Does an ISO 42001 Awareness Training satisfy the AI literacy duty under the EU AI Act?

More and more companies are looking at ISO 42001, the international standard for responsible AI management. At the same time, those same companies have to comply with Article 4 of the EU AI Act, which requires AI literacy among staff. That naturally raises the question: if our people complete an ISO 42001 Awareness Training, have we thereby met Article 4 straight away?

The honest answer: the two align closely, but not one to one. There is an important difference in the way that coverage works, and in what a general training can and cannot cover. That is what determines which route fits your organisation.

Two starting points, the same underlying need

Article 4 and ISO 42001 seem to point at the same thing, but they are two different kinds of thing.

Article 4 is a legal duty. If you fall within the scope of the EU AI Act, you must take appropriate measures to promote AI literacy among your people. That is not a choice, it simply applies.

ISO 42001 is a voluntary management system standard that an organisation can be certified against. You pursue it because you want to demonstrate responsible AI management, strengthen your international positioning or because a client or partner asks for it. It is a choice, not an obligation.

Different starting points, then. But the needs overlap strongly: people who work with AI and understand what they are doing, which risks are involved and what responsibility they carry.

What Article 4 asks of your staff

Article 4 requires you to take appropriate measures to promote AI literacy among your staff, proportionate to their role, their knowledge and experience and the risk of the AI use. The aim: that people understand what AI can and cannot do, recognise the risks and possible harm, and use AI responsibly.

What Article 4 does not do is prescribe a method. There is no mandatory curriculum, no mandatory exam, no mandatory certificate and no mandatory AI officer. There is no prescribed level of knowledge that each employee must individually attain. What matters is that you take appropriate measures and can substantiate what you have done. Without any record, that becomes difficult in practice.

The obligation has been in force since 2 February 2025. National supervisory authorities can begin actively enforcing Article 4 from 2 August 2026, but the duty already applies now. The Digital Omnibus softens the wording, from ensuring a sufficient level to measures that support the improvement of AI literacy. As long as that change has not been published in the Official Journal, the original text applies. The core holds either way: your people need to become AI literate and you must be able to show what you are doing to achieve that.

What ISO 42001 asks of your staff

ISO 42001 governs AI management far more broadly than training alone. Two clauses directly concern your staff.

Clause 7.2, competence, concerns everyone whose work affects the performance of the AI management system. The organisation must determine the necessary competence, ensure the people involved have it on the basis of education, training or experience, take action where needed, evaluate its effectiveness and retain documented evidence of it. A completed training certificate shows that someone completed the training. On its own it does not yet prove that the required competence has been determined, achieved and evaluated.

Clause 7.3, awareness, requires the people involved to know the organisation's AI policy, understand how their work contributes and understand the consequences of not following the rules.

An important point to see: these are two cogs in a much larger whole. ISO 42001 certification requires a great deal more, from an AI policy and risk and impact assessments to controls, communication, documentation and an external certification audit by an independent, preferably accredited certification body.

The overlap

At one point the two clearly meet. Both require people who work with AI to understand it properly and use it responsibly, with an awareness of the risks, not merely on a technical level. And both require evidence: Article 4 wants you to substantiate your measures, ISO 42001 wants competence and awareness records. A well-designed awareness training lays the organisation-wide foundation for that. The completion record is one part of your body of evidence.

Why the coverage only runs one way

A well-implemented ISO 42001 programme can cover much of the measures and evidence required for Article 4. Not the other way round. A standalone Article 4 training will never give you ISO 42001. For that you are missing the entire management system, the risk assessments, the controls and the audit. ISO 42001 is therefore the larger whole into which the literacy duty largely fits, not the reverse.

Mind one misconception: ISO 42001 certification is not automatic proof of compliance with the AI Act. The standard supports your compliance. It does not replace the law and gives no legal presumption of conformity.

Where a general training needs supplementing

An organisation-wide awareness training is a strong foundation, but not the whole story. Role-specific competence requires more. Key roles such as developers, HR staff who use AI recruitment tools, risk managers or human overseers need more in-depth training in addition to the foundation. That aligns with both the proportionality of Article 4 and clause 7.2.

In addition, an external training cannot make your people familiar with your own AI policy and procedures, whereas clause 7.3 asks precisely for that. So an organisation-specific supplement belongs there. And as roles, systems or risks change, your measures should move with them.

What does this mean for your choice?

The differences actually make the choice straightforward.

If you simply want to meet Article 4, an awareness training forms the core of your approach, supplemented with more in-depth training for your key roles and awareness of your own policy. You do not need to walk the whole way to ISO 42001 for that.

If you do go for ISO 42001, for example to strengthen your international positioning, that programme can also cover much of your Article 4 effort.

At AIAdopt you will find the building blocks for both routes: an ISO 42001 Awareness Training for Employees, core modules on AI literacy under Article 4 and sector-specific depth for particular roles. In three languages, with an exam and certificate. Whichever standard you choose, the underlying need is the same. That is what our offering is built around.

Frequently asked questions

Does an ISO 42001 Awareness Training satisfy the EU AI Act?

For the organisation-wide foundation of AI literacy it contributes strongly. An awareness training with a completion record is an important part of your body of evidence under Article 4. It does not automatically cover role-specific competence and awareness of your own policy, so for key roles and your internal procedures a supplement is needed.

Is a certificate mandatory under the EU AI Act?

No. Article 4 prescribes no certificate or exam. What the law asks is that you take appropriate measures and can substantiate what you have done. A training with a completion record is a practical way to support that, but it is a choice, not a legal obligation.

Does ISO 42001 replace the EU AI Act?

No. ISO 42001 is a voluntary standard, the EU AI Act is legislation. Whoever falls within the scope of the Act must comply with it, with or without ISO 42001 certification. ISO 42001 supports your compliance but gives no legal presumption of conformity.

Does Article 4 still apply after the Digital Omnibus?

Yes. The Digital Omnibus softens the wording of Article 4 but does not abolish the literacy obligation. Moreover, as long as the change has not been published in the Official Journal, the original text applies. AI literacy among your staff therefore remains necessary.

Written by Rob Ummels in collaboration with Claude (Anthropic). Final editorial responsibility: AIAdopt.