For businesses whose staff use AI at work in the EU, including US companies whose AI output is used there, this guide explains what Article 4 of the AI Act requires after its 2026 amendment and how to meet it.
What you'll learn
- What the AI literacy obligation requires, and how the Digital Omnibus changed it in July 2026
- Who has to comply, from ChatGPT users to contractors and US companies
- Whether employees need training or a certificate
- What AI literacy measures should cover, following the Commission's guidance
- Who enforces the rule from August 2026, and how to document what you did
Every business whose staff use AI at work in the EU has to support their AI literacy under Article 4 of the EU AI Act, in force since February 2, 2025. The Digital Omnibus changed the duty in July 2026: it now asks for measures that support the development of AI literacy and states that no specific level has to be guaranteed for any individual. The European Commission says no certificate is needed, and national authorities supervise the rule from August 2026. This guide covers who must comply, what the measures should cover, how enforcement works, and how to document what you did.
Most businesses now have employees using AI tools every day, whether IT approved them or not. The EU AI Act has an answer for what an employer owes those employees: AI literacy. The duty is short, it applies to almost everyone, and in July 2026 it was rewritten.
This guide explains what the rule requires now, how the change affects what you need to do, and how to meet it without a training industry's help. It ends with how to document your measures, which is what an authority will ask for.
What does the AI literacy obligation require?
The AI literacy obligation requires providers and deployers of AI systems to take measures that support the AI literacy of their staff and of others who use AI on their behalf. As amended in July 2026, Article 4 of the EU AI Act says these measures take into account people's "technical knowledge, experience, education and training" and the context of use, and that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".[1]
The AI Act defines AI literacy as the skills, knowledge and understanding needed "to make an informed deployment of AI systems" and to be aware of "the opportunities and risks of AI and possible harm it can cause".[2] In practice that means knowing what a tool is good for, where it goes wrong, and what to check. The gap is real: in 2025, 19.95% of EU enterprises with 10 or more employees used AI, and among enterprises that had considered AI but not used it, 70.89% named a lack of relevant expertise as a reason.[9]
The duty has applied since February 2, 2025.[3] What changed in 2026 is how much it asks, and the Commission and member states now have to help, "in particular SMEs", including by publishing practical examples.[1]
What changed in Article 4 in 2026?
The Digital Omnibus replaced a duty to reach a "sufficient level" of AI literacy with a duty to support its development. The original 2024 text required measures "to ensure, to their best extent, a sufficient level of AI literacy".[2] The European Commission confirms that since the amendment took effect in mid-July 2026, AI literacy "remains an obligation" but "no specific – or 'sufficient' - level is mandated".[3]
| Article 4 as adopted (2024) | Article 4 as amended (July 2026) | |
|---|---|---|
| The duty | Ensure, to the best extent, a sufficient level of AI literacy[2] | Take measures to support the development of AI literacy[1] |
| Required level | "Sufficient", undefined | None for any individual[1] |
| Support | Not addressed | Commission and member states support businesses, especially SMEs[1] |
| Guidance | Not addressed | Commission publishes practical examples; the AI Board adopts recommendations[1] |
The change matters less for what you do than for how you judge it. Under the old wording, a business could worry that its staff were never quite "sufficient". Under the new one, the question is whether you took sensible measures for the people and tools involved.
Many training providers and older guides still describe the 2024 wording, and some call it a "training obligation". The current text is on the Commission's AI Act Service Desk, marked as amended.[1]
Who has to comply with Article 4?
Every business that uses an AI system professionally has to comply, because it counts as a deployer. The European Commission gives the plainest example: a company whose employees use ChatGPT to write advertising text or translate must comply, and staff "should be informed about the specific risks, for example hallucination".[3] The duty also covers "other persons" acting on the business's behalf, such as contractors and service providers.[3]
The Commission even names clients as a possible audience: where customers use an AI system you provide, for example a chatbot that advises them, helping them understand its limits can be part of the same effort.[3]
The AI Act reaches beyond the EU's borders. It applies to deployers established in the EU, and to providers and deployers in other countries "where the output produced by the AI system is used in the Union".[2] A US company whose AI-written content or decisions reach EU customers can therefore fall under it.
