AI Literacy - Mandatory AI Training Under Article 4 of the AI Act: Who, What, and How

The owner of a five-person accounting office uses Claude to summarize financial statements. A marketing agency pastes client briefs into ChatGPT to speed up research. Neither company builds AI, sells AI, or has an IT department bigger than one person - yet both are "deployers" under the AI Act, and both, right now in September 2026, have an obligation under Article 4 to take measures that support their staff's AI literacy. Since the AI Omnibus entered into force (July 27, 2026), the provision no longer requires a "sufficient level" or any certificate, but the obligation itself remains for providers and deployers. This is the most widely applicable - and least understood - requirement in the entire regulation. It applies to literally anyone with any AI system in their company, regardless of its risk level.

If anyone at your company uses ChatGPT to draft emails, you're a “deployer” under the AI Act - and since August 2, 2026, national market surveillance authorities can check whether you're taking measures to support that person's AI literacy. After the AI Omnibus, no specific level or certificate is required - but there is a concrete methodology: who the obligation covers, how to design a role-based program (leadership, operations, IT), and how to document the result so it survives an inspection.

This post adds the fourth piece to the compliance series I've been building: the AI Act describes the legal obligations in general, AI policy and ISO/IEC 42001 shows how to organize them into a management system, and Shadow AI diagnoses what happens when nobody has done any of this. This post answers the question left over after those three: specifically who, on what, and how to train, so a document labeled "AI literacy" isn't fiction.

Who Article 4 covers - spoiler: even the one-person company with ChatGPT

Article 3(56) of the AI Act defines AI literacy as the skills, knowledge, and understanding that allow providers, deployers, and affected persons to make informed decisions about deploying AI systems and to be aware of the opportunities, risks, and possible harms it can cause. Critically, the Article 4 obligation doesn't depend on the system's risk level. It doesn't matter whether your automation is "minimal risk" under the classification in the AI Act guide - the mere fact that anyone in the organization operates an AI system triggers the obligation to take measures that build their competence.

Three factors that, per the European Commission's May 2025 guidance (AI Literacy - Questions & Answers), determine which measures are proportionate for a specific person (the guidance was written around the "sufficient level" wording that the AI Omnibus removed, but these criteria still show how to tailor a program well):

1. 1.The person's technical knowledge, experience, education, and training - a junior marketer using ChatGPT for drafts needs a different scope of knowledge than a CTO deploying credit-scoring systems.
2. 2.The context in which the AI system will be used - an internal brainstorming chatbot is a different risk level than a system evaluating loan applications.
3. 3.The people the AI system affects - if the outputs reach customers or employees, the competence bar rises.

There's no single template or required certificate - the Commission explicitly rejected a one-size-fits-all approach and instead published a repository of more than 40 real-world practices from AI Pact companies as inspiration, not a mandatory checklist.

How to design a proportionate program in practice

Since there's no rigid template, a defensible program follows three steps: assess, train, document. Each step leaves a record you can point back to later. The Commission's Q&A says an internal record of trainings and other initiatives is enough - no certificate or special governance structure is needed. Since August 2, 2026, national market surveillance authorities supervise Article 4.

The scale of the gap this reveals: according to Docebo's 2026 report (2,000 employees and L&D leaders at large organizations), 85% of employees say the AI training they received doesn't help them in their actual job, and one in five received no training at all. This isn't just a business-effectiveness problem - it's also a weak spot in an inspection, because training that doesn't change how people work is hard to defend as a genuine measure supporting AI literacy, no matter how many hours it formally ran for.

A role-based training program - three tiers, not one session for everyone

The biggest mistake I see at client companies: one generic "introduction to AI" session for the whole company, regardless of role. That's the exact opposite of the role-proportionate approach the Commission's guidance recommends. A real program splits into three tiers:

• Leadership and decision-makers. They don't need to know how to write prompts - they need to understand legal exposure (fines up to €35M or 7% of turnover for prohibited practices), decision frameworks for buying AI tools, and when a project needs the AI owner described in the AI policy post.
• Operations teams and general users. Practical knowledge: which tools are allowed, what data to never paste in, and when to escalate an AI output to a human instead of trusting it blindly. This is the group most exposed to Shadow AI if the training doesn't cover it. For the finance team, this same program must also cover deepfake CEO fraud scenarios - they're the group with direct account access, making them the most exposed to an attack from outside.
• IT and implementation specialists. Deeper technical knowledge: model limitations, hallucinations, prompt injection, and how to design human oversight and an audit trail for the systems they're responsible for.

For content and marketing teams using AI for research and content creation, I build a complete, structured competence path in the SEO & GEO course; for people deploying and overseeing the systems themselves, in the AI Engineer course. A certificate isn't required - the Commission says plainly that there's no need for one and that an internal record of trainings is enough. Completing a program like this, with its syllabus, is simply one convenient way to document the measures you've taken.

How to measure the result - attendance isn't proof of competence

Article 4 doesn't require you to measure staff knowledge - the Commission confirms this in its Q&A. But a sign-in sheet only proves someone sat in the room, not that the training works. If you want to know whether the program has an effect (and have stronger material in case of an inspection), measurement looks like this:

An audit of actual use after training is also the best test of whether the Shadow AI problem is actually shrinking rather than just moving further underground - a mechanism I cover in more depth in Shadow AI.

Enforcement since August 2026 - what it actually means

The AI literacy obligation has applied since February 2, 2025, but for a year and a half it was effectively unenforceable - no authority had formal enforcement powers. That changed on August 2, 2026: national market surveillance authorities across the EU can now check it. The Digital Omnibus package (agreed May 7, 2026, in force since July 27, 2026) softened the provision from a "duty to ensure" to a "duty to support the development" of competence and dropped the "sufficient level" requirement - a real shift from an obligation of result to an obligation of effort, but not a removal of the obligation, as I cover in more depth in AI policy and ISO/IEC 42001. The AI Act doesn't attach a specific fine amount to Article 4 - any penalties come from national law and, per the Commission, must be proportionate to the nature and gravity of the infringement. In practice: keep a record of the measures you've taken, not just intent. The Commission notes that a lack of appropriate training can make enforcement action more likely, especially after an incident.

The most common mistakes building an AI literacy program

• One session for every role. Ignores the role-based tailoring recommended in the Commission's guidance - leadership and a junior marketer don't need the same knowledge.
• Training once and never again. The AI tool landscape changes faster than most internal policies - a program with no recurring refresh is stale within a few months.
• No documentation. Running the training without a record (who, when, what it covered, what the test results were) leaves no evidence for an inspection.
• Treating it as an HR project, not an operational policy. AI literacy should be part of the same AI policy the AI owner manages - not a separate, disconnected training initiative.
• No connection to actual usage. Training that doesn't answer "what does my team actually use" misses the mark - a Shadow AI audit should come before a training program, not after it.

Training meets the obligation, but on its own it won't get people using AI. I cover how to turn it into everyday team habits in the post on AI adoption in your team.

---

I design and run AI literacy programs tailored to a company's actual structure - from a per-role needs assessment, through training materials, to documentation that survives an inspection. I do this as part of EU AI Act AI literacy training, broader AI training for teams and AI consulting, and I run full, certified competence paths in the SEO & GEO course and the AI Engineer course. Reach out - I'll start by assessing which roles at your company actually need which level of competence, and design a program that can be documented.

Worth reading next:

• The AI Act in practice - what your company must do in 2026
• AI Policy at Your Company and ISO/IEC 42001
• Prompt Engineering for Business
• Shadow AI - employees using AI without your knowledge
• Where to start implementing AI at your company