Why AI literacy is a policy instrument, not a training course

The most under-read clause in the EU AI Act is Article 4. It runs a few lines. It does not name a model, a vendor, or a sector. It does not specify a curriculum, a certificate, or a test. It says, essentially, that providers and deployers of AI systems shall ensure a sufficient level of AI literacy among their staff and the people acting on their behalf, calibrated to what those people already know, what context they are working in, and whom the AI is used on ^[1].

That sentence has been in application since 2 February 2025. Supervision and enforcement begin on 2 and 3 August 2026, when national market surveillance authorities take up the file ^[1]. In the eighteen months between those dates, every European organisation that deploys AI — public, private, large, small, inside the EU or operating into it — has been required, at least on paper, to make sure its people understand what AI is, what it is doing in their workplace, and what could go wrong.

Most have not done so. Most that have done so have treated it as a training course.

This is the wrong framing, and the cost of getting it wrong is bigger than it looks.

Article 4 is a policy instrument, not an HR exercise

When a regulation requires "a sufficient level of literacy" without specifying the curriculum, what it is really doing is delegating policy design to the deployer. The European Commission's own guidance is explicit: no mandatory certificates, no fixed governance structure, no measured tests, deliberate flexibility because the technology is moving fast and the contexts vary ^[1]. That flexibility is not a free pass. It is a transfer of responsibility.

In a Norwegian municipality with 4,000 employees, "sufficient AI literacy" is not the same as in a 30-person legal practice in Bergen, a hospital trust running an AI triage pathway, or an export-credit agency assessing a model-based underwriting tool. Each of these has a different set of risks, a different set of staff prior knowledge, and a different set of "persons on whom the AI systems are to be used", to use the Article 4 phrase. The deployer has to design the answer.

That is policy design. Outsourcing it to a generic e-learning module is not compliance — it is the appearance of compliance, which is worse.

Norway's choice in summer 2026

Norway's AI Act is on track to take effect in summer 2026, aligning Norwegian law with the EU AI Act, with the Norwegian Communications Authority (Nkom) as the proposed coordinating supervisory body ^[2]. The draft was published by the Ministry of Digitalisation and Public Governance on 30 June 2025 and went to consultation through 30 September 2025 ^[2]. By the time enforcement bites in August 2026, Norwegian organisations will be operating under both the EU regime and the Norwegian transposition.

This sequencing matters. It means Norway is one of the few countries with a chance to set a national pattern for what Article 4 actually looks like in operating practice, before the enforcement era hardens. The country is unusually well placed to do so. Public institutions are trusted. Digitisation is high. KI-fabrikken at Sigma2, opened in November 2025 by Minister Karianne Tung around the supercomputer Olivia, anchors a national AI infrastructure that is simultaneously sovereign and connected to the European LUMI AI Factory network ^[3]. The Norwegian press covers AI policy seriously and at volume.

What is missing is a recognised playbook for Article 4 inside ordinary public-sector organisations. That is the gap KI for Norge is built to close.

What "literacy as infrastructure" looks like

Treating AI literacy as policy infrastructure rather than training has four operational consequences.

First, it is owned at the leadership level, not delegated to HR. The decision about what staff need to understand is a policy decision about what the organisation is willing to deploy and on whom. That decision sits with leadership.

Second, it is built around real workplace decisions, not abstract concepts. "Procuring an AI-enabled service", "drafting a model card", "running human oversight on a recruitment tool", and "responding to a citizen who challenges an AI-supported decision" are all situations in which staff make policy choices in real time. Literacy work is the rehearsal for those choices.

Third, it is differentiated. Article 4 explicitly requires calibration to existing knowledge, context, and use ^[1]. A municipal CIO needs different literacy from a frontline caseworker, who needs different literacy from a procurement officer or a citizen-facing service designer. A single course for everyone fails the calibration test.

Fourth, it is documented. The EU AI Office has not required tests or certificates ^[1]. It has required that an organisation be able to articulate how its literacy work is calibrated, why it covers the AI systems it deploys, and how it adapts as systems change. That is documentation, not certification — and it is closer to a quality-management discipline than to training.

The Nordic opportunity

There is a temptation in Oslo, Stockholm, Helsinki, and Copenhagen to wait for Brussels to clarify Article 4 further before acting. That would be a strategic mistake.

The Nordics have the conditions — trusted institutions, high digitisation, accountable public-sector cultures, and a tradition of small-state competence in regulatory craft — to define what good Article 4 implementation looks like, before the rest of the EU does. If the Nordics do that work first, two things follow. The Nordic interpretation becomes, by default, the reference point for the Commission's own enforcement priorities. And Nordic vendors, advisors, and public-sector consortia become the credible exporters of literacy infrastructure to the rest of Europe and beyond.

If the Nordics wait, two different things follow. The interpretation will be set elsewhere — most likely by the largest member states' federations of industry, optimising for compliance burden rather than public interest. And the Nordic public will end up importing literacy frameworks designed for very different institutional contexts.

The choice is now. The instrument is Article 4. The deadline is August 2026.