AI literacy under the AI Act: what your company has to do, step by step

Carlos Imlau, AI Product Builder · Certified trainer (CCP) · AI applied to work · 2026-10-23

What does the AI Act require on AI literacy? That any company using AI systems at work in the EU takes measures so the people using them know what they are doing: what the tool does, where it gets things wrong, what risks it brings and what data should never go into it. The rule is in Article 4 of Regulation (EU) 2024/1689 and has applied since 2 February 2025. In July 2026 the wording was softened, but it did not go away.

For a small business, complying is less daunting than it sounds: know which AI tools the team uses, set rules, train each person for what they actually do and keep a record. Below I explain what the law says and a simple step-by-step way to comply.

What does Article 4 of the AI Act say?

The EU AI Act defines "AI literacy" as the skills, knowledge and understanding that allow people to use AI systems in an informed way and to be aware of the opportunities, the risks and the harm AI can cause (Article 3, point 56).

Article 4 sits in Chapter I, which Article 113 made applicable from 2 February 2025, ahead of most of the regulation, which only applies in general from 2 August 2026.

What changed with the Digital Omnibus in July 2026?

On 8 July 2026, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was adopted. It was published in the Official Journal on 24 July 2026 and entered into force three days later, on 27 July. Among other changes, it rewrote Article 4.

Before, the rule asked companies to ensure "a sufficient level" of AI literacy. The Omnibus itself explains why it changed: strict obligations created compliance burdens, especially for smaller companies. The new text says providers and deployers take measures to support the AI literacy of their staff, and adds that this does not require anyone to reach any specific level of AI literacy.

What this means for you:

• The obligation remains. The company has to take measures. Doing nothing is not an option.
• There is no minimum level to prove. You don't need tests or scores for each person.
• Measures must fit the context. The text says to consider people's technical knowledge, experience and training, the context in which AI is used and who is affected by it.
• Support is built in. The Commission and Member States must now support companies, SMEs in particular, and the Commission has to publish practical examples of how to comply.

Is my company covered?

If it operates in the EU and uses AI at work, very likely yes. Article 4 applies to two kinds of organisations:

• Providers: those who develop an AI system and place it on the market.
• Deployers: those who use an AI system under their own authority, except for personal, non-professional activity (Article 3, point 4).

There is no size exemption. If your team uses ChatGPT to draft proposals, Copilot to summarise meetings or Claude to analyse spreadsheets, your company uses AI systems at work.

How do you comply with AI literacy, step by step?

This is the path I suggest for small teams. It is not an official formula: it is a practical way to do what the text asks, with effort in proportion to the size of the company.

1. Take an inventory. List the AI tools the team really uses (the ones the company pays for and the ones people use on their own), who uses them and for what.
2. Write short rules. One page is enough: which tools are approved, what data never goes in (customer personal data, tax IDs, contracts), who reviews AI output before it reaches a client.
3. Train by role. Someone who only writes emails needs less than someone using AI to make decisions about people, such as screening job applications.
4. Practise with real tasks. A session using the team's own documents and cases teaches more than a generic course. Everyone should leave knowing how to ask well, check the result and spot when the AI makes things up.
5. Record what you did. Date, who attended, content, rules shared.
6. Review when something changes. A new tool, a new feature or a new team member is a good moment to update the rules and repeat part of the training.

What evidence should I keep?

Article 4 does not mention certificates, minimum hours or a record format. But since the obligation is to take measures, it makes sense to be able to show which ones. Keep:

• the tool inventory and the date it was made;
• the AI use policy and confirmation that the team received it;
• attendance lists and the agenda of each training session;
• the dates of each review.

Where does team training fit in?

It is the most obvious measure and the one you notice most day to day. A team that knows what it can put into AI and how to check the result makes fewer mistakes and works faster.

In Portugal, I run the workshop "AI in the team's daily work" (3 hours, from 450 €) and the course "Automating work with AI" (8 hours, from 1,000 €), online or in person in the North. Details are on the AI training for teams page. If you're still deciding where to start, I wrote about what your team should learn first.

Frequently asked questions

Is there a fine for not complying with Article 4?

The AI Act sets maximum fines for several obligations in Article 99, and Article 4 is not on that list. Each Member State sets the penalties and other enforcement measures for the remaining infringements, which may include warnings. The sensible move is to have your measures in place and recorded.

Does a three-person micro-business have to comply too?

Yes, if it uses AI at work. But measures are proportionate: in a team of three, one page of rules, one practical session and a simple record may be enough.

Does the training have to be certified?

Article 4 does not require it. In Portugal, if a company wants the training to count towards the continuous training hours recorded in SIGO, it needs a training provider certified by DGERT, as I explain in the article on AI training for companies.

If we only use Microsoft 365 Copilot, does it count?

Yes. Copilot is an AI system used at work. The rules and training can be simpler, but the obligation is the same.

Did the Digital Omnibus remove the AI literacy obligation?

No. It removed the requirement to ensure a sufficient level, but kept the obligation to take measures. The text in force is in Regulation (EU) 2026/1744.