Providers, the companies that build AI systems, have the same duty for their own staff.[1] A business that runs a custom agent built for it is a deployer of that agent and owes AI literacy to the staff who use it; whoever built the agent owes it to its own people.
Do employees need AI training or a certificate?
Employees need measures that fit the AI they use, but no certificate. The European Commission states: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives."[3] Germany's Bundesnetzagentur, the national AI authority, adds that no standardized training is prescribed and that measures can be run internally or externally.[4]
Training is the usual measure, but not the only one. The Commission says the right form depends on the people and the tools, and warns that simply relying on a tool's instructions for use, or asking staff to read them, "might be ineffective".[3] A short session on the tools in use, written rules for what may be entered into them, and a contact for questions often do more than a long generic course.
The Commission also says there is no obligation to measure employees' AI knowledge.[3] Tests are allowed where they help, for example before staff use a tool on customer data, but they are not required.
What should AI literacy measures cover?
AI literacy measures should cover what AI is, which AI your business uses, the risks of those tools, and what each group of staff needs to know. The European Commission lists four minimum considerations: a general understanding of AI in the organization, the organization's role as provider or deployer, the risks of the AI systems in use, and measures built on that analysis for each group's knowledge and context.[3] The following sequence turns those into work.
List the AI in use
Group the people
Name the risks per tool
Match the measure to the group
Include contractors
Repeat when tools change
The Commission also encourages covering the legal side, including the AI Act itself, and basic principles of ethics and governance.[3] For most small businesses, a page of rules on what data may go into which tool covers the most common legal risk. Our guide to using ChatGPT under the GDPR shows which plans come with a data processing agreement, which decides what staff may enter.
Who enforces AI literacy, and what happens if you ignore it?
National market surveillance authorities enforce AI literacy, starting in August 2026. The European Commission confirms that supervision and enforcement apply from August 2026 and that the AI Office does not enforce Article 4 itself.[3] In Germany, the Bundesnetzagentur has been the AI Act's market surveillance authority since a federal law took effect on July 29, 2026.[5]
Penalties come from national law. The Commission says authorities could impose penalties for breaches of Article 4 under national rules, proportionate to the case, and that sanctions become more likely "if there is proof of an incident due to lack of appropriate training".[3] Article 4 is not among the obligations the AI Act's own penalty article lists with fixed fine ranges.[6] Our guide to AI fines in Europe sets out what the AI Act and the GDPR fine for.
The law no longer asks whether your staff are literate enough. It asks what you did to help them get there.
The bigger risk is indirect. Germany's Bundesnetzagentur notes that a lack of AI literacy can be seen as a breach of the duty of care, especially when it leads to harm.[4] If an employee pastes customer data into an unapproved tool or publishes an invented fact, the first question will be what the business told staff about that risk.
Do employee representatives have a say in AI literacy training?
In Germany, yes: a works council has a co-determination right over how in-company training is carried out. Section 98(1) of the Works Constitution Act gives the works council a say in how in-company vocational training is carried out, and section 96 obliges the employer to determine training needs when the council asks.[8] AI literacy training run inside the company falls under these rules.
The practical answer is to plan the AI literacy measures together with the rollout of the tools themselves. A works council that is already informed about planned AI use, as German law requires, will ask what staff learn about it in the same meeting. Our guide on when employees must be consulted about AI covers the wider rules in the US, the EU and Germany.
Elsewhere in the EU, the rules differ by country, and many have no specific co-determination right over training. Telling staff what the measures are and why they exist still makes them more effective: people take a briefing on hallucinations more seriously when they know it is meant to protect them.
What extra applies to high-risk AI?
High-risk AI needs more than general AI literacy: people assigned to oversee it need specific competence. Article 26 of the AI Act requires deployers to assign human oversight to people "who have the necessary competence, training and authority".[7] The European Commission notes that for such systems, relying on the instructions for use is not enough and further measures are necessary.[3]
For high-risk systems listed in Annex III, such as AI used in hiring or to evaluate workers, these duties apply from December 2, 2027.[7] Our EU AI Act guide for small businesses covers the other duties of deployers.
