The short answer. Article 4 of the AI Act requires you to take measures to support the AI literacy of your people, in line with their role and the AI they use. You do not need a certificate or a fixed number of hours. It is sensible, though, to record what you do. What works in practice: deciding per role which level is needed, short basic training for everyone, in-depth training where AI affects decisions about people or money, and a file in which you record who did what. With the planner below you have that plan in five minutes, with real dates and an evidence file you can open in Excel.
What Article 4 says exactly and what changed with the Digital Omnibus in July 2026 is covered in our piece on Article 4. This piece is about putting it into practice.
Who needs to know what
- basic
- applied
- in-depth
| Role | What AI is | Checking | Data | Working with AI | Bias | Rules | Security | Oversight | Building | Level | Hours pp |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Board and management team2× | Skilled | 5 | |||||||||
| Managers3× | Skilled | 6.5 | |||||||||
| Office and administration6× | Skilled | 6 | |||||||||
| Sales and customer contact4× | Skilled | 7 | |||||||||
| HR and recruitment1× | Aware | 4 | |||||||||
| IT and development2× | Expert | 14 | |||||||||
| Operations and delivery5× | Skilled | 4.5 | |||||||||
| Freelancers and interns2× | Aware | 3 |
25 people · 8 roles · 154 hours of training in year one
Your 90-day plan
21 Oct 2026 – 28 Oct 2026
Taking stock
Make a register of the AI tools in use, including free tools and personal accounts, and who uses them.
29 Oct 2026 – 4 Nov 2026
Setting the goal
Record this plan and the level per role, and adopt the AI policy the training builds on.
5 Nov 2026 – 5 Dec 2026
Basic training for everyone
25 people, about 50 hours in total: what AI is, checking output, data and the policy.
6 Dec 2026 – 4 Jan 2027
In-depth training per role
Workshops and coaching for: Board and management team, Managers, Office and administration, Sales and customer contact, IT and development, Operations and delivery.
5 Jan 2027 – 19 Jan 2027
Evaluating and recording
A short test per person, a complete evidence file, and an evaluation of what can be improved.
21 Oct 2027
Annual refresher
New tools, new rules, new colleagues: repeat the cycle and update the file.
Your evidence file
This shows which measures you have taken. A certificate is not needed; according to the European Commission, an overview like this is enough.
| Role | Level | Hours pp | Period | Evidence |
|---|---|---|---|---|
| Board and management team | Skilled | 5 | Day 15 to 75 | Workshop attendance list, test and own case |
| Managers | Skilled | 6.5 | Day 15 to 75 | Workshop attendance list, test and own case |
| Office and administration | Skilled | 6 | Day 15 to 75 | Workshop attendance list, test and own case |
| Sales and customer contact | Skilled | 7 | Day 15 to 75 | Workshop attendance list, test and own case |
| HR and recruitment | Aware | 4 | Day 15 to 45 | Attendance list or e-learning record, plus test |
| IT and development | Expert | 14 | Day 15 to 75 | Training plan, coaching reports and test |
| Operations and delivery | Skilled | 4.5 | Day 15 to 75 | Workshop attendance list, test and own case |
| Freelancers and interns | Aware | 3 | Day 15 to 45 | Attendance list or e-learning record, plus test |
The plan is a reasoned estimate, not legal advice. The hours are a guideline per person for the first year.
Why per role, and not one training course for everyone
The text of Article 4 itself names what you have to take into account: the knowledge, experience and training of your people, the context in which the AI is used, and the persons on whom the AI is used. A single e-learning module for the whole company rarely meets that. A recruiter who uses AI to sort CVs needs different knowledge from a colleague who has meetings summarised. And the board above all needs to know what it is responsible for.
That is why the planner works with a matrix: a level per role and per topic. That way you train no one too much and no one too little, and you can explain per role why you chose that level.
The three levels
Aware. You know what AI is and what it cannot do, you check output before you use it, and you know which data never belongs in an AI tool. For everyone, including people who barely use AI: AI is now in Office, in the CRM and in the phishing email that looks more genuine every time.
Skilled. You use AI daily and well: you give clear instructions, you know where AI fits in your own work and where it does not, and you recognise the risks in your field. For most office roles that genuinely use AI.
Expert. You build or manage AI, or you use it in decisions about people or money. You know how bias arises, how to set up human oversight and what the AI Act requires of your application. For IT, and for HR or finance as soon as AI has a say in decisions.
The nine topics
- What AI is and is not: how language models work and why they can be convincingly wrong.
- Checking output: recognising hallucinations, verifying figures and sources.
- Data and privacy: what may go into which tool and what the GDPR requires.
- Working well with AI: giving AI good instructions and fitting it into your own work.
- Risks and bias: how AI can treat people unequally.
- Rules: your own AI policy and the AI Act, translated to the role.
- Security and misuse: deepfakes, AI phishing and prompt injection.
- Oversight and accountability: stepping in when things go wrong, logs and reporting incidents.
- Building and managing: evaluations, monitoring and secure integrations.
The 90-day plan
In its guidance Aan de slag met AI-geletterdheid (Getting started with AI literacy), the Dutch Data Protection Authority (AP) describes a four-step cycle: mapping, setting goals, implementing and evaluating. The plan from the planner follows that cycle and puts dates to it:
- Week 1: taking stock. A register of the AI tools in use, including free tools and personal accounts.
- Week 2: setting the goal. Recording the level per role, and adopting the AI policy the training builds on.
- Day 15 to 45: basic training. For everyone, one to two hours, with your own policy as the common thread.
- Day 46 to 75: in-depth training. Workshops with your own cases for the roles that use AI daily or in decisions.
- Day 76 to 90: evaluating and recording. A short test, a complete file, and what you will do differently next year.
After that, you repeat the cycle every year. Tools, rules and colleagues change faster than you think.
What belongs in the evidence file
According to the European Commission’s questions and answers, a certificate is not needed and an internal record of trainings and guidance is enough. A good file answers five questions per role: who, which level, which topics, when, and how you demonstrate it. That last one can be an attendance list, an e-learning record or a short test, such as a short quiz. The file from the planner already has those columns, plus room for the completion date.
Four mistakes we often see
One e-learning module for everyone. Easy to buy, but the recruiter and the developer learn nothing from it that reduces their risks.
Training only IT. Article 4 is about everyone who works with AI on your behalf, including freelancers and interns. Most of the risk lies with ordinary users.
Once and done. Someone trained in 2025 knows nothing about today’s tools and rules. Plan an annual refresher.
No evidence. Training without a record is something you cannot demonstrate to a regulator. Keep the file up to date while you train, not afterwards.
Frequently asked questions
How many hours of training are mandatory?
None. The law does not specify a number of hours. The planner gives a guideline per person for the first year, derived from the level per topic. For most users, that comes down to a few hours.
Does it also apply to freelancers and interns?
Yes. Article 4 covers your staff and other persons who work with AI on your behalf. Include them in the plan and in the file.
We hardly use AI. Do we still need to do something?
Probably, yes. AI is in Office, in your CRM and in your email, and your people will come across AI phishing and deepfakes. A short awareness session is then an appropriate measure.
Do I need to appoint an AI officer?
No, that is not mandatory. But someone does need to own the plan and the file. You record who that is in the AI policy.
Who checks this, and what if I do nothing?
In the draft bill for the Dutch AI Act Implementation Act (Uitvoeringswet AI-verordening), the Dutch Data Protection Authority (AP) supervises Article 4, with the AFM and DNB for financial institutions. There is no fine attached. If you fall short, the supervisor can, once that act applies, impose an order subject to a penalty: an instruction with a deadline, and only after that does it cost money.
