AI Act AI Literacy: What Article 4 Asks of Small Firms
Short answer: Since February 2025, Article 4 of the EU AI Act has required organisations that use AI systems to take steps on their staff's AI literacy. The July 2026 Digital Omnibus reworded it: companies must take measures to support AI literacy, without guaranteeing any particular level. No certificate is required. A short training session, written rules and a simple record usually cover it.
Few EU rules have caused as much confusion in small businesses as Article 4 of the AI Act. Since February 2025, inboxes have filled with offers of “mandatory certified AI training”, often with warnings about multi-million fines. Neither claim gets to the heart of it.
On top of that, the text changed in summer 2026. Many guides online still describe the old wording.
What Article 4 actually requires
The original version, in force since 2 February 2025, required providers and deployers of AI systems to take measures to ensure, “to their best extent”, a sufficient level of AI literacy among their staff.
The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, rewrote Article 4. Providers and deployers now have to take measures to support the development of their staff’s AI literacy. The new text states explicitly that this doesn’t require anyone to guarantee a specific level of AI literacy for any individual. The Commission is to publish practical examples, and the AI Board is to adopt recommendations.
The regulation was published in the Official Journal on 24 July 2026 and entered into force on the third day after that. The obligation hasn’t disappeared. It’s just worded more realistically.
- 2 Feb 2025Article 4 (AI literacy) and the prohibitions apply.
- 8 Jul 2026Digital Omnibus on AI adopted.
- 27 Jul 2026New Article 4 wording in force: "take measures to support" instead of "ensure".
- 29 Jul 2026Germany's AI market surveillance act takes effect; Bundesnetzagentur in charge.
- Aug 2026Supervision and enforcement by national authorities begin.
- 2 Dec 2027Obligations for Annex III high-risk systems apply (postponed).
Source: Regulations (EU) 2024/1689 and 2026/1744; German KI-MIG; European Commission
Who it applies to
Under the AI Act, a deployer is anyone using an AI system under their own authority in a professional context. That covers practically every company whose staff use ChatGPT, Copilot or an AI translation tool. Company size makes no difference.
The European Commission’s AI literacy Q&A addresses this exact case. Any company whose employees use ChatGPT for marketing copy or translation should comply and inform staff about specific risks, such as hallucinations. The obligation reaches beyond employees to people working with the systems on the company’s behalf, which may include contractors and service providers.
Companies outside the EU aren’t automatically off the hook. The AI Act also reaches certain providers and deployers outside the Union where the AI output is used inside it. Picture a UK agency running an EU subsidiary, or delivering AI-generated work to EU clients. That agency should at least check where it stands.
What’s enough, and what isn’t needed
The Commission is refreshingly direct here. No certificate is needed. There’s no mandatory course with a fixed number of hours. Appropriate measures depend on which systems are used, for what, by people with what background, and with what risk to those affected. Simply relying on the vendor’s instructions, though, is often not enough according to the Commission.
For a typical small office using AI for writing, email and the odd bit of research, we’d consider this package proportionate:
- Short training (60 to 90 minutes): how language models work, what hallucinations are, what must never go into a chat
- Written usage rule listing approved tools, off-limits data and the duty to check outputs
- Named contact for questions and new tools
- Record of date, attendees and content
- Refresher when new tools arrive or once a year
Higher-risk uses, such as AI helping with hiring, credit decisions or medical questions, need more. Extra obligations apply there, and for high-risk systems that includes training for human oversight. The Omnibus has, however, pushed those high-risk rules back to December 2027 and August 2028.
What the training should cover
Good short training is practical rather than academic. It answers four questions everyone on the team has.
How does the tool roughly work? Language models generate likely text; they don’t look things up in a database. That explains why it makes mistakes. Our piece on AI hallucinations works well as a basis.
What can I type in? This is about data protection and confidential information. The rules from our ChatGPT and GDPR guide can be lifted straight into your policy.
How do I check results? Figures, names, deadlines and sources against the original before anything leaves the company.
When do I need to label something? Since August 2026, transparency obligations apply to certain AI content such as deepfakes. Our guide to disclosing AI-generated content explains what that means for businesses.
How to document it
Nobody prescribes a format. The Commission suggests keeping an internal record of the training and other measures. Here’s a simple table that does the job:
| Date | Measure | Attendees | Content | Owner |
|---|---|---|---|---|
| 5 Nov 2026 | Short training: AI at work, 75 min | 6 people (list) | How it works, hallucinations, privacy, checking | J. Patel |
| 5 Nov 2026 | Usage rule sent, acknowledged by email | everyone | approved tools, off-limits data | J. Patel |
Add a list of the AI tools in use and what they’re for. When a new one arrives, update the list and the rule. For a small business with everyday uses, nobody will expect more.
Four persistent myths
“The obligation only starts in August 2026.” Wrong. Article 4 has applied since 2 February 2025. August 2026 is when national supervision and enforcement begin.
“It only affects companies with high-risk AI.” Also wrong. Article 4 applies to all providers and deployers regardless of risk. Risk only determines how extensive the measures should be.
“An online course with a certificate settles it.” A course can be one element. If it has nothing to do with the tools and tasks in your business, though, it misses the point. The Commission stresses that measures should fit the context.
“The Omnibus scrapped the obligation.” No. The wording got softer, but the duty to act remains. Doing nothing at all doesn’t satisfy the new version either.
Who enforces it
Enforcement sits with national market surveillance authorities, not with the EU’s AI Office. Germany, for example, passed its implementing law in July 2026 and named the Bundesnetzagentur as the main market surveillance authority and central point of contact, with the financial regulator BaFin responsible for supervised financial firms.
The AI Act sets no fine amounts for Article 4; the Commission points to national law and requires proportionate penalties. Anyone advertising million-euro fines for missing training is overselling. The more serious point is different. If an employee causes harm using an AI tool, people will ask whether the company did enough to make them competent.
Your next step
Companies rolling out AI tools or building their own assistants can plan rules and training in from the start; for larger projects, studios such as OnlineBuilders develop and run AI systems.
For most, an afternoon will do. List the AI tools your team uses, write the five lines of your usage rule and book a date for the short training. Other topics on law and risk are collected under privacy and limits.
Step by step
- List your AI tools Write down which AI systems are used in the company, official and unofficial, and by whom.
- Map roles and risks For each role, note what AI is used for and what could go wrong.
- Choose measures Short training, written usage rules, a named contact. Scale the effort to the risk.
- Deliver and record Note date, attendees, content and the person responsible.
- Review regularly Update when new tools or uses appear, or at least once a year.
Questions people ask
Does this apply to sole traders with no staff?
Article 4 refers to staff and to people dealing with AI systems on the organisation's behalf. Working alone, there's no staff to train. If you hand AI-related work to freelancers or contractors, the European Commission says they may need to be included.
Do I need a certificate or an accredited course?
No. The Commission's own Q&A says plainly that no certificate is needed. What counts as appropriate depends on the tools, the use and the risk involved.
Does the AI Act apply to UK or US companies?
It can. It covers deployers established in the EU and, in certain cases, providers and deployers outside the EU whose AI output is used in the EU. A UK firm with an EU subsidiary or EU-facing AI services should check its position.
What happens if we do nothing?
The AI Act itself sets no specific fine for Article 4; penalties are left to national law and must be proportionate. The more practical risk is liability if an untrained employee causes damage using an AI tool.
