AI literacy sounds like a soft obligation that somebody in HR will handle. It is a legal duty with a date that has passed, and it applies to organisations that merely use AI, not only to those that build it.
The text, and who it binds
Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
Regulation (EU) 2024/1689, Article 4
The European Commission's timeline records that “prohibited AI practices and AI literacy obligations entered into application from 2 February 2025”. It is not pending.
Three phrases in the Article decide how much work it is. “To their best extent” makes it proportionate. “Taking into account their technical knowledge, experience, education and training” makes it role-based. “And the context the AI systems are to be used in” means a company using an assistant for internal drafting owes less than one using AI in a regulated decision.
What the Regulation says it is for
Recital 20 explains the purpose. AI literacy should “equip providers, deployers and affected persons with the necessary notions to make informed decisions regarding AI systems”, and those notions “may vary with regard to the relevant context”, including “the measures to be applied during its use, the suitable ways in which to interpret the AI system's output”.
Interpreting the output is the operative phrase for most companies. The duty is not to explain transformers. It is to make sure the person reading an answer knows what it is and is not.
Different roles, different content
A developer using a coding assistant needs to know about generated code that compiles and is wrong, and about dependencies the model invents. An accountant summarising invoices needs to know that a confident total is not a checked total. A manager approving a use case needs to know what data classes are permitted and who signs off.
A single deck delivered to everyone satisfies an auditor for about one question.
Five modules that fit a small company
- Approved tools: which systems are sanctioned, and how to ask for another one
- Permitted data: the classification, with real examples from this company's work
- Verifying output: what must be checked, by whom, before it leaves the organisation
- Security and privacy: prompts are data, logs are data, and documents carry instructions
- Reporting: how to report a wrong or harmful answer, without blame
Keep a record of who completed what and when. The obligation is to take measures, and a measure nobody can evidence is difficult to defend.
The best policy is one employees can follow. The best literacy programme is one they can remember on a Tuesday afternoon.
Why a defined internal system makes this easier
Training is far simpler when the answer to "which AI do we use" is one system with one set of rules. The instruction becomes concrete: use the company assistant for these classes of work and these classes of data, and ask before going outside it.
That is not a compliance product. It is the difference between a rule about a category and a rule about a tool people can see.
With Bastion
What Bastion changes
Bastion is a private AI system delivered as one sealed appliance that runs inside your building. One monthly fee covers the hardware, the model, the hardened operating system and support, and nothing your team types leaves the building.
A single internal system gives the literacy programme something concrete to describe: one tool, one processing location, one permission model, one update path.
The Article 4 duty remains with the deployer, and no appliance discharges it. It just makes the training shorter and the rules easier to follow.
Questions this article answers
- Is AI literacy training mandatory under the EU AI Act?
- Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff. The European Commission records that the obligation entered into application on 2 February 2025, so it is already in force.
- Who does the AI literacy obligation apply to?
- Providers and deployers. A company that buys an assistant and gives it to its staff is a deployer, so the duty applies to ordinary AI users, not only to the firms that build models.
- What should AI literacy training cover?
- Five things: which tools are approved, which data may be entered, how to verify output, security and privacy basics, and how to report a wrong answer. Recital 20 puts the emphasis on interpreting the system's output correctly.
On the record
- 1
EUR-Lex
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligenceread 2026-09-22
- 2
Read next
- The EU AI Act in 2026: which dates have passed and which have movedA date-by-date reading of what applies to an ordinary company today, what was extended by the AI Omnibus, and why moving a model onto your own server changes none of the classification.Read the article
- What an enterprise AI policy has to contain to be worth writingTen sections, each of which answers a question somebody in the company will ask this quarter. What the law requires, what the survey evidence says about the behaviour you are governing, and why a ban is the weakest option available.Read the article