Prove that workplace AI literacy matches the work

The current Article 4 boundary is narrower and more practical than a universal exam

The European Commission's current AI Literacy Q&A says the Article 4 obligation has applied since February 2, 2025 and that supervision and enforcement rules began in August 2026. It also closes off a common overclaim: Article 4 does not require an employer to measure every employee's AI knowledge or guarantee that each individual reaches a specified level.

The obligation remains context-sensitive. The current text and Commission explanation point to the technical knowledge, experience, education, and training of staff and other persons dealing with AI systems on an organisation's behalf, plus the context in which systems are used and the people who may be affected. A marketing writer using an approved text assistant does not need the same measures as a recruiter configuring candidate matching, a finance analyst relying on an AI-generated forecast, or an engineer giving an agent production access.

This changes the control design. A generic annual video plus a completion spreadsheet may be one measure, but it does not show why the measure fits the systems and roles in scope. A defensible evidence pack should connect four things: the actual AI inventory, the people and work exposed to it, the measures provided, and the exceptions or refresh actions that followed.

This guide is operational, not legal advice. National market-surveillance authorities enforce Article 4, laws and institutional practice vary, and the Commission notes that enforcement is proportionate and fact-specific. Legal, labor, privacy, works-council, equality, records, accessibility, and sector questions require qualified review.

Start with the system and people map, not the course catalog

Training cannot be proportionate when HR does not know which AI systems are in use. Build a living register with approved tools, embedded vendor features, custom models, automations, decision-support systems, and connected agents. Include pilots and material shadow use discovered through normal governance channels. Do not infer use from writing style or launch hidden prompt surveillance.

The phrase “other persons” matters operationally. The Commission's Q&A discusses people dealing with operation and use on the organisation's behalf. Depending on facts and legal interpretation, that can make contractors, temporary workers, outsourced operators, or service providers relevant. Do not copy every vendor employee into an HR programme. Map who actually acts for the organisation, then have qualified reviewers confirm scope and contractual responsibility.

Record affected people as well as users. A recruiter may operate the system, but candidates experience the consequence. A support agent may use an assistant, but customers receive its statements. Literacy objectives should include the impact, contest, and escalation path relevant to those affected people.

Translate exposure into role-specific objectives

A useful matrix describes observable work, not broad labels such as “beginner” or “advanced.” Technical knowledge matters, but so do source judgment, data boundaries, uncertainty, human authority, professional obligations, and the ability to stop or escalate.

Do not turn the matrix into a personality score. Recent scenario-based research distinguishes instrumental ability from critical-reflective judgment. Someone may know how to write a prompt yet fail to notice a stale source, inappropriate data request, unequal effect, or missing escalation route. Someone else may use few advanced features but make excellent boundary decisions. Design measures around what the role must do safely and effectively.

Set accessibility and learning conditions at the same time. Provide language support, accessible formats, paid time, device access, shift coverage, alternatives to timed tests, and contractor access where relevant. Record accommodations without exposing diagnosis or unnecessary personal information.

Use scenarios as development evidence, not a fabricated legal pass mark

The Commission says Article 4 does not require measuring each employee's knowledge. Organisations may still use assessments or scenarios as one way to understand needs and test whether measures work. The boundary is important: label a result as evidence from a specific scenario, not proof of universal competence or legal compliance.

Build measures in layers. A baseline briefing can cover approved tools, prohibited data, hallucinations, source checking, security, and escalation. System-specific demonstrations show the actual interface, connected tools, limitations, and override. Role practice uses controlled cases. Managers need coaching on review time and psychological safety. Owners need change control, incident response, and evidence expectations.

scenario: hr_policy_summary_stale_source
role: people_operations_partner
system: approved-enterprise-assistant-v4
materials:
  - synthetic policy v3
  - deliberately stale policy v2
  - AI summary citing v2
observe:
  - identifies version conflict
  - checks the authoritative source
  - does not send the draft
  - records uncertainty and correction
  - escalates if policy ownership is unclear
rating:
  - NOT_OBSERVED
  - NEEDS_SUPPORT
  - DEMONSTRATED_FOR_THIS_SCENARIO
retention:
  store: scenario version, observation, support action, reviewer
  exclude: live employee data, unnecessary prompt transcript

Use known errors rather than trivia. Ask the learner to handle an apparently confident answer from an obsolete policy, a request to paste sensitive data into an unapproved model, a candidate ranking that conflicts with job criteria, a finance narrative that does not tie to the workbook, or an agent action outside approved scope. Observe whether they check, challenge, stop, override, escalate, and document.

Route gaps to the control that can fix them. A person who misses a data boundary may need a clearer tool banner or access restriction, not another lecture. A manager who cannot review because the queue is too large exposes a staffing or workflow problem. Repeated uncertainty about the authoritative source suggests poor information architecture. Literacy is partly a property of the work system.

