AI Literacy Requirement Under the EU AI Act, Explained

The AI literacy requirement in Article 4 of the EU AI Act obliges every provider and deployer of AI systems to take measures that support AI literacy among their staff and others using AI on their behalf. It has applied since February 2, 2025. Since the Digital Omnibus entered into force on July 27, 2026, the rule is explicitly a duty of effort: you must take proportionate measures, but you don't have to guarantee a specific literacy level for each individual.

The short version:

• Article 4 applies to any organization that builds or uses AI in the EU, with no size threshold. If your team uses ChatGPT or Copilot, you are in scope.
• After the Omnibus, compliance is judged on the measures you took, not on the literacy level people reached.
• No certificate or mandatory course is prescribed. Measures should match who uses which AI, for what, and with what risk.
• Regulators treat AI literacy as an ongoing program, not a one-off training.

What does AI literacy mean?

The AI Act defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems, and to be aware of the opportunities and risks of AI and the harm it can cause.

On the ground, that means practical questions. Does the sales rep drafting a quote with ChatGPT know the model can invent facts? Does the planner know not to paste customer data into a free chatbot? Does the operator supervising an AI agent know when to step in? AI literacy is less about how transformers work and more about responsible use inside your actual processes.

What exactly does Article 4 require after the Omnibus?

The Digital Omnibus (Regulation (EU) 2026/1744) amended the wording of Article 4. If you want the full picture of what else changed, see our guide to EU AI Act compliance.

The European Commission also says that it and the member states will take a stronger role in promoting AI literacy. In short, the bar is now your effort, calibrated to risk. You need to be able to show what you did and why it fits your use of AI.

Is there a fine for ignoring AI literacy?

The AI Act does not attach its own fine ceiling to Article 4, unlike prohibited practices or transparency breaches. Member states set the penalty rules, and several are still finalizing their national implementation. Enforcement at national level for AI literacy formally started on August 2, 2026, according to the Commission's timeline.

The more realistic risk sits elsewhere. When something goes wrong, such as a data leak through a chatbot or a customer harmed by an AI error, "nobody ever explained how this tool works" is a weak position with any regulator, client or court. The Dutch data protection authority, for example, has already received multiple breach notifications caused by employees entering personal data into AI chatbots.

Who does the AI literacy requirement apply to?

Article 4 binds providers and deployers. Most businesses are deployers: they use AI systems under their own authority. There is no minimum company size.

The duty covers your staff and "other persons dealing with the operation and use of AI systems on their behalf". That includes contractors, temporary staff and outsourced teams using AI inside your processes.

Typical examples in scope:

• An operations team using Microsoft 365 Copilot for email and scheduling.
• A finance team using AI to process invoices or reconcile transactions.
• An ecommerce company running an AI chatbot or an AI agent that handles returns.
• A company running a custom AI agent that writes orders into its ERP.

Will the EU AI Act apply to the UK? Not as domestic law, but UK companies that deploy AI systems as part of EU operations, or place AI systems on the EU market, are in scope for that activity.

What are the training requirements for AI literacy?

The law does not list specific measures. It asks you to account for people's technical knowledge, experience, education and training, the context of use, and who the AI is used on. A four-tier model works well in practice:

For high-risk AI systems, an additional rule applies from December 2, 2027: Article 26(2) requires deployers to assign human oversight to people with the necessary competence, training and authority. The Omnibus did not soften that.

A five-step AI literacy program

Regulatory guidance, including two practical guides from the Dutch data protection authority, points to a multi-year cycle: map, set goals, implement, evaluate. For a small or mid-sized business, that translates into:

1. Map actual AI use. Ask your team which tools they use, official and unofficial. You will almost always find personal or free accounts nobody approved. Include AI features embedded in existing software.
2. Segment by role and risk. Use the four tiers above. Someone using AI to polish an email needs something different from someone supervising an agent that posts invoices.
3. Set the rules. A one or two page AI policy: approved tools, data that never goes in, ownership, and how AI output gets checked. Align it with your data protection rules; see our article on ChatGPT and GDPR.
4. Train on your own workflows. A general online course is a fine baseline, but people learn most from examples from their own work: what an AI error looks like in your quotes, your schedules, your customer emails. One hour per group per quarter beats a single full day.
5. Document and review. Record who received what training and when, and what changed as a result. Review every six months for new tools and use cases.

