Article 4 of the EU AI Act requires providers and deployers to take measures to support AI literacy, but it does not tell you what a plan looks like, and most organisations end up with one generic e-learning module and no record of who needs what. National market surveillance authorities have been able to supervise Article 4 since 2 August 2026, and the Commission says a lack of appropriate training may make enforcement more likely if an incident occurs. This template is a ready-to-adapt AI literacy training plan: audience groups mapped to the AI systems they touch, learning objectives and content per role, delivery and timing, contractors, records and review. It is for AI governance, HR, learning and security leads. For what the law requires and how it changed under the Digital Omnibus, read the EU AI Act AI Literacy Obligations (Article 4) Guide first; this page does not repeat it.
How to use this template
- Replace text in square brackets, such as [Organisation], [AI governance lead] and [Q1 2027], with your own terms and values.
- Build it from your AI register: every audience group in section 4 should be traceable to the AI systems its members operate, use or oversee. See the AI Register and AI Inventory Template.
- The Commission's AI literacy Q&A says no certificate, single format or AI officer is required, and that relying on instructions for use alone is often ineffective. Keep that in mind when choosing delivery methods; a mix of short training, briefings and on-the-job guidance is acceptable.
- The Commission describes keeping an internal record of trainings and other initiatives as an option, not a requirement. We recommend keeping one (section 8), because it is the simplest way to show what measures you took.
- Where you already run security awareness training, add the AI modules to that programme rather than building a parallel one. See the Security Awareness and Training Policy Template.
- Review the plan at least every [12] months, and when you add a new AI system, provider role or risk class.
1. Purpose
This plan sets out the measures [Organisation] takes to support the AI literacy of its staff and other persons dealing with the operation and use of AI systems on its behalf, as required by Article 4 of Regulation (EU) 2024/1689 (the EU AI Act) as amended. It aims to ensure that people:
- Understand what AI is, how the AI systems they use work, and their opportunities, limits and risks.
- Know whether [Organisation] acts as provider or deployer for each system, and what that means for their role.
- Use AI systems safely, lawfully and in line with the [AI acceptable use policy].
- Recognise and report AI failures, misuse and incidents.
- Where they oversee high-risk AI systems, have the competence, training and authority that Article 26(2) requires.
2. Scope
This plan covers:
- All employees who use, configure, develop, procure or oversee AI systems for [Organisation], at any risk level.
- Contractors, consultants, temporary staff and service providers who operate or use AI systems on [Organisation]'s behalf.
- [Optional] Clients or partners who use AI systems provided by [Organisation], where the risk justifies it.
- [Optional] All other staff, through general AI awareness, because unapproved AI use is common.
The AI systems in scope are those listed in the [AI register] as of [date], including AI features embedded in approved software and AI agents that act on [Organisation]'s behalf.
3. Roles and responsibilities
- [AI governance lead]: owns this plan, maintains the audience map and reports progress to [AI governance group].
- Learning and development: builds and delivers content, runs the learning platform and keeps records.
- AI system owners: supply system-specific content (limits, known failure modes, approved uses) and confirm who uses each system.
- Line managers: ensure their teams complete required measures and identify role changes.
- Security, privacy and legal: supply content on data handling, AI threats, the AI Act and data protection law.
- Procurement and vendor management: ensure contracts with service providers who use AI on [Organisation]'s behalf include AI literacy expectations proportionate to risk.
- Human oversight leads: for high-risk systems, confirm that each assigned overseer has completed the oversight curriculum before being assigned.
4. Audience map and needs analysis
Complete one row per audience group. Base the required depth on the people's existing technical knowledge, experience, education and training, the context the AI systems are used in, and the persons or groups on whom the systems are used, as Article 4 directs.