The people who approve an AI agent's actions are the clearest case for deeper training, high-risk or not. Our guide on what human-in-the-loop means in practice shows why approval without understanding turns into rubber-stamping.
How do you document AI literacy?
Document AI literacy with an internal record of what you did, for whom and when. The European Commission says an internal record of trainings or other initiatives is enough, and Germany's Bundesnetzagentur recommends documenting measures so that compliance with Article 4 can be shown at any time.[3][4] A simple table, kept up to date, covers what an authority would ask.
| Record | Example entry |
|---|---|
| AI tools in use | ChatGPT Business for drafting; a quoting agent in the CRM |
| Groups of users | Sales team (daily), managers (approve output), office staff (occasional) |
| Risks covered | Invented facts, customer data in prompts, wrong totals |
| Measure per group | 45-minute briefing; one-page usage rules; approval checklist |
| Date and attendees | Date of each session and who took part |
| Next review | When tools change, or at least yearly |
The record is also useful beyond compliance. It shows which tools are in use, who relies on them, and where a new tool needs a briefing before anyone uses it.
When does this matter for an AI agent?
AI literacy matters most for the people who work alongside an agent: those who give it tasks, check its output, or approve its actions. An agent that drafts quotes or answers customers is only as safe as the person who reviews what it produces, and Article 4 asks you to support that person's understanding of the tool.[1] A short, specific briefing for those people is the most useful AI literacy measure most businesses can take.
Rolling out an agent is the natural moment for that briefing. Our guide on how to onboard an AI agent covers the first 30 days with a new agent. For the choice between a general AI tool and an agent built around your own processes, see what a custom agent is and when to build one.
Frequently asked questions
What does Article 4 of the EU AI Act require? Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other people using AI systems on their behalf, taking into account their knowledge, experience and the context of use. Since the Digital Omnibus amendment of July 2026, it states that no specific level of AI literacy has to be guaranteed for any individual.
Do I need to train my employees on AI under the EU AI Act? You need to take measures that support their AI literacy, and for most businesses that means short training or guidance on the AI tools staff actually use. The European Commission says there is no need for a certificate and that an internal record of trainings or other initiatives is enough. Relying only on a tool's instructions for use may be ineffective, according to the Commission.
Does the AI literacy requirement apply if employees only use ChatGPT? Yes. The European Commission says a company whose employees use ChatGPT, for example to write advertising text or translate, must comply with Article 4, and that staff should be informed about specific risks such as hallucinations. The measures can be short when the use is simple and low-risk.
Is there a fine for not complying with the AI literacy obligation? Article 4 is not among the obligations the AI Act's penalty article lists with fixed fine ranges. National market surveillance authorities supervise it from August 2026 and can impose penalties under national law, proportionate to the case. The Commission notes that sanctions are more likely if an incident happens because staff lacked appropriate training.
Notes
- AI Act Service Desk, Article 4: AI literacy, consolidated text as at July 27, 2026, including the Digital Omnibus amendments, accessed October 16, 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal, July 12, 2024, Articles 2, 3(56) and 4 as adopted, accessed October 16, 2026.
- European Commission, AI Literacy: Questions and Answers, accessed October 16, 2026.
- Bundesnetzagentur, KI-Kompetenz, in German, accessed October 16, 2026.
- Bundesnetzagentur, press release on the AI market surveillance act, July 29, 2026, in German, accessed October 16, 2026.
- AI Act Service Desk, Article 99: Penalties, consolidated text as at July 27, 2026, accessed October 16, 2026.
- AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems, and Article 113, consolidated text as at July 27, 2026, accessed October 16, 2026.
- Works Constitution Act (BetrVG), section 98, and section 96, in German, accessed October 16, 2026.
- Eurostat, Use of artificial intelligence in enterprises, data extracted December 2025, accessed October 16, 2026.
