The AI Act obligations start with one paragraph that affects everyone.

Three words carry the whole article. 'Sufficient' means there's no fixed measure: what's enough depends on what you do with AI. 'Taking into account' refers to technical knowledge, experience, education and the context of use, that's the phrase that makes one programme for everyone inadequate. And 'on their behalf' widens the circle: contractors and suppliers operating your systems fall under it too.

What it doesn't say matters just as much. No hours, no exam, no recognised certificate, no register to enrol in. The legislator prescribes an outcome and leaves the route to you. That's comfortable until someone asks why your approach was sufficient, because then there's nothing to hide behind but your own reasoning.

Note also the distinction between provider and deployer. Nearly every Dutch organisation is the latter: you use AI someone else built. That doesn't lessen your responsibility under this article, the literacy obligation applies to both, but it matters enormously for the rest of the regulation, where the heavy obligations sit with the provider.

Regulators rarely start at the maximum, and rarely with the smallest breach. The first years of a new regulation typically focus on high-risk applications and on parties where the harm is visible: recruitment screening, credit scoring, facial recognition. A municipality that rolled out Copilot without a role analysis isn't top of that list.

That's no reason to do nothing, for two practical reasons. The first is that the obligation surfaces at moments you don't expect: in a tender, during an audit, in a data processing agreement, or when the works council asks. At those moments 'we ran a training' is a weaker answer than a measurement with a date on it.

The second is that it's cheap to cover. The four steps Article 4 implies, inventory, level assessment, training, recording, are exactly the steps you'd go through anyway if you want to know whether your AI investment delivers. Compliance is then a by-product of adoption work done properly, not a separate cost line.