Since February 2025, every business that uses AI systems in the EU has an AI literacy duty under Article 4 of the AI Act. In July 2026 the Digital Omnibus rewrote that article, and many guides still quote the old wording. This guide explains what Article 4 asks for today, who it covers and how a small business can meet it in a few hours, without buying a certificate.
This guide is based on the consolidated text of the AI Act on the European Commission’s AI Act Service Desk and on the Commission’s AI literacy Q&A (last updated 20 October 2026), checked on 28 October 2026. The training plan and templates are our own suggestions. It is not legal advice. See our editorial policy.
Quick answer: if your business uses AI, including ChatGPT, Claude or Gemini at work, you must take measures to support the AI literacy of the people who use it on your behalf. Since the Omnibus you do not have to guarantee any specific level, there is no mandatory course or certificate and you do not have to test anyone. A proportionate approach for a small business is a list of the AI tools in use, a one-page policy, a short session adapted to each role and a written record that it happened.
Table of Contents
What Article 4 Says Now
The Digital Omnibus on AI amended all three paragraphs of Article 4. The consolidated text as at 27 July 2026 says:
| Paragraph | Who | What |
|---|---|---|
| 4(1) | Providers and deployers of AI systems | “Take measures to support the development of AI literacy” of their staff and of other people operating or using AI systems on their behalf, taking into account their knowledge, experience, education and training, the context of use and the people the systems are used on. This “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” |
| 4(2) | The Commission and member states | Support and facilitate those efforts, in particular for SMEs. The Commission must publish practical examples of how to comply. |
| 4(3) | The European AI Board | Adopt recommendations to promote AI literacy, taking into account European competence frameworks. |
What changed with the Omnibus
The original 2024 text asked providers and deployers to take measures “to ensure, to their best extent, a sufficient level of AI literacy”. The amended text keeps the duty to act but drops the idea of a guaranteed or “sufficient” level, and adds an explicit duty for public authorities to help SMEs. The Commission’s AI literacy Q&A sums it up: AI literacy “remains an obligation”, but no specific or “sufficient” level is mandated.
One exception stays strict: deployers of high-risk AI systems must still make sure the people doing human oversight are properly trained, under Article 26. That matters if you use AI in hiring or credit decisions, which become high-risk rules from 2 December 2027.
What “AI literacy” means
Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of the opportunities and risks of AI and the harm it can cause. In plain terms: the people using the tool know what it is good at, where it fails and what they must not do with it.
Who It Covers in a Small Business
- Your business as a deployer: any company that uses an AI system under its authority, which includes an employee using ChatGPT to write ads or translate. The Commission’s Q&A uses exactly that example and says those staff “should be informed about the specific risks, for example hallucination.”
- Your business as a provider: if you build your own AI system, such as a chatbot on an AI API, the duty applies to you in that role too. See our Article 50 guide for how to tell the roles apart.
- Not only employees: the Q&A says the duty can extend to contractors, service providers and even clients who operate or use the AI system on your behalf.
- Not covered: purely personal, non-professional use.
Enforcement and Penalties
Article 4 has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026. Unlike Article 50, Article 4 is not in the list of obligations with fixed maximum fines in Article 99(4), so penalties depend on national law, and the Commission says any sanction must be “proportionate, based on the individual case”. In Spain, the national bill that would have set the domestic penalty regime lapsed in Congress in October 2026; our AI rules for businesses in Spain and the EU page tracks its status. The practical risk for a small business is less a fine for Article 4 alone and more having no evidence of training when something else goes wrong.
A Proportionate Plan in Four Steps
The Commission’s Q&A suggests starting from four questions: what AI the organisation uses, whether it is a provider or a deployer, what the risks of each system are and what staff need to know given their role and context. Turned into steps:
1. List the AI tools in use (30 minutes)
Ask each person which AI tools they use for work, including free accounts they opened on their own. Note the tool, who uses it, for what, and whether it receives customer or personal data. Most small businesses find more tools than they expected.
2. Write a one-page AI policy
- Allowed tools: which ones, and which account type (for example, business plans with a data processing agreement, not personal free accounts).
- Data that never goes in: health data, ID numbers, passwords, bank details, confidential client documents, unless the tool is approved for it. See our GDPR guide for ChatGPT, Claude and Gemini.
- Human review: AI output that goes to customers, is published or affects a person is checked by a person first.
