The EU AI Act's AI Literacy Rule: What Employers Must Do

Under Article 4 of the EU AI Act, organizations that provide or use AI systems must take measures to support the AI literacy of their staff and of other people who use AI on their behalf. As of October 2026, the European Commission says the obligation applies from 2 February 2025, but since a mid-July 2026 amendment it no longer requires any specific level of literacy. Nothing in the Commission's Q&A says a certificate, a test or a formal course is required.

This page summarizes the Commission's own question-and-answer page (last updated 27 July 2026) and the Article 4 text on its AI Act Service Desk. It is not legal advice, and national rules and enforcement can differ.

1. What Article 4 says

The Commission describes Article 4(1) as requiring providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. The measures must take into account their technical knowledge, experience, education and training, and the context in which the AI will be used.

"Deployers" includes an ordinary company that uses someone else's AI tool. The Commission's Q&A asks organizations to consider "the role of their organisation (provider or deployer of AI systems): Is my organisation developing AI systems or just using AI systems developed by another organisation?"

"Other persons" means people under the organization's remit who are not employees. The Commission gives contractors, service providers and clients as examples.

2. What changed in 2026

The Commission proposed the Digital Omnibus on AI on 19 November 2025. The Commission's page says the amendments to Article 4 entered into force in mid-July 2026. According to the page:

• AI literacy remains an obligation for providers and deployers of AI systems, but "no specific, or sufficient, level is mandated."
• The Commission and Member States are to keep supporting organizations, including by publishing practical examples of compliance on the AI Act Single Information Platform.
• The AI Board is to adopt recommendations on Article 4 that take European competence frameworks into account.
• For deployers of high-risk AI systems, the obligation to ensure staff are trained for human oversight remains in place.

If you read older articles saying companies must guarantee a "sufficient" level of AI literacy, check the date. The Commission's page describes the wording as changed.

3. What the Commission says about common questions

The Q&A answers several questions employers tend to ask.

• Is training mandatory? The page says there are no "strict requirements or mandatory trainings" and no one-size-fits-all format. It adds that merely telling staff to read an AI system's instructions for use "might be ineffective."
• Does using ChatGPT count? The Q&A asks whether a company whose employees use ChatGPT for writing ads or translating text must comply. Its answer is yes, and staff "should be informed about the specific risks, for example hallucination."
• Do you have to measure knowledge? No. The Commission says Article 4 does not entail an obligation to measure employees' AI knowledge, and does not require guaranteeing a specific level for any individual.
• Do you need a certificate or an AI officer? No certificate is needed, and organizations can keep an internal record of trainings or other guidance. No specific governance structure, such as an AI officer or board, is mandated.
• Do different roles need different training? The page says different levels of detail are allowed, and notes that someone with AI development experience will normally count as literate but should still understand the organization's specific systems and risks.
• Are there sector-specific requirements? The Commission says the AI Office does not impose requirements for specific sectors, but the sector and purpose are relevant when designing the program.

4. A starting outline from the Commission's steps

The Commission suggests organizations consider at least these steps:

1. Build a general understanding of AI in the organization: what it is, how it works, which AI the organization uses, and its opportunities and dangers.
2. Decide whether the organization is a provider or only a deployer.
3. Consider the risk of the AI systems and what employees need to know about them.
4. Build literacy actions around staff differences in knowledge and around the context and the people the system is used on.

For a small office using general chat tools, that could mean a short written note on which tools are approved, what data may not be pasted in, the known failure modes such as made-up facts, and who to ask. The Commission does not prescribe that specific format; it is one way to cover the steps.

5. Who enforces it

The Commission says national market surveillance authorities, not the AI Office, supervise and enforce Article 4, starting 2 August 2026 (another answer on the same page says 3 August 2026). They can impose penalties under national law, and enforcement is meant to be proportionate to the nature and gravity of the case. The Commission adds that sanctions may be more likely if there is proof of an incident caused by a lack of appropriate training and guidance. The AI Act can apply to organizations outside the EU if an AI system's use is in the Union or affects people located there.

6. Key takeaways

• Article 4 of the EU AI Act has applied since 2 February 2025, and enforcement by national authorities started 2 August 2026.
• Since a mid-July 2026 amendment, organizations must still support AI literacy, but no specific level is mandated.
• Employees using a general chatbot for writing or translation are covered, and the Commission says they should be told about risks such as hallucination.
• No certificate, test, mandatory course or AI officer is required; an internal record of what you did is enough.
• Training should match the audience and the risk of the system, and high-risk deployers still must train staff for human oversight.