Somebody asked, and there was no answer
Four ways this lands on a desk, and it is usually the same desk.
- Enforcement powers started in August 2026, somebody asked the board what we do about it, and there is no answer and no budget line for one.
- Staff are already using AI, visibly, with no rules and no training. The risk is felt long before it is written down anywhere.
- An auditor, a customer security questionnaire or a DORA reviewer asked for evidence of AI training, and nothing exists to send them.
- The same person also owes security-awareness training, and has no appetite for running two programmes.
The dates a lawyer will check first
- 2 Feb 2025The duty started
Article 4 of the EU AI Act began to apply, to providers and deployers alike, at every risk tier. Almost every company using AI internally is a deployer.
- 27 Jul 2026The duty was rewritten, and softened
The Digital Omnibus replaced "ensure, to their best extent, a sufficient level of AI literacy" with "support the development of AI literacy", and added that it does not require any specific level of AI literacy of any individual. An obligation of effort rather than of result — and most training material still teaches the old wording.
- 2 Aug 2026Enforcement arrived
The Act applies generally from this date and national authorities supervise it. No penalty article reaches Article 4 itself, so the exposure is civil liability if untrained staff cause harm, and a regulator’s view of obvious non-compliance during any later inquiry.
What Article 4 asks of you, and what it does not
The obligation stays yours. It is discharged by measures you take and can show, not by a course somebody sells you.
Measures, taken
Take measures to support the development of AI literacy among staff and others operating AI systems on your behalf.
Proportionate to the role
Tailored to technical knowledge, experience, and the context the system is used in. A finance team and a data team do not need the same thing.
Documented
The measures are what you would show a regulator or an auditor, which means something has to exist in writing.
Continuous
Reviewed as systems change, as new ones are deployed, and as people move into AI-adjacent roles.
A fine, a pass mark, or a certificate
None of the three is in Article 4. No penalty article reaches it, the July 2026 amendment removed the "sufficient level" wording, and nothing in the law asks anyone to be certified. Any page that tells you otherwise is selling from a version of the text that no longer exists.
What the programme covers
Six modules, a knowledge check at the end of each, and two role tracks — one for general staff, one for technical. The result is recorded per person and exports as a training record.
What AI is, and what it is not
Models, tokens, context and the difference between a system that reasons and one that predicts.
The EU AI Act in ten minutes
What the regulation covers, who it binds, and the risk tiers it sorts systems into.
Article 4 — what the law asks of us
The literacy duty itself, in the wording that applies now rather than the wording it started with.
Risks: hallucination, bias, leakage, automation bias
The four failure modes that actually cause incidents, with what each looks like in ordinary work.
Our rules of use
What may be shared with a model and what may not, and what to do when the answer is unclear.
Roles in the AI value chain
Provider against deployer, and why almost every company is the second one.
The record is the point, not the score
Each module ends in a knowledge check and the result is recorded against the person. That record is evidence of the measures your organisation took — which is what Article 4 asks for, and more than it now asks for, since the amended text does not require anyone to reach a level.
The second reason is the better one anyway, and it has nothing to do with the law: the score tells you who actually understood it. People can be retrained later, as systems change and as roles move.
No pass mark, no certificate, and nothing here makes an organisation compliant. Compliance is yours. This is one measure, documented.
Free as it stands, and yours if you want it to be
The programme is free to any organisation and free to OpsHero customers. Not a trial, not a seat count. Access is arranged by hand today — ask, and we set your organisation up.
What is not free is making it yours, and that is bought as part of an AI Champion engagement: modules presented by somebody your staff recognise, rather than a stranger; your own AI policy and rules of use inside the training rather than beside it; and the tools and harnesses your teams actually use rather than a vendor-neutral abstraction.
Staff learn the rules that apply to them, on the stack they work on. That is the difference between training people and showing them a course.
The ones people actually ask
Free? What is the catch?
The training is free and customising it is not. That is the whole of it: the programme costs you nothing, and modules presented by your own people, carrying your own policy and your own tools, are bought as part of an engagement.
Does taking this make us compliant?
No, and anyone who tells you otherwise is wrong. It is one measure, documented, which is what Article 4 asks for. Compliance belongs to your organisation and cannot be bought from a course.
Our lawyers say Article 4 has no penalty — why bother?
They are right, and we will not pretend otherwise. The exposure is civil liability if untrained staff cause harm, a regulator’s view of obvious non-compliance during any later inquiry, and the fact that customers and auditors now ask for this in security questionnaires.
We already have an LMS — is that not a weakness?
It is not, and pretending it is would be a poor argument. Our content is free, current with the July 2026 rewrite, and specific rather than generic. Use the system you already have people logging into.
We are not in the EU. Does any of this apply to us?
The Act may not, and the page does not assume it does. The reason to train people then is the one that was always there: staff using AI without understanding it is a capability and security problem before it is a legal one.
Ask for your organisation's access
There is no sign-up form yet. Tell us who you are and we set your organisation up by hand, which is also a chance to say what your staff actually need.
- Your organisation set up, and your staff able to take the programme
- The completion records, per person
- An honest read on whether the standard programme is enough for you