AI Literacy Training: What the EU AI Act Requires
Article 4 of the EU AI Act requires AI literacy from every company using AI tools. What changed with the Digital Omnibus and how to train and document it.
Yes: if your team uses AI tools such as ChatGPT or Microsoft Copilot at work, Article 4 of the EU AI Act requires you to actively support their AI literacy. There is no mandatory certificate or exam. What you need is a set of sensible measures – usually hands-on training plus clear internal rules – and a simple internal record that shows what you did.
What Article 4 of the AI Act requires
The AI Act, Regulation (EU) 2024/1689, covers AI literacy in Article 4. In its current wording, providers and deployers of AI systems “shall take measures to support the development of AI literacy” of their staff and of anyone else operating or using AI systems on their behalf. The measures should reflect people’s technical knowledge, experience, education and training, and the context in which the AI is used.
What changed in 2026
Article 4 has applied since 2 February 2025. The original text asked companies to ensure, “to their best extent, a sufficient level” of AI literacy. The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote the article with effect from 27 July 2026:
- The obligation still applies to providers and deployers.
- No specific or “sufficient” level is mandated any more. The focus is on taking reasonable steps, not on guaranteeing an outcome.
- The Commission and Member States are tasked with supporting businesses, explicitly including SMEs.
According to the European Commission’s AI literacy Q&A, national market surveillance authorities supervise and enforce the rules from 2 August 2026. The AI Act itself does not set a specific fine for Article 4. Austria’s regulator RTR, through its AI Service Desk, notes that a lack of training can still become relevant under civil liability if poor use of AI leads to damage.
Art. 4 AI Act over time
- Art. 4 applies to providers and deployers of AI systems.
- The Digital Omnibus rewrites Art. 4: measures instead of a “sufficient level”.
- National market surveillance authorities supervise the rules.
Provider or deployer: who is covered?
The AI Act defines several roles. Two matter for most companies:
| Role | Who it is | Typical example |
|---|---|---|
| Provider | Anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark, paid or free | A software company selling its own AI product |
| Deployer | Anyone using an AI system under their authority in a professional context | An accounting firm using Copilot; a trade business drafting quotes with ChatGPT |
Most small and medium-sized businesses are deployers. Article 4 applies to both roles. Purely personal, non-professional use is out of scope.
One edge case: if you have an AI system built specifically for you and put it into service under your own name – a custom chatbot, for instance – you may count as a provider too. That is worth checking case by case.
It also matters who is included. The Commission counts not only employees but also other people working with the AI system on your behalf, such as freelancers or service providers.
What AI literacy looks like in practice
The AI Act describes AI literacy as the skills, knowledge and understanding needed to use AI systems in an informed way and to be aware of their opportunities, risks and possible harm. There is no one-size-fits-all programme. The Commission suggests considering four things:
- a general understanding of AI across the organisation,
- your role (provider or deployer),
- the risks of the specific systems you use,
- what the people using them already know.
In practice, not everyone needs the same. Someone who occasionally polishes an email with AI mainly needs clear rules and a feel for where it goes wrong. Someone who analyses customer data or publishes AI-assisted content needs more depth. Management needs to know which tools are in use and who is responsible for what.
High-risk AI systems, for example in recruitment or credit scoring, come with stricter human oversight duties on top. This article focuses on the common case: everyday office and creative tools.
What a good AI training should cover
The basics, without jargon
How does a language model produce its answers? Why does a wrong answer sound just as confident as a right one? Once people understand this, they become both more careful and more confident with any tool.
Prompting with real tasks
Training sticks best when people practise on their own work: drafting a quote, summarising a meeting, replying to a customer. Good prompts give context, a goal, a format and examples. A shared library of prompts that work saves a lot of time afterwards.
Data protection and the GDPR
Personal data should only go into tools that have a legal basis and the right contract in place, such as a data processing agreement. Your team should know which tools are approved and which data never goes in: health data, HR files, full customer lists.