| Audience group | Approx. number | AI systems used or overseen | Role (provider / deployer) | Highest risk class | Current knowledge (low / medium / high) | Required depth |
|---|---|---|---|---|---|---|
| All AI users | [ ] | [general assistant, meeting summariser] | [deployer] | [minimal] | [ ] | Foundation |
| Developers and data scientists | [ ] | [coding assistant, models built in-house] | [provider] | [ ] | [ ] | Technical |
| AI agent and automation owners | [ ] | [agents with tools] | [ ] | [ ] | [ ] | Technical and operational |
| Human overseers of high-risk systems | [ ] | [e.g. recruitment screening, credit scoring] | [deployer] | [high] | [ ] | Oversight competence |
| Procurement, legal, HR, risk | [ ] | [ ] | [ ] | [ ] | [ ] | Applied |
| Executives and board | [ ] | [ ] | [ ] | [ ] | [ ] | Strategic |
| Contractors and service providers | [ ] | [ ] | [ ] | [ ] | [ ] | [as for equivalent internal role] |
Experienced AI engineers may already be literate in the technology. The Commission suggests the organisation should still check that they know its systems, risks and the legal and ethical aspects, so record a gap assessment rather than an automatic exemption.
5. Curriculum and learning objectives
5.1 Core modules
| Module | Learning objectives | Audiences | Suggested length |
|---|---|---|---|
| M1 AI fundamentals | Explain what AI and generative AI are, how outputs are produced, why they can be wrong, and which AI [Organisation] uses | All | [30 min] |
| M2 Using AI safely at [Organisation] | Apply the acceptable use policy: approved tools, data never to enter, verifying outputs, disclosure of AI use, reporting route | All AI users | [30 min] |
| M3 Our role and the law | State whether [Organisation] is provider or deployer for each system; outline the AI Act risk categories, prohibited practices and data protection basics | All AI users (short), legal, procurement, executives (full) | [20 to 60 min] |
| M4 System-specific briefing | Describe the intended purpose, known limits, failure modes and escalation path of each system the person uses | Users of each system | [15 min per system] |
| M5 AI threats for builders | Recognise prompt injection, insecure output handling, data and model poisoning, excessive agency and supply chain risks, and apply the secure development standard | Developers, data scientists, agent owners | [2 to 4 hours] |
| M6 Agents, tools and credentials | Scope tool permissions and credentials for agents, configure approval gates and kill switches, read agent logs | Agent and automation owners | [2 hours] |
| M7 Human oversight | Interpret outputs, recognise automation bias, decide when to override or stop the system, escalate and record decisions | Overseers of high-risk systems | [half day plus supervised practice] |
| M8 Buying and contracting AI | Assess provider documentation, data use terms and AI clauses; identify when a change of purpose moves obligations | Procurement, legal, risk | [1 hour] |
| M9 AI strategy and risk for leaders | Set risk appetite for AI, read AI risk reports, understand accountability under the AI Act | Executives and board | [1 hour briefing] |
5.2 Content rules
- Every module must include legal and ethical aspects relevant to the audience, as the Commission's Q&A recommends.
- System-specific content (M4) must be reviewed by the system owner whenever the system's model, purpose or tools change materially.
- Examples should come from [Organisation]'s own approved uses and anonymised incidents and near misses where possible.
- Content for high-risk system overseers must be agreed with the system owner and reflect the provider's instructions for use, but must not consist of the instructions for use alone.
6. Delivery and timing
| Trigger | Measures required | Deadline (our recommended default) |
|---|---|---|
| New joiner or contractor onboarding | M1, M2, M3 short version | Before access to any AI system, or within [30] days |
| Access granted to a specific AI system | M4 for that system | Before first use |
| Assigned as overseer of a high-risk system | M7 and M4, with a competence check by the oversight lead | Before assignment |
| Role change into development or agent ownership | M5, M6 | Within [60] days |
| Material change to a system or new AI regulation | Updated M4 or M3 briefing | Within [30] days of the change |
| Annual refresher | Updated M1 and M2, plus role modules where content changed | Every [12] months |
| After an AI incident | Targeted briefing for affected teams | Within [14] days of closure |
Delivery methods: [e-learning / live workshop / lab exercise / team briefing / intranet guidance / mentoring]. Accessibility and language requirements: [ ].
7. Contractors and service providers
- Contractors who operate or use AI systems on [Organisation]'s behalf must complete the same measures as the equivalent internal role, or provide evidence of equivalent measures from their employer.
- Contracts with service providers that use AI to deliver services to [Organisation] must include a clause requiring AI literacy measures proportionate to the risk of the AI systems used. See the AI Contract Clauses Guide.
- [Organisation] will request evidence of those measures at onboarding and [annually] for suppliers using high-risk AI systems.