How much effort is this?

For a company of 20 to 50 people, the first cycle is a few days of work: a day to map usage and write the policy, half a day of training per group, and an hour to document. After that it is maintenance. It only becomes a big project if you outsource it to a generic e-learning and stop there.

AI literacy training and certificates

There is a growing market of AI literacy courses, e-learnings and certificates, including free ones. A few pointers:

• No certificate is required. The AI Act does not mandate a specific course or credential. A certificate can support your documentation but does not replace measures tailored to your use.
• Context matters. Article 4 explicitly requires you to consider the context of use. A generic "what is AI" module says nothing about how your support team should handle a chatbot quoting the wrong delivery time.
• Combine. A general baseline plus a short internal session on your own tools and rules gives most businesses the best balance of cost and impact.

Why it pays off beyond compliance

Adoption research keeps pointing at the same barrier. Dutch statistics office CBS found that micro businesses that considered AI but did not adopt it most often cited lack of experience (71.6%), followed by privacy (48.8%) and legal consequences (42.7%). Those are exactly the gaps an AI literacy program closes. Teams that understand what AI can and cannot do use it more confidently and make fewer costly mistakes.

We see the same in delivery. An AI agent in production performs best when the people around it understand which cases it handles alone, which it escalates, and how to read in the logs why it did something. That is why a short handover to users is part of every project we ship. For the broader rollout approach, read how to implement AI in your business.

Frequently asked questions

What is the AI literacy requirement in the EU AI Act?

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures that support the development of AI literacy among their staff and others using AI on their behalf. It has applied since February 2, 2025. Since July 27, 2026 it no longer requires guaranteeing a specific literacy level for any individual.

What does AI literacy mean?

AI literacy means having the skills, knowledge and understanding to use AI systems in an informed way and to be aware of their opportunities, risks and potential harm. In practice: knowing what a tool can and cannot do, checking its output, keeping sensitive data out, and knowing when to intervene.

Do employees need an AI literacy certificate?

No. The EU AI Act does not prescribe a certificate, diploma or specific course. You need proportionate measures that fit who uses which AI and for what, and you should be able to document them. A certificate can be part of that documentation.

What is the EU AI literacy framework?

There is no single mandatory framework in the AI Act itself. The law sets the duty and the calibration factors, while the European Commission and member states have taken on a stronger role in promoting AI literacy since the Omnibus. National regulators publish practical guidance that organizations can use as a starting structure.

Does AI literacy apply to contractors?

Yes. Article 4 covers your staff and other persons dealing with the operation and use of AI systems on your behalf. If contractors or outsourced teams use AI inside your processes, include them through your contracts and your AI policy.

Next steps

Start this week with step one: ask your team which AI tools they use. That conversation usually gives you enough for a first policy draft. If you want to know where AI creates real value in your business and how to set it up responsibly, take our free AI scan. When we build AI solutions, a practical handover to your team is part of the standard delivery; see our services.

Sources

• Regulation (EU) 2024/1689, AI Act, Articles 4 and 26 (EUR-Lex, June 13, 2024)
• Regulation (EU) 2026/1744, Digital Omnibus on AI (EUR-Lex, July 24, 2026)
• AI Omnibus enters into force (European Commission, July 27, 2026)
• Timeline for the Implementation of the EU AI Act (AI Act Service Desk, September 25, 2026)
• Getting started with AI literacy (Dutch Data Protection Authority, January 30, 2025)
• Further building AI literacy (Dutch Data Protection Authority, accessed September 26, 2026)
• Use of AI chatbots can lead to data breaches (Dutch Data Protection Authority, August 6, 2024)
• Use of AI technology by Dutch micro businesses (CBS, March 16, 2026)