Confidentiality and trade secrets
Even without personal data, an input can be sensitive: contracts, pricing, source code. Check whether a provider uses your inputs for training, and decide whether personal accounts are off-limits for work.
Hallucinations and fact-checking
AI tools sometimes invent facts, sources or figures. The rule for the team is simple: anything that leaves the company or supports a decision gets checked by a person. Be extra careful with numbers, names, quotes and legal questions.
Labelling AI content
Article 50 of the AI Act sets out transparency duties. Deployers must disclose deep fakes – realistic AI-generated or manipulated images, video or audio. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless a person has reviewed it and takes editorial responsibility. And anyone talking to a chatbot should be able to tell they are dealing with AI. Your team should know when a notice is needed and what it looks like.
Depending on your use, copyright and employment law belong in the programme too; the RTR lists both as training topics.
Planning the training in five steps
- Take stock. Which AI tools are used, by whom, and for what? Ask openly, including about personal accounts. For typical use cases, see our article on AI in small business.
- Set the rules. A short internal AI policy covers which tools are allowed, which data is off-limits, who checks results and when to label content.
- Group your people. Occasional users, heavy users and the people responsible need different depth.
- Train with practice. A little theory, lots of hands-on work on real tasks, and room for everyday questions.
- Refresh. When new tools arrive, new people join or the rules change. A fixed date once a year keeps it from slipping.
Documentation: what to record
According to the Commission, you do not need a certificate. An internal record of trainings and other measures is enough. The RTR recommends keeping:
- a written AI strategy, even if it is a single page,
- an internal AI policy that everyone knows,
- a training plan: who learns what, and how often,
- per person: type of training, provider, content, date and any refreshers.
For a small business, a well-kept spreadsheet often does the job. For ideas on how other organisations build AI literacy, the Commission collects examples in its repository of AI literacy practices. Copying them does not automatically mean you comply with Article 4, though.
Training formats that work for SMEs
| Format | Good for | Effort |
|---|---|---|
| Workshop on-site or online (half or full day) | A shared start, agreeing on rules, practising real tasks | Medium, one-off |
| Short sessions (15–30 minutes) | Refreshers, going deeper on single topics | Low, ongoing |
| Onboarding module | New team members | Build once, then low |
| Internal point of contact | Everyday questions, assessing new tools | Low, ongoing |
| Prompt library and cheat sheet | Repeating good results faster | Low |
A sensible mix: one workshop to get started, then short formats. That keeps the knowledge alive without taking the business offline for days.
A quick note
This article gives an overview of the legal situation as of October 2026 and is not legal advice. For your specific case, especially with high-risk applications or your own AI development, talk to a lawyer or to your national AI authority.
Training built around your work
We run AI training for companies: with the tools your team actually uses, with tasks from your day-to-day work, and with data protection and AI Act literacy covered. On-site or online. If you would like to see what that could look like for you, get in touch.
Frequently asked questions
Do employees who use ChatGPT need AI training?
Yes. According to the European Commission, staff who use tools like ChatGPT at work should at least be informed about the specific risks, such as made-up answers (hallucinations). How much training they need depends on what they use the tool for.
Do we need a certificate to prove AI literacy?
No. The European Commission states that no certificate is needed. An internal record of the trainings and other measures, who took part and what was covered, is enough.
When did the AI literacy obligation start?
Article 4 of the AI Act has applied since 2 February 2025. The Digital Omnibus amended it on 27 July 2026: the obligation stays, but a specific level of literacy is no longer required. According to the Commission, national authorities supervise the rules from 2 August 2026.
Are there fines for not training staff on AI?
The AI Act does not set a specific fine for Article 4; supervision sits with national market surveillance authorities. Austria's RTR also points out that missing training can matter under civil liability if poor AI use causes damage.
Does the AI literacy rule apply to small businesses?
Yes. Article 4 has no exemption based on company size. The measures should fit your business, though: a team using two AI tools needs a different programme than a corporation building its own AI.
