Role-Specific Duties for HR, Managers and Customer-Facing Teams

Article 4 asks for literacy calibrated to context and to the people on whom systems are used, which means a single organisation-wide module cannot be the whole programme. Three populations carry duties heavy enough to need their own material.

People teams come first because employment is one of the areas listed in Annex III of the Act, covering AI used for recruitment, selection, promotion, termination, task allocation and monitoring of work. The specific high-risk obligations for Annex III systems were deferred to 2 December 2027 by Regulation (EU) 2026/1744, and that deferral is genuinely useful for preparation time, but it changes nothing about the law that already applies.

Discrimination law applies today. Data protection law applies today, including the right in Article 22 of the GDPR not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects a person, subject to defined exceptions. The literacy content for HR therefore covers what the tools in use actually do, why a screening model trained on past hiring decisions reproduces past preferences, why proxy variables such as postcode or career gaps can encode protected characteristics, and why a human review that rubber-stamps a ranked list is not meaningful human involvement.

HR teams also need to know that a change in how a tool is used can change its regulatory status, since a summarisation tool repurposed for sifting is a different thing in law from the tool that was bought.

Managers hold a different set of duties, and they are usually the least trained group in the organisation. Where a high-risk system is deployed, Article 26(2) requires the deployer to assign human oversight to natural persons who have the necessary competence, training and authority. Authority is the word managers most often overlook. A person told to supervise a system, who fears being marked down for slow throughput when they override it, does not have real authority, and the oversight arrangement is defective no matter what the policy says.

Managers set that culture. They also decide what tools their teams use in practice, they are the people staff ask when a rule is unclear, and they are the ones who will be asked whether their team’s training was appropriate to the work. A manager’s literacy therefore includes knowing which systems the team touches, what the vendor said the system is for, what the team is allowed to decide with it, how to escalate, and how to record that this happened.

Managers also carry the evidence burden described later in this course. Under Article 4 the organisation must be able to show what it did, and the person who knows which contractor started using a new tool last month is the line manager rather than the compliance function. Making that reporting easy is a design problem worth solving early.

Customer-facing teams meet the third set of duties, because they operate at the point where the organisation’s use of AI becomes visible to the public. Staff in service, sales and support need to know the disclosure rule and apply it consistently, since Article 50 transparency obligations apply from 2 August 2026 and the next lesson deals with them in full. They need to know what to do when a customer asks whether they are speaking to a machine, which is to answer honestly and immediately.

They need to know that customers affected by certain decisions may have a right under Article 86 to an explanation of the role the AI system played, and that the correct response to such a request is to route it rather than to improvise. They also need firm limits on what an assistant may state to a customer without a check, because a fabricated policy detail delivered in a support ticket becomes a commitment the organisation may have to honour.

Two further populations are worth naming even though they are smaller. Procurement staff decide which systems enter the organisation, and their literacy determines whether the instructions for use, the intended purpose and the supplier’s own AI Act position are ever obtained. Developers and data teams need the deepest technical content, and they are the group most likely to trigger Article 25 by fine-tuning a model or changing an intended purpose, so they need to understand the line rather than only the tooling.

The practical method for building role-specific material is to start from tasks rather than job titles. List what each population actually does with AI in a normal week, identify the decisions and the data involved, and write the training against that. A recruiter who screens two hundred applications a week and a recruiter who writes job adverts have the same title and need different literacy. Training built from tasks tends to be shorter, more specific and far easier to defend than training built from an organisation chart.