EU AI Act Article 4: Is AI Literacy Training Mandatory?

Short answer: yes. If your company operates in or sells into the EU and your staff use AI tools such as ChatGPT, Copilot or Claude for work, the EU AI Act’s AI literacy requirement in Article 4 applies to you, although since July 2026 it asks you to support your team’s AI literacy rather than guarantee a sufficient level. This guide explains what Article 4 says now, who it covers, how it is enforced and what a practical plan looks like for a small or mid-sized business.

Key takeaway

If your team uses AI at work and you operate in or sell into the EU, Article 4 of the EU AI Act applies. Since July 2026 you must take reasonable, documented measures to support your staff’s AI literacy; you don’t need a certificate, and you don’t have to guarantee a specific level. The AI Act sets no fine of its own for Article 4: penalties are set by each Member State, and national market surveillance authorities enforce it from August 2026.

What Article 4 of the EU AI Act requires

Article 4 now requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and of other people who operate and use AI systems on their behalf; since the July 2026 amendment it no longer requires a “sufficient level” and does not require any individual to reach a specific level.

The AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. Article 4, on AI literacy, was one of the first provisions to apply, on 2 February 2025. In its original wording, providers and deployers had to take measures to ensure, “to their best extent, a sufficient level of AI literacy” of their staff and of other people operating AI systems on their behalf.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote that article. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The new Article 4(1) says that providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, and adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

In plain language:

• It is still an obligation. The word “shall” stayed. The duty was softened, not removed.
• It is about effort, not results. You must take reasonable measures, but you don’t have to prove that every employee reached a set level. The “sufficient level” wording is gone.
• Context still counts. Measures should reflect people’s technical knowledge, experience, education and training, the context in which the AI is used and the people it affects.
• SMEs get support. The Commission and Member States must support and facilitate these efforts, in particular for SMEs, and the Commission is to publish practical examples of how to comply.

What counts as “AI literacy”? Article 3(56) defines it as the skills, knowledge and understanding needed to make an informed deployment of AI systems and to be aware of AI’s opportunities, risks and possible harm. In practice: knowing what the tools can do, where they fail and how to use them responsibly.

Who the AI literacy requirement applies to

The AI literacy requirement applies to providers and deployers of AI systems, and any company whose staff use AI tools at work is a deployer, so almost every business that uses AI and operates in or sells into the EU is covered. Article 4 covers two roles:

• Providers: organizations that develop an AI system, or have one developed, and place it on the market or put it into service under their own name.
• Deployers: any person or organization using an AI system under its authority, except in a purely personal, non-professional activity (Article 3(4)).

Most businesses are deployers: if your staff use ChatGPT to draft emails, Copilot to summarize meetings or Claude to analyze documents at work, your company is one. The European Commission’s Q&A on AI literacy gives a similar example: a company whose employees use ChatGPT to write advertising copy or translate texts should inform them about specific risks such as hallucination.

Three details are easy to miss:

• It applies to all AI systems, not only high-risk ones.
• “Staff and other persons” is wider than your payroll. The Commission mentions contractors, service providers and even clients who operate AI systems on your behalf.
• Location matters less than you might think. The AI Act covers deployers established in the EU, and also providers and deployers outside the EU where the output of the AI system is used in the EU (Article 2). A company outside Europe that serves EU customers shouldn’t assume it is out of scope.

Is there a fine for not training staff?

There can be, but it depends on national law: the AI Act itself sets no fine for Article 4 and leaves penalties to the Member States. Supervision and enforcement are the job of national market surveillance authorities, and according to the Commission’s Q&A these rules apply from August 2026. Article 99 fixes maximum fines for other obligations, such as prohibited practices and transparency duties, and leaves penalties and other enforcement measures, which may include warnings, to the Member States. The Commission confirms that national authorities could sanction infringements of Article 4, in line with proportionality.

So the consequences depend on each country’s implementing law, and some of those laws, such as Spain’s, were still going through parliament in September 2026. Check the rules in the markets that matter to you.

