Since 2 February 2025, the EU Artificial Intelligence Act has required companies that use AI to look after their employees' AI literacy. The requirement doesn't only apply to AI developers. It also covers a company whose sales manager writes emails with ChatGPT, and an accounting team that processes invoices with an AI tool.
In July 2026, the requirement was softened, and some companies concluded it no longer applies. That's not the case: the wording changed, but the obligation remains.
What does Article 4 say?
The original text of the AI Act required companies to ensure "a sufficient level of AI literacy". The Digital Omnibus (Regulation (EU) 2026/1744), in force since July 2026, changed that wording. Article 4 now requires providers and deployers of AI systems to take measures to support the development of AI literacy among their staff and other people using AI on their behalf.
In practice, this means two things:
- A company no longer has to guarantee that every employee reaches a specific level of knowledge.
- A company still has to take action. If AI is used in the company and employees have received no training or guidance, the obligation isn't met.
Since 2 August 2026, national market surveillance authorities supervise compliance with this requirement. The AI Act doesn't set specific fine amounts for breaches of Article 4; each member state sets its own penalties.
Who does it apply to?
Under the AI Act, a "deployer" is any organisation that uses an AI system in a professional capacity. The risk level doesn't matter here: Article 4 applies to simple chatbots too, not only to high-risk systems.
If your employees use ChatGPT, Copilot, Gemini or any other AI tool at work, the requirement applies to you. It covers not only full-time staff but also contractors and service providers who use AI on your behalf.
What should an ordinary company do?
The AI Act doesn't prescribe a specific training programme and doesn't require certificates. The European Commission's guidance stresses that measures should match employees' knowledge and what AI is used for: a developer and a customer service specialist need different things. For companies that only use AI and don't build high-risk systems, this is usually the main item on the AI Act compliance list.
A simple plan:
- List the AI tools your employees use. Including those used through personal accounts.
- Set the rules. Which tools can be used, which data must not be uploaded to them, and who checks the output.
- Train employees based on their work. How AI works, where it makes mistakes, how to check its output, and what risks it brings (data protection, made-up facts).
- Document it. Who received which training and when. The Commission states that internal records are enough.
- Keep it up to date. When tools change or new employees join.
Why training is the simplest route
"Taking measures" can mean many things: writing internal guidelines, buying an e-learning course, appointing a responsible person. Training solves several things at once: employees gain knowledge, everyone hears the same rules, and the company has clear proof that action was taken.
Technically, an hour-long lecture on the history of AI could count as a "measure", but it won't change how anyone works. AI training for companies where employees work on their own real tasks delivers both results: the company meets the requirement, and the team uses AI more safely and effectively.
Where to start?
If your employees already use AI, and they most likely do, start with a list of tools and one training session. That covers most of what Article 4 requires and lays the groundwork for the next steps.
Not sure whether other AI Act requirements apply to you? Take our AI Act compliance check or get in touch.