By Laas NuryIf your company uses AI, and almost every company does by now, the EU AI Act has given you one duty that already applies: AI literacy. It has been in force since February 2025, it was rewritten in July 2026, and since August 2026 national regulators can check it.
It is also the most misunderstood part of the Act. Training companies sell it as a certificate you must buy for every employee. It is not. This article sets out what the rule actually asks, what a regulator will want to see, and a plan a mid-sized company can complete in a month.
What the law asks, in one paragraph
Article 4 of the AI Act requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of other people who operate or use AI systems on their behalf. When doing so, you take into account what those people already know, their experience and training, the context the AI is used in, and the people it affects.
That is the whole rule. It applies to any company that uses AI, not only to companies that build it.
What changed in July 2026
The original text said companies must ensure a sufficient level of AI literacy. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since late July 2026) replaced that with a duty to take measures that support it. The Commission's own summary: AI literacy remains an obligation for providers and deployers, but no specific or "sufficient" level has to be reached.
In plain terms, it went from an obligation of result to an obligation of effort. You are not judged on whether every employee now understands AI. You are judged on whether you did something sensible about it, in proportion to how you use AI.
Two things did not change: the duty still applies to every company that uses AI, and you still need to be able to show what you did.
Who counts as "your staff"
More people than most companies assume. The rule covers your employees and "other persons dealing with the operation and use of AI systems on your behalf". That includes:
- Freelancers and contractors using AI in work they do for you.
- Temporary and seasonal staff.
- A service provider running a process for you with AI, such as an outsourced customer service desk.
It does not cover your customers. They are covered by other parts of the Act, such as the transparency duties.
What a regulator will look for
Since August 2026, national market surveillance authorities supervise this duty. In the Netherlands, the Autoriteit Persoonsgegevens (AP) plays the central role. The Commission's guidance and the AP's own documents point to the same four things:
- You know which AI you use. Not a vague "we use some AI tools", but a list: which systems, who uses them, for what.
- You thought about who needs to know what. A planner using a forecast needs different knowledge from a manager signing off decisions based on it.
- You did something. Training, instructions, usage rules, a briefing when a new tool arrives.
- You wrote it down. The Commission is clear that no certificate is needed; an internal record of the measures is enough.
The AI Act does not set a specific fine for Article 4; penalties come from national law and must be proportionate. Realistically, AI literacy gets examined when something else goes wrong, after a complaint or an incident, and then the question is simple: did the people using this system understand it?
Three groups, three levels
Most companies can work with three groups. Everything in the plan below is built on them.
| Group | Who | What they need to know |
|---|---|---|
| Everyone | All staff with access to any AI tool, including Copilot or ChatGPT | What the tools are allowed to be used for, which data never goes into them, that output can be wrong and must be checked, who to ask |
| Users | People who work with a specific AI system daily: planners, finance staff reading AI-processed invoices, support agents with an AI assistant | How that system works in their process, where it typically goes wrong, what the exceptions look like, when to overrule it |
| Owners and decision-makers | The person responsible for each system, and managers who act on its output | The system's limits and risks, its data, how its performance is monitored, what the AI Act requires for this use |
A ten-person company might have only the first group. A company using AI to make decisions about customers or staff needs all three, and needs them in more depth.
A 30-day plan
Week 1: find out what you use
Make the list. Ask each team lead one question: "Which tools do you use that do something automatically with AI?" Then check the software you already pay for: ERP, CRM, HR, accounting and support tools increasingly ship AI features that are switched on by default.
For each tool, write down: what it is, who uses it, what it is used for, what data goes in, and who is responsible for it. Most mid-sized companies end up with between five and fifteen lines.
Week 2: decide who needs what
Map every person to one or more of the three groups above. For each tool, write two or three sentences on what its users must know. Keep it concrete. "The invoice tool is right most of the time but misreads handwritten amounts; every invoice over EUR 5,000 is checked by a person" is useful. "Understand the risks of AI" is not.
Week 3: do it
For the "everyone" group: one short session (an hour is plenty) and a one-page usage rule. The rule answers four questions: which tools are approved, what may never go in (personal data of customers, confidential contracts, passwords), that output is checked before it is used, and who to ask.
For users: a walk-through of their own system, in their own process, with real examples of it going wrong. The best person to give it is usually the colleague who knows the system best, not an outside trainer.
For owners and decision-makers: a session on the limits of each system they are responsible for, and what the AI Act asks for that use. If a system turns out to be a high-risk use, this is where you find out.
Week 4: record it and keep it alive
Put it in one register. A spreadsheet is fine:
| Tool | Used for | Owner | Groups | Measure taken | Date | Next review |
|---|---|---|---|---|---|---|
| Microsoft Copilot | E-mail, documents, meeting notes | Operations manager | Everyone | Session + usage rule | 14 Oct 2026 | Apr 2027 |
| Invoice processing (AI reading) | Purchase invoices into the ERP | Finance lead | Users, owner | Walk-through, exception checklist | 16 Oct 2026 | Jan 2027 |
| Demand forecast | Weekly purchasing | Supply chain lead | Users, owner | Walk-through, override rule | 17 Oct 2026 | Jan 2027 |
Then make it part of how you work: new staff get the usage rule in their first week, a new AI tool is added to the register before it goes live, and the register is reviewed twice a year.
That is a complete answer to Article 4 for most companies. It costs a few days of work spread over a month, and most of it you would want anyway.
Where companies go wrong
- Buying certificates instead of making the list. A certificate says someone passed a general course. It says nothing about whether your planners understand your forecast. The Commission itself says certificates are not required.
- Treating it as an IT matter. The knowledge that matters is how the system behaves in the process: where it fails, what the exceptions look like. That sits with the people who run the process.
- Forgetting the AI inside existing software. The AI feature your CRM switched on last quarter is an AI system your staff use. It belongs on the list.
- Doing it once. Tools change and people change. Twice a year is enough, but it has to happen.
Where this fits
AI literacy is one of four parts of the AI Act that matter to a company using AI. For the full picture (the bans, the transparency duties since August 2026 and the high-risk obligations now due in December 2027), read our overview of the EU AI Act for companies that use AI.
And if the list you make in week 1 shows AI running in places where nobody really owns it, that is usually the first thing worth fixing, well before any regulator asks.
