Article 4 of the EU AI Act (AI literacy) has applied since February 2025; the rule was amended in 2026, so we word this carefully. Since then, two misconceptions have been circulating: some treat it as a formality, others as a certification process. Both are wrong, and both mistakes are costly.
What the article actually requires
Providers and deployers of AI systems must ensure that their staff – and anyone working with these systems on their behalf – have a sufficient level of AI literacy. "Sufficient" means appropriate to prior knowledge, the context of use, and the people affected.
This is deliberately principle-based. There's no prescribed curriculum and no accredited exam. But there is an expectation of adequacy and traceability – and you don't meet that with a video and a checkbox.
| Assumption | Reality |
|---|---|
| "Only applies to IT." | Applies to everyone who deploys AI systems. |
| "We need an official diploma." | No prescribed diploma, but an obligation to document the measure taken. |
| "Training once is enough." | Competence must match the actual use – meaning it has to evolve with it. |
| "Only applies once the high-risk rules kick in." | Article 4 has applied since February 2025 (amended in 2026). |
| "External contractors are exempt." | People working on your behalf are covered too. |
What solid evidence looks like
- Who was trained: names, roles, date, scope.
- What they actually work with: a system list, not the vague catchall "AI."
- What content was covered: capabilities and limits, data handling, hallucinations, human oversight, escalation paths.
- How application is ensured: guardrails, points of contact, repetition.
- What resulted from it: outputs that show the knowledge was actually applied.
The best evidence of competence isn't the attendance list – it's what participants built and documented afterward.
Risk classes – the short version
| Class | Example | Core obligation |
|---|---|---|
| Prohibited | Social scoring, emotion recognition in the workplace | Do not deploy |
| High risk | Candidate screening, creditworthiness | Governance, documentation, oversight |
| Limited risk | Customer-facing chatbot | Transparency toward users |
| Minimal risk | Internal text drafting | Good practice, few obligations |
Why a hackathon fits well here
Because compliance knowledge sticks precisely when it's tied to a real use case. Someone who realizes firsthand that their prototype would touch personal data understands data classification within five minutes – and retains it permanently. The result is two things at once: documented competence and an outcome that actually delivers value.
This overview doesn't replace legal advice. But it does replace the excuse of not knowing where to start.