EU AI Act AI Literacy (Article 4): What Employers Need to Do in 2026

"Is AI training mandatory now?" is one of the questions HR managers ask us most often. The short answer: not as a course, but as a set of measures. The longer answer changed in July 2026, and much of what you find online still quotes the old wording.

This article covers what Article 4 of the EU AI Act says today, what it does not require, and five proportionate measures for a company of 10-200 people. It ends with a one-page record you can copy. It is general information, not legal advice.

What does Article 4 of the EU AI Act say now?

Article 4 is the AI literacy article. It has applied since 02.02.2025. Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, replaced its text in full. The new version has applied since 27.07.2026.

	Original text (from 02.02.2025)	Current text (from 27.07.2026)
The duty	Take measures to ensure, to the best extent, a sufficient level of AI literacy	Take measures to support the development of AI literacy
Who it covers	Staff and other people who operate or use AI systems on the organisation's behalf	The same
What to take into account	Technical knowledge, experience, education and training, the context of use, the people affected	The same
Required level	"Sufficient", not defined	No specific level has to be guaranteed for any individual
Support	Not mentioned	The Commission and member states support providers and deployers, particularly SMEs

The key sentence in the new text is short: the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". The duty moved from a result to an effort. It did not disappear.

AI literacy itself is defined in Article 3(56) of the AI Act: the skills, knowledge and understanding that let people use AI systems in an informed way and be aware of their opportunities, risks and possible harm. In plain words: people know what the tool is good at, how it fails and what they must not put into it.

Does Article 4 apply to my company?

Almost certainly, if your staff use AI at work. Article 4 applies to providers (who build AI systems) and deployers (who use them). A deployer is anyone who uses an AI system under its own authority, except for personal, non-professional use.

In the usual reading, a company whose staff use ChatGPT, Microsoft Copilot, Claude or Gemini for work is a deployer of those systems. That covers most companies we meet, including the ones that never decided to use AI. In the survey we run before every workshop, the question is rarely whether people use AI. It is which account they use.

Three details matter:

• No size threshold. A 15-person company is covered, and so is a municipality.
• Not only employees. The text also covers other people who use AI systems on your behalf, such as contractors.
• It applies everywhere in the EU in the same way. The AI Act is a regulation, so it applies directly in every member state. Supervision is national.

What does Article 4 not require?

Much of the anxiety around Article 4 comes from requirements it does not contain. It does not require:

• A certificate. The European Commission's AI literacy Q&A says plainly that no certificate is needed.
• A test or a score. There is no obligation to measure employees' knowledge of AI.
• A set course. No length, format or syllabus is prescribed.
• An AI officer. No new role or governance structure is required.
• A guaranteed level. Since 27.07.2026 the text says so expressly.

It also has no fine of its own. The AI Act's penalty article (Article 99) does not list Article 4. National market surveillance authorities supervise the AI Act from August 2026, and each member state sets its own penalty rules.

So why do anything? Because the risks Article 4 points at are the same ones that cost money: a client email pasted into a personal account, a confident but wrong figure sent to a manager, a team where three people use AI well and twelve do not use it at all. The measures below take a few days and make AI useful, not only compliant.

One exception deserves attention. If you use AI to screen CVs, assess candidates or evaluate staff, you are in high-risk territory (Annex III of the AI Act), with stricter duties, including trained human oversight. For most of these systems, those obligations now apply from 02.12.2027. Get specific advice before you buy such a system.

AI literacy requirements in practice: five measures for a 10-200 person company

1. Know which AI tools people actually use

Run a short survey: which tools, which accounts (company or personal), for which tasks, and how often. It takes ten minutes to fill in and it usually surprises management. It is also the starting point for every other measure.

2. Write the rules on one page

Approved tools and accounts, what data may go where, and who to ask. We teach a traffic light rule: green on any account, yellow on the company account only with a person reading the output, red nowhere. Our AI policy template for employees sets it out in full and you can copy it.

3. Train people on the tools they use

Literacy that sticks is built on the assistant your company already licenses and on your own document types, not on a generic tour of twenty tools. Make it proportionate:

Group	What they need	Typical format
Everyone who uses AI	What the tool is good at, how it fails, the data rule, how to check an answer	A half-day hands-on workshop
Heavy users and assistant builders	A shared prompting method, building and testing team assistants	Function deep-dives in a programme
Managers	Risks, licence decisions, how to measure use	A short briefing plus the workshop
Anyone using AI in hiring or staff evaluation	The system's limits, human oversight, documentation	Specific training before use

If you are choosing a trainer, our article on AI training for staff lists eight questions to ask first.

4. Name one owner

One person who uses AI, answers questions, keeps the rules current and decides on new tools. Not a committee. In a company of 50 people this is a few hours a month.

5. Keep a short record

The Commission suggests keeping an internal record of trainings and other measures. No certificate or formal register is needed, and one page a year does the job.

Copy-paste template: AI literacy record

[Company name]: AI literacy record [year] (owner: [name, role], last updated [date])

AI tools in use

Tool	Account type	Used by	Data allowed (traffic light)	Owner
[Microsoft 365 Copilot Chat]	Work account	All staff	Green and yellow	[name]
[ChatGPT Business]	Company workspace	Sales, marketing	Green and yellow	[name]

Measures taken

Date	Group	Measure	Content	Length
[DD.MM.YYYY]	All staff	AI policy issued and walked through	Approved tools, traffic light rule, contact person	30 min
[DD.MM.YYYY]	All staff	Hands-on workshop on [tool]	Prompting method, data rule, checking answers, own documents	4 h
[DD.MM.YYYY]	Sales, finance	Deep-dive: building a team assistant	Instructions, test cases, ownership	3 h

New starters: walk through the AI policy in week 1, workshop recording or next session within 3 months.

Next review: [date, at least every 6 months or when tools change].

The tables can live in a shared document. What matters is that someone can see at a glance what you did and when.

What about national rules?

The AI Act applies directly, but each member state names its own supervisory authorities and penalty rules. In Estonia, for example, the Consumer Protection and Technical Regulatory Authority (TTJA) says it will supervise AI in products and in higher-risk uses, and the Data Protection Inspectorate (AKI) covers personal data. Data protection law applies alongside the AI Act, so the data rule in your AI policy does double duty.

What to do this week

Next 15 minutes. Write down which AI tools your company pays for, and ask three colleagues which tools they actually use and on which account.

Next 7 days. Send a short survey to everyone. Name an owner. Draft the one-page AI policy from our template and start the AI literacy record.

Next 30 days. Walk the team through the policy, run a hands-on session on the tool you license, and fill in the first rows of the record. Put the next review in the calendar.

If you want help with the workshop or a programme that covers all five measures, that is what we do. Start with a discovery call.

Sources

Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex. European Commission, AI literacy: questions and answers. TTJA, Tehisintellektisüsteemid. Legal facts checked on 30.10.2026. This is general information, not legal advice.