For anyone who needs to show it's covered
AI literacy: what Article 4 of the AI Act asks of you
The AI Act requires organisations to make their people AI-literate. The law prescribes no mandatory course and no minimum number of hours. What it does say, and what you need to be able to show, is set out below.
Plan an introductionThe obligation
An obligation without a prescribed form
Article 4 of the EU AI Act asks organisations to make sure employees working with AI understand enough about what they are using. That obligation has applied since February 2025 and touches nearly every organisation, because a team using only Copilot or ChatGPT falls under it too. What the law does not do is prescribe how, and since the Digital Omnibus of July 2026 it says explicitly that you need not guarantee a specific level of knowledge per person. That makes the question harder than it looks: there is no box to tick, and yet you do need to be able to show something.
The dates and supervisory powers around the AI Act have shifted several times in recent years, most recently in late July 2026 through the Digital Omnibus. A separate page covers the EU AI Act and what applies when. Updated 19 August 2026.
Article 4
What the law does and doesn't say
The article itself is short. Most of the uncertainty comes not from what it says, but from what people read into it that is not there.
Everyone who uses AI, not only those who build it
The obligation sits with the organisation using an AI system, whether or not it built that system. A municipality running Copilot in Microsoft 365 falls under it just as much as a company training its own model. It covers the people working with it and those on whose behalf it is used.
Knowledge that matches the role and the risk
The law ties the level to the context: what someone needs to know depends on what they do with AI and the risk that carries. An adviser using AI on client files needs a different conversation than someone using Copilot to summarise minutes. One generic all-hands session rarely covers that. Since the Digital Omnibus it is explicitly an obligation of effort: you take measures that support literacy, you do not guarantee a level of knowledge per individual.
No mandatory course, no hour quota, no certificate
The law names no prescribed course, no minimum number of hours and no recognised certificate. Since the Digital Omnibus it even says explicitly that no specific level of knowledge has to be guaranteed per person. So providers suggesting that their training in particular is legally required are claiming more than the text supports. What counts is whether what you offer demonstrably fits what your people actually do with AI.
You need to be able to show it, not just have done it
In practice it comes down to a file: which AI systems you use, what knowledge level belongs to which role, what was offered, who attended, and which internal guidelines apply. That file is useful even with no supervisor asking, because it answers exactly the questions new joiners have.
In practice
Three steps that make it demonstrable
This is not a project of months. Most organisations get a long way with half a day of stocktaking and a training round that was already planned.
Map what is already being used
Not only the tools that were officially rolled out, but also what people started using on their own. That second list is usually longer than expected, and it is exactly where the risk sits.
Decide per role what someone needs to know
Three or four levels is enough: those using AI occasionally, those using it daily, those basing decisions on it, and those buying or managing it. A short description per level of what you expect.
Record what you did
A training plan, an attendance list, the internal guideline and the date. Keeping that up to date means the answer is ready when someone asks, instead of having to be reconstructed afterwards.
Where this lands
What we do in this
The fundamentals module
Our foundation module covers exactly what Article 4 asks of everyday users: approved tools, data classification, do's and don'ts, and who is responsible for what. 8 to 15 people per session, from 250 euro per participant.
The policy underneath
Training without boundaries mostly produces enthusiasm. An AI policy sets out which tools are allowed, what data may go into them and who decides. It is also the document your file refers to.
First know where you stand
Not sure what is already in place? The AI Quick Scan gives an honest starting point in a few minutes, including what is still missing.
When this isn't your first concern
- Is AI not in use anywhere yet, not even informally? Then this is a paper exercise. Start instead with the question of where AI could actually help.
- Is a compliance or legal department already running this? Then we do not need to sit on top of that. We would rather connect on the training side than take over the file.
- And if someone tells you a fine is coming unless you hold a certificate next month: that is not accurate. Do not let a deadline that does not exist be used to sell you something.
We don't ask organisations to do anything we don't do ourselves.
Five rules our work follows, including what we don't do. Read our AI policy
Frequently asked questions
01 Is AI literacy really mandatory? +
Yes. Article 4 of the EU AI Act places that obligation on organisations deploying AI systems, and it has applied since February 2025. The Digital Omnibus of July 2026 did not remove the obligation but did soften the wording: it is about measures that support AI literacy, and no specific level has to be guaranteed per person. What was never required is a specific course or certificate. The law asks for sufficient knowledge, proportionate to role and risk, and that you can substantiate it.
02 Does this apply if we only use Copilot or ChatGPT? +
Yes. The obligation attaches to using AI, not to building it. It is particularly relevant for general-purpose tools, because people often started using those on their own without any agreements in place.
03 How much time does it take to get this in order? +
For most organisations: half a day to map what is being used and set out expectations per role, plus the training rounds themselves. The heaviest part is usually not the training but the stocktake, because it reveals everything already running.
04 What if employees already use AI without us knowing? +
That is the normal situation, not the exception. It is also exactly why the stocktake comes first. Ask about it openly rather than banning it: a ban moves the use to personal accounts, where you lose sight of it entirely.
05 What's the difference with an AI policy? +
AI literacy is about what people know; policy is about what is allowed. They belong together: without policy you do not know what to train, and without training nobody reads the policy. In most engagements we pick them up together.
Want this demonstrably in order?
We look together at what is already there and what each role needs.