AI Training for Employees: Role-Based AI Literacy, EU AI Act Article 4 and a 90-Day Programme

AI training for employees works best in layers: a short AI literacy course for everyone who uses AI at work, then role-based modules for managers, power users, builders and risk, legal and compliance staff. In the EU, Article 4 of the AI Act has required AI literacy measures since 2 February 2025. Since the Digital Omnibus rewrote it with effect from 27 July 2026, providers and deployers must take measures that support their staff's AI literacy without guaranteeing a set level, and national authorities supervise the duty from 2 August 2026.

This guide is for the HR, learning, compliance or AI programme lead who has to design an employee AI training programme and show what it achieved. The legal text was read on EUR-Lex and the Commission’s AI Act Service Desk, and the guidance comes from the Commission’s AI literacy Q&A as updated on 20 October 2026.

What employees need from AI training, by role

One course for everyone fails twice: it bores the specialists and loses the beginners. Build AI literacy training for employees around what people do with AI, not around their grade.

Two further groups need short, specific sessions: executives and board members, who approve the AI strategy and the risk appetite, and procurement teams, who buy AI features embedded in other software.

Demand for this training is high and supply lags. In BCG’s AI at Work 2026 survey of 11,749 people, 88% said they would need major upskilling in the next five years, while 36% felt properly trained. BCG’s 2025 edition pointed to three features of training that worked: at least five hours of instruction, sessions held in person and access to a coach.

EU AI Act Article 4: the AI literacy duty

What the text says now

The AI Act, Regulation (EU) 2024/1689, defines AI literacy in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of the opportunities and risks of AI and the harm it can cause. That definition was not amended in 2026.

Article 4 was. The original version required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and of other persons dealing with AI systems on their behalf. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, was published in the Official Journal on 24 July 2026 and entered into force on the third day after publication, 27 July 2026. It replaced Article 4 with three paragraphs:

1. Providers and deployers must take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training, the context of use and the people on whom the systems are used. The paragraph adds that this obligation does not require them to guarantee any specific level of AI literacy of any individual.
2. The Commission and the Member States must support and facilitate those efforts, in particular for SMEs, and the Commission must publish practical examples of how to comply on the single information platform.
3. The AI Board must adopt recommendations, taking account of European competence frameworks, to support the promotion of AI literacy.

Recital 8 of the Omnibus gives the reason: stakeholders reported that stringent obligations to ensure a sufficient level of AI literacy did not suit every type of provider and deployer, and such obligations added a compliance burden, particularly for smaller enterprises.

What has not changed

• The duty still applies. Chapters I and II of the Act, which contain Article 4, have applied since 2 February 2025, and the Omnibus kept the obligation on providers and deployers.
• The scope is wide. The Commission’s Q&A reads “other persons” as people broadly under the organisation’s remit, such as contractors, service providers and even clients.
• Supervision sits nationally. National market surveillance authorities supervise and enforce the rules from 2 August 2026; the AI Office does not.
• High-risk systems add a competence duty. Deployers of high-risk AI systems must assign human oversight to people with the necessary competence, training and authority (Article 26(2)). For Annex III systems that applies from 2 December 2027; the dates under the AI Act are listed in our timeline, and the AI Act compliance checker helps classify your systems.

What the Commission’s AI literacy Q&A adds

The Q&A makes five practical points:

• There is no one-size-fits-all approach and no mandatory training format, and different levels of training for different groups can be appropriate.
• A programme should start from the AI used in the organisation, whether the organisation acts as provider or deployer, the risks of those systems, and the knowledge and context of the people concerned. Legal and ethical aspects belong in it.
• Relying only on the instructions for use of an AI system might be ineffective.
• No certificate is needed. Organisations can keep an internal record of trainings and other guiding initiatives.
• The Commission’s living repository holds more than 40 literacy initiatives for learning and exchange, and copying one does not create a presumption of compliance.

On penalties, the fixed fine tiers in Article 99 do not list Article 4. Member States set the penalties for other infringements, which since the Omnibus may include administrative fines, warnings and non-monetary measures, and the Commission stresses that any sanction must be proportionate.

Beyond the AI Act: ISO 42001 and NIST

Two voluntary references cover similar ground, inside and outside the EU. ISO/IEC 42001:2023, the AI management system standard, has clauses on competence (7.2) and awareness (7.3). In the NIST AI Risk Management Framework, GOVERN 2.2 calls for personnel and partners to receive AI risk management training so they can perform their duties consistent with related policies, procedures and agreements. Our guide to ISO 42001 explains the standard.

AI literacy training modules: a curriculum

The modules below combine into tracks for each group. The lengths are planning suggestions, not requirements of any law or standard.

Useful material for individual modules already exists. Our explainer on why AI models hallucinate works as a pre-read for module 1, the prompt engineering explainer supports module 6, and filling in a fundamental rights impact assessment is a practical exercise for module 8.

Formats for AI awareness training

Choose the format by goal:

• Short e-learning for modules 1 to 4, so every new joiner and contractor completes them before receiving access.
• Live sessions for managers and for the regulatory track, where discussion matters more than slides.
• Hands-on labs on the tools people will actually use, with real but non-sensitive tasks. Practice on a public chatbot transfers poorly to an internal assistant with different rules and data.
• Coaching and office hours run by champions in each team.
• In-tool guidance: short tips and examples where people work, updated with each release.
• Refreshers triggered by changes to the tools, the rules or the law, not only by the calendar.

Free, structured courses help power users and builders go further; the VDF AI Academy offers hands-on lessons on agents, retrieval and governance. Training also works better as part of a wider rollout plan with champions and clear communication, which our guide to AI change management sets out.

AI training for employees and compliance: records and evidence

Article 4 prescribes no documents, but an organisation that cannot show what it did will struggle to explain itself to an authority, an auditor or a works council. Keep a small, consistent set of records.

The Act sets no retention period for these records, so follow your HR records policy. If you hold or are working towards ISO/IEC 42001 certification, its competence clause expects documented information as evidence of competence, so the same records can serve both purposes.

Measuring the effect of AI training

Completion rates show reach, not effect. Measure four things.

Behaviour is the level that matters most and the one most often skipped. Ask team leaders to sample AI-assisted work each month during the first quarter, and check whether discoveries of unsanctioned AI tools fall after training. For adoption measures beyond training, see our AI metrics guide.

Example: a 90-day AI literacy training programme

This illustrative plan is for a fictional organisation of about 2,500 staff that is giving an AI assistant to all office employees and running a few agent projects.

After day 90 the programme moves into maintenance. New joiners complete the core course before access, each tool release triggers a short update, and the curriculum is reviewed whenever the law or the policy changes. Who owns that work in the long run is covered in our guide to roles in an AI team.

How VDF AI fits

Literacy sticks when people practise on the tools they will use, under the rules that apply to them. In VDF AI, role-based access control on every plan lets you grant assistants and agents by role group, so access can follow completion of the core course. VDF AI Chat can answer staff questions from your own policies and training material through private retrieval, with links to the source documents, and audit logs keep a record of use.

For delivery, our training agent for AI Act literacy runs role-adaptive, scenario-based questions with feedback and a score, and the AI literacy training use case shows how a programme can run on the platform. Scores from such tools are internal evidence; the content, the role analysis and the records remain the organisation’s responsibility.