Fines are not the only angle. If an AI-related mistake causes harm (confidential data pasted into an unapproved tool, an invented figure sent to a client), what the company did to prepare its people may come up when due diligence or liability is assessed. A policy and training records put you in a much better position.

What AI literacy measures look like in practice

In practice, AI literacy measures usually follow four steps: take stock of your AI use, train by role, document it and refresh it. There is no official curriculum: the Commission’s Q&A says there is “no one size fit all” and no mandatory training is imposed; measures should fit your role, the risks of the AI systems involved and your people’s knowledge. The four steps in detail:

1. Take stock of your AI use. List the tools in use (including ones people signed up for on their own), who uses them and for which tasks.
2. Train by role. Everyone who uses AI needs the basics; sensitive roles need more depth. Typical content:
   • what generative AI is and what it is good and bad at;
   • hallucinations: why a confident answer can be wrong, and how to check it;
   • GDPR and confidentiality: what must never go into an AI tool, and which accounts are approved;
   • bias, especially where AI touches decisions about people, such as recruitment;
   • copyright questions around inputs and outputs;
   • your internal AI policy: approved tools, review rules and who to ask.
3. Document it. Record who took part, when and what was covered, plus the version of your AI policy. According to the Commission, no certificate is needed; an internal record is enough.
4. Refresh it. Update the training when tools, uses or rules change, and make AI basics part of onboarding.

If you use AI in areas the Act classes as high-risk, stricter duties apply on top of Article 4. The Omnibus postponed most of them to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

A simple AI literacy plan for SMEs

A small or mid-sized company can cover the essentials of Article 4 with six steps and no compliance department:

1. Name one person responsible for AI use and training.
2. List the AI tools and use cases in the company.
3. Write a one-page AI policy: approved tools, data that must never be shared, and what a person must check before AI output reaches a customer. Our comparison of ChatGPT, Claude and Gemini for business can help you choose the approved tools.
4. Run a basic session for everyone who uses AI, then add role-specific sessions (sales, support, HR, finance, developers) where needed.
5. Keep a log: date, participants, content and policy version.
6. Include AI basics in onboarding, brief contractors who use AI on your behalf, and review everything when you adopt a new tool.

How to make AI training stick

AI training sticks when it is built around each team’s real tasks rather than a one-off slide presentation. Compliance is the floor, not the goal: the Omnibus itself notes that AI literacy should be a strategic priority regardless of regulatory obligations and possible sanctions. A slide presentation may leave a record, but it rarely changes how people work; what works better is practice on people’s own emails, reports and spreadsheets, a clear policy and someone to ask afterwards. We cover that approach in AI training for employees: from ChatGPT access to adoption.

FAQ

Is AI training mandatory for companies under the EU AI Act?

Yes, in the sense that companies that provide or use AI systems in the EU must take measures to support the AI literacy of their staff (Article 4). Since the July 2026 amendment this is an obligation of means: no fixed format, number of hours or level to guarantee, but you should be able to show what you did.

Do employees need an AI literacy certificate?

No. The European Commission’s Q&A states that there is no need for a certificate and that organizations can keep an internal record of trainings and other guidance initiatives. A course certificate can be part of that record, but no certificate is required by law.

What happens if we don’t train our staff?

National market surveillance authorities supervise and enforce Article 4 from August 2026, and the penalties are set by national law, so the consequences vary by country. Beyond fines, having no AI literacy measures at all can count against you if an AI-related error causes harm to a client, an employee or a third party.

UsualMatrix runs hands-on AI training for teams, built around their real tasks: what AI can and can’t do, hallucinations and verification, data protection, and a practical AI policy for your company. Training is delivered in Chinese, Spanish or English. See our AI solutions service or contact us to plan training for your team.

Note: this article is general information as of 29 September 2026, not legal advice. The AI Act and national implementing rules are still evolving; check the current text and the rules in your country, or ask a lawyer.