AI Act Article 4 — the evidence that actually satisfies it

Article 4 is the cheapest obligation in the AI Act and the one most associations have already failed to evidence. Not failed to do — most staff have had some exposure to AI by now, several of them enthusiastically. Failed to evidence, which is a different failure and a more expensive one, because it is invisible until somebody asks.

The article itself is short, and it is worth reading the actual words rather than the summary a vendor put on a slide. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and among other persons dealing with the operation and use of AI systems on their behalf — taking into account those people's technical knowledge, experience, education and training, and the context in which the systems are to be used, and the people the systems are used on.

Four words carry the whole obligation: best extent, sufficient, context, and on their behalf. Every one of them is a question about your specific organisation, which is precisely why no certificate can answer them for you.

It has been live for over a year

Article 4 began to apply on 2 February 2025, alongside the prohibitions in Article 5. It was not deferred. When the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force from 27 July 2026, moved the high-risk timetable — Annex III to 2 December 2027 and Annex I to 2 August 2028 — it did not touch Article 4.

This is the single most common misreading in the sector right now. An association that reads "high-risk obligations deferred to 2027" and concludes it has time is reading a different article. The duty that has applied longest is the one still outstanding.

Why a certificate is not evidence

The market answered Article 4 with courses, because courses are what a training obligation looks like from a distance. Most of what is sold is a generic module, an hour of video, a multiple-choice quiz and a PDF. It is not worthless. It is just not the thing Article 4 asks for.

Read the obligation again and note what it is anchored to. Sufficient — for the job that person does. Context — the systems actually in use in your building. Best extent — proportionate to the risk and the size of the organisation. A certificate issued to a membership director, a policy officer and a finance assistant for completing the same generic module asserts that all three needed the same thing. They did not.

There is a second, quieter problem with the certificate. It evidences that somebody sat through content. It does not evidence that anything changed. Article 4 sits inside a Regulation whose purpose is to change how AI is used, and a record that shows no change in behaviour is a record of attendance. If an inquiry asked what did your staff do differently afterwards, a stack of completion certificates would answer a question nobody asked.

What the evidence pack contains

Four items, and none of them is a certificate.

• A role-based matrix. Which staff touch AI, what they use it for, and what each of them needs to know to do that safely. This is where the literal text of Article 4 gets answered: technical knowledge, experience, education, training, and context. A policy officer drafting consultation responses needs to know about accuracy and confidentiality. A finance assistant processing invoices needs different things. The matrix is the argument for why the training you gave was the right training.
• A dated record of what was delivered. Who, what, when, delivered by whom, and — the part almost everybody omits — what it was tied to. "AI awareness, all staff, March 2025" is weak. "Handling member correspondence with an AI tool: permitted inputs, the three things never to paste, how to check an output before it goes out — delivered to the membership team, 14 March 2025, by the operations lead" is evidence.
• A named owner. Somebody accountable for the literacy programme, identified in the record, with a review date. The obligation is on the deployer, which means it needs an owner inside the deployer.
• A review cycle with a real trigger. Annual is defensible. "We will review it" is not. Better still, a trigger tied to change: a new AI tool adopted, a new role created, a material shift in what an existing tool is used for. Article 4 is not satisfied once and filed; it is satisfied continuously or it decays.

If a board wants the short version: the matrix, the dated record, the owner, the review date. One document. Produced in days, not months.

The two categories people forget

Article 4 covers staff and "other persons dealing with the operation and use of AI systems on their behalf". For an association that second category is not decoration. It is contractors, interim staff, volunteers running a regional branch, and — depending on how the work is arranged — the supplier's staff operating a system inside your processes.

It also covers the people the systems are used on. The article explicitly requires the assessment to consider the persons or groups on whom the systems are to be used. For a membership body, that means the literacy assessment is not only about protecting the association from its staff's mistakes. It is about whether the people being processed — members, applicants, examination candidates — are being handled by people who understand what the system is doing to them.

That framing is uncomfortable, and it is the one that makes the record credible. A literacy programme written entirely around organisational risk reads as compliance theatre. One that can explain how it protects members reads as governance.

What to do this week

Three steps, in order, and the third is the one that gets skipped.

1. List the systems. Including the free ones staff signed up to themselves, because those are in use on the association's behalf whether or not procurement knows.
2. Write the matrix. Role by role, system by system, what each person needs to know. It will be shorter than expected, and the gaps will be obvious.
3. Fill the gaps and date everything. A short session that is recorded beats a long programme that is planned. The record starts on the day it is written, which is why waiting for the perfect programme is the expensive choice.

An association that produces those three things is in better shape than most of the sector on the one obligation that has been live longest. That is not a high bar, which is exactly why clearing it is cheap and visible.

---

The full picture: The AI Act for associations — what your body must actually do covers provider versus deployer, all four duties that reach a membership body, the dates, and the five items of evidence a board will ask for.

If the matrix and the dated record are the job your team keeps deferring, First Build is ten working days on exactly one of them.