AI literacy requirement: what Article 4 now asks of you

Your people already use AI. In Copilot, in the CRM, in a chat window someone opened on their own. The EU AI Act expects you, as the employer, to make sure they understand what they are doing. That is Article 4, and it applies to every organisation that uses AI, large or small. In July 2026 the article was amended. Below: what it says now, who it covers and how to handle it without turning it into a paper exercise.

This article is general information, not legal advice. Have your approach checked by your lawyer or data protection officer.

What does Article 4 say?

Article 4 of the AI Act (Regulation (EU) 2024/1689) covers AI literacy. It has applied since 2 February 2025 to providers and deployers of AI systems. A provider builds an AI system and places it on the market. A deployer uses an AI system under its own authority. Most companies are the latter.

The original text asked for measures to ensure, to their best extent, a sufficient level of AI literacy. The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, rewrote that. Providers and deployers must now take measures to support the development of AI literacy among their staff and others operating AI systems on their behalf. The new text states explicitly that this does not require guaranteeing a specific level for any individual. The European Commission and the Member States must support those efforts, including with practical examples.

In short: the obligation stayed, the bar moved. You have to take measures you can show. You do not have to guarantee a level of knowledge per employee.

There is no required number of hours, no exam and no recognised certificate. What is appropriate depends on who works with AI, for what, and who is affected when it goes wrong. Filling that in is up to you.

Is AI literacy still mandatory after the change?

Yes. Article 4 was neither removed nor postponed. The delays in the omnibus concern other parts, such as the requirements for high-risk AI systems listed in Annex III, which under the amended text apply from 2 December 2027. What did change: the obligation is one of effort, not of result. That makes it easier to comply with, and easier to let slide.

If you use high-risk AI, for example in recruitment, a stricter requirement applies on top. Article 26 asks you to assign human oversight to people with the necessary competence, training and authority. That takes more than a general session. More on that category in AI Act and GDPR: what to arrange.

Who does it cover in your company?

Everyone who works with AI on your behalf or decides on its use. That is a wider group than the people typing prompts.

• Direct users: anyone operating an AI tool, from marketer to planner.
• Reviewers: managers who decide based on an AI summary or recommendation.
• Purchasing decision-makers: management, IT and procurement, who need to judge whether a tool is suitable and allowed.
• Contractors and third parties: freelancers, temps and service providers using AI on your behalf. Cover this in your agreements with them.

Customers using your AI are not covered; the transparency rules in Article 50 apply to them. And the group of employees who truly do nothing with AI shrinks every year, as AI features appear unasked in Office, CRM and accounting software.

What level does each role need?

Decide per group what people need to be able to do. This split works as a starting point in most companies.

All employees

Know what AI is and is not, recognise that output can be wrong, know which data must not go in and who to ask. A short introductory session plus one page of house rules is enough. Repeat it at onboarding and every year.

Heavy users

Marketing, sales, support and administration. They need to check output, verify sources and know when to bring in a person. Use a hands-on session with their own documents and tasks.

Managers and reviewers

They need to spot limitations and bias in output and know when not to follow AI advice. Focus the session on decisions, not tools.

Management, IT and procurement

The difference between provider and deployer, the risk categories in the regulation, the questions to ask a supplier and the overlap with the GDPR. Link this to a fixed check for new tools.

Users of high-risk AI

Everything above, plus knowledge of the specific system, logging, human oversight and documentation duties. This is the only group for which it gets genuinely demanding.

What goes into the training?

Whatever the format, the same topics keep coming back.

• What a language model does: it predicts what sounds likely, not what is true. This single insight prevents most mistakes.
• Checking: never take figures, legal articles, names or quotes from AI output without verifying them. See also preventing AI hallucinations.
• Data: which information must not go into an AI tool, and the difference between a business account with a data processing agreement and a personal account.
• Bias: where unfair outcomes come from and why they weigh more heavily in decisions about people.
• Human oversight: when AI proposes and a person decides, and who that person is.
• House rules: which tools are approved, how to request a new one and where to report problems.

Practise with your own material. A session full of other companies' examples scores well on the evaluation form and changes little about the work. A session with your own quotes, emails and files does.

How do you make it demonstrable?

After the amendment, it is even more about showing that you take measures. Five documents make that visible.

• An overview of the AI systems you use: tool, supplier, users, purpose and what data goes in. Including use that grew outside IT.
• A role overview: which groups exist and what each group needs to be able to do, with two sentences on why that fits the risks.
• Attendance records: date, participants, topics and who ran the session.
• An adopted AI policy with a date and version number. How to set one up is in writing an AI policy.
• A refresh agreement: new employees get the introductory session, and the whole is reviewed at least once a year.

Keep it in one dated folder. When a customer, a contracting authority or a regulator asks, you have the answer straight away.

A four-week plan

Week 1: take stock. Ask every team which AI tools they use, including free accounts. Put it on one page. Surprises are normal.

Week 2: set roles and levels. Sort people into the groups above and write down for each group what is sufficient and why.

Week 3: train. Start with the largest group and the roles with the most risk. Use your own documents.

Week 4: record it. Adopt the policy, file the attendance records, put the refresh date in the calendar and appoint an owner who checks new tools.

Standalone training or part of something you are doing anyway?

Many companies buy AI literacy as a one-off training day. That is a measure, and it meets the letter of the law. But afterwards people often do not know which of their own tasks they should do differently.

The alternative: train people on the AI applications you are actually introducing, using their own work as material. Then the training is a by-product of something that adds value. How to choose between a workshop, an analysis and building straight away is covered in AI workshop, AI assessment or implementation.

Where to start

The inventory in week 1 is most of the work, and it shows more than your compliance position. You see where AI already saves time and where it brings risks nobody had noticed. If you want to use that inventory to decide where AI adds the most value in your processes, that is what the AI Opportunity Audit does. It does not make you compliant; that remains your own responsibility. It does give you the overview to build your policy and training on.

Sources: AI Act, Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 (Digital Omnibus on AI), Dutch Data Protection Authority (Autoriteit Persoonsgegevens): getting started with AI literacy, in Dutch. Status: October 2026.