{"id":9406,"date":"2026-08-15T01:04:55","date_gmt":"2026-08-14T23:04:55","guid":{"rendered":"https:\/\/cybernecs.com\/?p=9406"},"modified":"2026-08-15T01:04:55","modified_gmt":"2026-08-14T23:04:55","slug":"ai-act-article-4-mandatory-ai-literacy","status":"publish","type":"post","link":"https:\/\/cybernecs.com\/en\/ai-act-article-4-mandatory-ai-literacy\/","title":{"rendered":"AI Act Article 4: mandatory AI literacy"},"content":{"rendered":"<p style=\"letter-spacing:.12em;text-transform:uppercase;font-size:12px;opacity:.7\">Training \u00b7 14 August 2026<\/p>\n<p>On 2 August 2026, Article 50 of the AI Act monopolised the headlines: chatbots, watermarks, deepfakes. An older duty stayed in the blind spot. Since 2 February 2025, Article 4 requires providers and deployers to ensure sufficient AI literacy for the people who look after AI for them. A VSE that has \u201clet sales plug in ChatGPT\u201d for eighteen months is not in a grey zone. It is behind on a text already applicable, even as it is only now discovering chatbot disclosure.<\/p>\n<h2>What Article 4 says, without polish<\/h2>\n<p>AI literacy, in the regulation, is not a diploma, nor a mandated number of hours, nor a badge. It is the duty, for those who place a system on the market (providers) and for those who use it under their authority (deployers), to see to it that their staff and the other people who look after the systems on their behalf have a level of skill, knowledge and understanding suited to the context. The context of a 12-person SME is not that of a foundation lab. The duty, in its principle, is the same.<\/p>\n<p>An SME that puts an agent on its site is a deployer. It must inform users since 2 August 2026 (Article 50). It must also, since 2 February 2025, see to it that the person who configures the agent, who feeds the document base, who reads the conversations or who turns off a filter, understands what they are doing. The two articles hold together: poorly worded disclosure is often the symptom of an untrained team, not of a lawyer\u2019s omission.<\/p>\n<h2>Why directors have forgotten it<\/h2>\n<p>Three reasons, all prosaic.<\/p>\n<p>First, Article 4 does not have the same media shine as the fines. Those on the transparency strand go up to \u20ac15 million or 3% of worldwide turnover; those for prohibited practices up to \u20ac35 million or 7%. Article 4 looks like a duty of means. It is pushed behind \u201cthe real topics\u201d.<\/p>\n<p>Next, many believed training concerned only model vendors. The text also targets deployers. \u201cWe do not train a model, so we are not concerned\u201d is a false argument, the same one that leads to \u201cit is the vendor who must display the banner\u201d.<\/p>\n<p>Finally, tools spread from the bottom: a personal subscription, a CRM plugin, a three-week trial. Nobody opened a training plan because nobody opened a project. The AI Act does not distinguish \u201cproject\u201d AI from AI \u201ccobbled together in the evening\u201d.<\/p>\n<h2>What \u201csufficient\u201d means in a VSE or an SME<\/h2>\n<p>This is not about turning your teams into researchers. It is about covering, for each real role, a baseline.<\/p>\n<ul>\n<li><strong>Director.<\/strong> Distinguish provider and deployer. Know what has been due since February 2025, since August 2026, and what is postponed (Annex III high-risk to 2 December 2027; Annex I to 2 August 2028, Regulation EU 2026\/1744). Decide which flows stay human.<\/li>\n<li><strong>Person who configures the agent.<\/strong> Understand the data perimeter, tool rights, user disclosure, model limits, the log. Know that a poorly cleaned RAG invents a price list from an obsolete PDF.<\/li>\n<li><strong>Person who talks to the customer.<\/strong> Know how to say that an assistant is automated, know how to take back control, know not to paste an unreviewed reply into a quote.<\/li>\n<li><strong>Person exposed to generated content.<\/strong> Recognise a deepfake, know the visible-label rule since 2 August 2026, not republish a visual that is \u201ctoo good\u201d without a mention.<\/li>\n<\/ul>\n<p>This baseline is documented: who was trained, on what, on which date, with which material. A one-page register is worth more than a slide that says \u201cour teams are aware\u201d.<\/p>\n<h2>Five actions to catch up with February 2025<\/h2>\n<ul>\n<li>Draw up the list of people who touch an AI system (including those who use a consumer tool for work).<\/li>\n<li>Attach each person to a role (director, configurator, business user, communications) and to a competence objective.<\/li>\n<li>Follow an <a href=\"https:\/\/cybernecs.com\/en\/training\/\">AI and cybersecurity training path<\/a> suited to those roles, not a single 45-minute webinar for everyone.<\/li>\n<li>Tie the training to real uses: your <a href=\"https:\/\/cybernecs.com\/en\/grow-your-sme-with-ai-and-gain-efficiency\/\">VSE\/SME agents<\/a>, your RAG, your box or your cloud. Generic training that never opens your tool changes nothing on tomorrow\u2019s banner.<\/li>\n<li>Cross-check with the GDPR: the trained person must know what not to send in a prompt. A <a href=\"https:\/\/cybernecs.com\/en\/gdpr-audit-and-compliance\/\">GDPR compliance audit<\/a> supplies the concrete examples (identity document, payroll, an employee\u2019s medical file, customer list).<\/li>\n<\/ul>\n<h2>Literacy and security: the same omission<\/h2>\n<p>Training without talking about the agent\u2019s rights is learning the highway code without talking about the brake. A competent configurator also knows what not to connect. Patrick Dajan Mouelle, director of Cybernecs, deliberately ties the two topics in our work: we do not \u201craise awareness\u201d of AI on one side and audit access on the other. The same employee makes both mistakes.<\/p>\n<h2>From omission to a dated plan<\/h2>\n<p>If you have formalised nothing since February 2025, do not promise an internal \u201cacademy\u201d. Date three sessions, name the participants, keep the materials. To build that plan with a trainer who knows the VSE\/SME ground (agents, box, France cloud), contact us via <a href=\"https:\/\/cybernecs.com\/en\/contact-cybernecs\/\">the contact page<\/a>. Article 4 is not waiting for 2027. It has been waiting for a year and a half.<\/p>\n<p>Sources: Artificial Intelligence Regulation (AI Act), Regulation EU 2026\/1744 (Digital Omnibus), Touteleurope, L\u2019Express.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>While Article 50 grabs attention, the AI literacy duty has been running for more than a year. How to catch up in a VSE or an SME.<\/p>\n","protected":false},"author":2,"featured_media":9362,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-classe"],"_links":{"self":[{"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/posts\/9406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/comments?post=9406"}],"version-history":[{"count":1,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/posts\/9406\/revisions"}],"predecessor-version":[{"id":9409,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/posts\/9406\/revisions\/9409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/media\/9362"}],"wp:attachment":[{"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/media?parent=9406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/categories?post=9406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybernecs.com\/en\/wp-json\/wp\/v2\/tags?post=9406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}