8. Records
[Organisation] keeps an internal record of AI literacy measures. Records are kept for [duration of employment or engagement plus 3 years] and handled under [Organisation]'s data protection policy.
| Record field | Example entry |
|---|---|
| Person or group, role and audience group | [name or team, role, "Agent and automation owners"] |
| Employer (for non-employees) | [supplier name] |
| AI systems covered | [register IDs] |
| Measure and version | [M6 v2.1, live workshop] |
| Date completed | [date] |
| Competence check (oversight roles) | [assessed by, date, outcome] |
| Next due | [date] |
Alongside individual records, keep a programme file: this plan and its versions, the audience map, module content and change history, attendance summaries and the annual review.
9. Measurement and review
- Coverage: percentage of each audience group with all required measures current. Target: [95]%.
- Oversight readiness: percentage of high-risk system overseers with a completed competence check. Target: 100%.
- Time to train: median days from AI system access to completion of M4.
- Behaviour: AI-related policy violations and data loss alerts per [1,000] users, tracked over time.
- Reporting: number of AI near misses and incidents reported by staff (a rise after training is usually a good sign).
- Feedback: learner rating of relevance by module.
The [AI governance lead] reviews results [quarterly] and the plan [annually], and reports to [AI governance group].
10. Approval
Owner: [role]. Approved by: [AI governance group] on [date]. Next review: [date]. Version: [1.0].
Implementation guidance
Rolling out the plan
- Start from the register: without a list of AI systems and their users, the audience map in section 4 is guesswork.
- Deliver M1 and M2 to everyone first: these cover the broadest risk (data entered into AI tools and unverified outputs) quickly.
- Prioritise high-risk overseers: Article 26(2) competence is a separate, harder duty for deployers of high-risk systems; build M7 well ahead of the Chapter III application dates, which as of November 2026 are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113 as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, per the Commission AI Act Service Desk consolidated text as at 27 July 2026). Confirm against the official text before relying on them.
- Pilot role modules: run M5 and M6 with one engineering team, collect feedback, then scale.
- Connect to access: where tooling allows, make completion of M4 a condition of being granted access to the AI system.
Small and large organisations
A small organisation that only deploys a few AI tools can run M1 to M4 as a single one-hour session plus a written guide, record attendance in a spreadsheet and review annually. A large organisation, or one that provides AI systems, needs the full modular curriculum, integration with the learning platform and HR system so role changes trigger assignments, and system owners accountable for M4 content. The Commission's living repository of AI literacy practices contains examples from companies and public bodies, though replicating them does not create a presumption of compliance.
Common failure patterns
- One generic module for everyone: it satisfies nobody; overseers and agent owners need far more than general users.
- No link to actual systems: staff learn about AI in general but not the limits of the tools they use every day.
- Contractors forgotten: Article 4 covers people acting on your behalf, not only employees.
- Stale content: modules are not updated after a model or tool change, so briefings describe a system that no longer exists.
- Completion as the only metric: high completion with rising AI data loss alerts means the content is not landing.
Framework mapping
| Template section | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | AI-specific reference |
|---|---|---|---|
| 5 M1 to M4 general measures | PR.AT-01 | AT-2 Literacy Training and Awareness | EU AI Act Article 4; NIST AI RMF GOVERN 2.2 |
| 5 M5 to M7 role measures | PR.AT-02 | AT-3 Role-based Training | EU AI Act Article 26(2); NIST AI RMF MAP 3.4 |
| 7 Contractors | GV.RR-04 | AT-3 | EU AI Act Article 4 ("other persons") |
| 8 Records | PR.AT-01 | AT-4 Training Records | Commission AI literacy Q&A (internal record optional) |
Sources
- European Commission AI Act Service Desk: Article 4 AI literacy
- European Commission: AI Literacy Questions and Answers
- European Commission AI Act Service Desk: Article 26 Obligations of deployers
- European Commission AI Act Service Desk: Article 113 Entry into force and application
- NIST: AI Risk Management Framework Core
Related NHI Mgmt Group resources: EU AI Act AI Literacy Obligations (Article 4) Guide · Role-Based Security Training Programme Guide · AI Acceptable Use Policy Template · EU AI Act Provider vs Deployer Obligations Guide. This template summarises obligations under the EU AI Act and is not legal advice.