- Transparency: chatbots and AI agents that talk to customers say they are AI (Article 50).
- Red lines: no AI for emotion recognition of staff, which Article 5 bans, and no automated decisions about people without human involvement.
- Owner: the person who approves new tools and keeps the record.
3. Train by role, not one course for all
| Role | What they need to know | Suggested format |
|---|---|---|
| Everyone who uses AI | What a language model is, why it can invent facts (hallucinations), what data must not go in, the internal policy | 45-minute session plus the one-page policy |
| Marketing and content | Fact-checking, copyright and brand risks, when AI images or video need a label (deepfakes) | 30 minutes with real examples from your own content |
| Customer service using a chatbot | What the bot can and cannot answer, when to take over, the AI notice customers see | 30 minutes reviewing real conversations |
| Whoever builds automations or agents | Prompt injection, least-privilege access, human approval for sending, paying or deleting, logging | 1–2 hours using the OWASP Top 10 for LLM applications |
| Hiring or evaluating people with AI | Bias, GDPR Article 22 on automated decisions, high-risk rules from December 2027 | 1 hour, before using any such tool |
Free material exists: the Commission’s living repository of AI literacy practices collects more than 40 initiatives from companies and public bodies. The Commission notes that copying them does not give an automatic presumption of compliance, but they are a good starting point.
4. Keep a simple record
No certificate is required, and the Q&A says an internal record of training and other initiatives is enough. A spreadsheet with these columns works:
| Date | Person or group | Role | Tools covered | Content | Format and length | Next review |
|---|---|---|---|---|---|---|
| 12 Nov 2026 | Customer service team (3) | Deployer, chatbot users | Website chatbot, ChatGPT Team | Policy, hallucinations, handover, AI notice | In person, 45 min | May 2027 |
Repeat the review when you add a tool, when someone new joins or at least once a year.
Sample 45-Minute Session
- 5 min: which AI tools we use and what for (from your list).
- 10 min: how a language model works in plain words, and a live example of it confidently getting a fact wrong.
- 10 min: data: what never goes in, and why business plans differ from free accounts.
- 10 min: the rules that touch us: AI notices for chatbots, labels for realistic AI images, no automated decisions about people.
- 10 min: questions, and each person names one task where they will use AI and one where they will not.
Common Mistakes
- Paying for a “mandatory AI Act certificate”. There is none. External training is allowed, but not required.
- One generic video for everyone. Article 4 asks you to consider each person’s role and context.
- Ignoring the tools people use on their own. Unofficial accounts are where customer data most often leaks.
- Training once and forgetting it. Tools change monthly; review when something changes.
- No written evidence. If it is not recorded, you cannot show you did it.
If you are just starting with AI, our guide to AI agents for small business explains which tasks to automate first and what they cost.
Frequently Asked Questions
Is AI training for employees mandatory under the AI Act?
Article 4 requires providers and deployers to take measures to support the AI literacy of staff and others who use AI systems on their behalf. Since the 2026 Digital Omnibus it does not require any specific level, mandatory course or certificate, but you do have to act and it is wise to keep a record.
Does Article 4 apply if my staff only use ChatGPT?
Yes. The European Commission’s Q&A uses that example: staff who use ChatGPT to write advertising text or translate should be informed about its specific risks, such as hallucinations.
Do I need an AI literacy certificate?
No. The Commission says no certificate is needed and an internal record of training and other initiatives is enough. There is no obligation to use external training or certification.
What is the fine for not training staff on AI?
Article 4 is not among the obligations with fixed maximum fines in Article 99(4) of the AI Act. Penalties are set by national law, and the Commission says any sanction must be proportionate to the individual case.
What did the Digital Omnibus change in Article 4?
It replaced the duty to ensure a ‘sufficient level’ of AI literacy with a duty to take measures to support its development, stated that no specific level has to be guaranteed, and added a duty for the Commission and member states to help, especially SMEs.
Official Sources
- AI Act Service Desk: Article 4 (consolidated as at 27 July 2026)
- European Commission: AI Literacy – Questions & Answers (updated 20 October 2026)
- European Commission: Living repository of AI literacy practices
- AI Act Service Desk: Article 99 (penalties)
- EUR-Lex: Regulation (EU) 2024/1689 (AI Act)
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- OWASP: Top 10 for LLM Applications