longer in use shows nothing about the ones that are.
Measuring AI literacy with an exam and filing the scores.
Article 4 does not ask for each person to reach a level, so a score is not the proof that matters, and a record of individual marks turns a measures-based obligation into one of result that the rule does not impose. You also pile up data on your staff’s performance that you did not need. The opposite mistake is in circulation too: thinking that, because no level is required, nothing is. The article still requires measures to be taken, by the same parties and with the same criterion of adaptation. What you document is the measure and its why.
A register of the measures adopted on AI literacy and of the criteria used to size them, ready to fill in profile by profile with the measure, the date, the material and the planned review.
AI literacy measures checklist (Article 4)One week between days 20 and 27. The first version of the record takes an afternoon to write; the rest of the time goes on delivering or sending the measures and keeping each one with its date.
The AI literacy measures record: profiles, the measure taken for each, the criterion it was decided on, date, versioned material and the date of the next review.
In Alethexis there is no separate section for Article 4: measures are recorded where they happen, with the acknowledgement of the current policy in the policy section and, in Evidence, the “Training record” category with a quick-access filter, “Evidence of AI literacy measures (Article 4)”.
The status report then brings together the current AI use policy, its acknowledgements among the people with access to the account and the training evidence recorded, so that the record of measures does not live in a separate spreadsheet.