Worked example: three roles using the same enterprise assistant

Assume an organisation provides an enterprise assistant to Marketing, People Operations, and Finance. The tool contract is approved, but access alone does not define the measures. Each role supplies different information, creates different outputs, and can affect different people.

All three roles receive baseline measures, but the evidence differs. The Marketing writer demonstrates claim verification and data boundaries. The People Operations partner demonstrates authoritative-source selection, privacy, fairness awareness, and escalation. The analyst demonstrates calculation tie-out, separation of observed variance from causal hypothesis, and reviewer handoff.

Suppose the People Operations partner misses the stale policy but correctly protects personal data. Record both observations. Assign a source-version job aid, add a visible authoritative-policy link in the tool, provide supervised practice, and retest that scenario. Do not declare the person “AI illiterate,” and do not use a composite score to hide the specific gap.

Build a package another reviewer can understand without the AI chat

1. Scope record: entities, business units, jurisdictions, workforce groups, contractors, exclusions, legal interpretation, and accountable owners.
2. AI system inventory: exact systems, purposes, users, data, connected actions, affected people, decision influence, and versions.
3. Role-exposure matrix: actual tasks, knowledge and experience considered, consequence, objectives, supervision, override, and escalation.
4. Measures register: content, version, audience, delivery method, owner, rationale, accessibility, language, completion, and support.
5. Scenario library: controlled inputs, expected observable behavior, version, reviewer guidance, data handling, and limited result labels.
6. Exception register: missing groups, access barriers, gaps, incidents, owner, interim containment, remediation, due date, and retest.
7. Feedback and outcome evidence: questions, support demand, error patterns, overrides, incident linkage, and workflow improvements without false attribution.
8. Approval and refresh: named reviewers, qualifications or roles, unresolved questions, decision, expiry, and event-based triggers.

Minimize personal data. Completion records may need employee identity, but scenario evidence often needs only a participant reference, role, date, observed behavior, support action, and reviewer. Follow records, labor, privacy, and security requirements. Do not retain live prompts merely because the AI platform makes them easy to export.

Keep official sources with access dates because the implementation landscape changes. The August 2026 Commission Q&A reflects amendments that entered into force in mid-July 2026 and explains current enforcement. National guidance, authority designations, and case practice may add relevant detail. Set a legal-review trigger rather than freezing today's summary into permanent policy.

Failure modes to test before approving the programme

Implement the control in 30 days without boiling the ocean

1. Days 1-5: select one business unit, appoint HR/L&D, business, AI governance, and legal/privacy owners as applicable, and approve the scope method.
2. Days 4-10: validate the unit's AI system inventory and the people who operate, configure, review, or rely on each system. Record unknowns.
3. Days 8-14: build the role-exposure matrix and define five to eight observable objectives for each material role/system combination.
4. Days 12-19: adapt baseline guidance, job aids, system demonstrations, supervisor support, and three to five controlled scenarios.
5. Days 18-24: deliver measures with accessible alternatives. Observe scenarios using limited labels and collect questions, access barriers, and workflow defects.
6. Days 22-27: assign remediation across training, tool design, access, supervision, policy, and workflow. Retest material gaps.
7. Days 26-30: assemble the evidence index, exceptions, unresolved legal questions, approvals, expiry, and refresh triggers. Decide approve, approve with actions, hold, or redesign.

Measure control health rather than claiming a direct productivity payoff. Useful indicators include inventory completeness, in-scope access, accommodation fulfillment, scenario gap type, remediation closure, source-check behavior, escalation accuracy, incident recurrence, policy questions, and overdue refreshes. Do not use “number of prompts” as a literacy metric.

Frequently asked questions

Does Article 4 require every employee to pass a test?

The Commission's current Q&A says no: Article 4 does not require measuring each employee's knowledge or guaranteeing a specific individual level. An organisation can still use proportionate scenarios as development and control evidence, with qualified legal review.

Who belongs in scope?

Start with staff and other persons who operate or use AI systems on the organisation's behalf, then map actual roles, systems, contracts, jurisdictions, and affected people. Ask qualified reviewers to confirm contractors, vendors, and special cases.

Is a completion certificate enough?

It proves that an event was completed. A stronger package explains why measures fit the role and system and includes the inventory, objectives, content, delivery, support, selected scenario evidence, exceptions, remediation, approvals, and refresh triggers.

Can HR use AI to score the scenarios?

AI may help structure evidence under an approved rubric, but a named human should review material observations. Do not let a model create an opaque employee score, infer traits, or make disciplinary decisions.

Does this workflow certify compliance?

No. It prepares operational evidence and questions for human review. Article 4 enforcement is fact-specific and national implementation matters. Obtain legal advice for the organisation's circumstances.