AI literacy is mandatory: what Article 4 of the AI Act requires now

Updated on 2 October 2026. Since 27 July 2026 a new text of Article 4 applies, through the Digital Omnibus on AI. The obligation still exists, but it has become lighter. This explanation has been updated accordingly.

The obligation everyone missed

Last week at a networking drinks, a mortgage adviser heard the question "are you AI-literate yet?" and at first thought it was a new LinkedIn campaign. Until his neighbour explained that it is an obligation under the AI Act. The mortgage adviser finished his drink and googled it the next evening.

What he found was not what he expected. No vague Brussels bureaucracy, but an article that has applied since February 2025 to everyone who uses AI, and that was rewritten in the summer of 2026. Less strict than before, but not optional. For his 32 employees, he should have arranged something long ago.

What Article 4 of the AI Act now literally says

Article 4 has applied since 2 February 2025. The original text required providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff. With the Digital Omnibus on AI (Regulation (EU) 2026/1744), that text was replaced on 27 July 2026. Article 4 now reads:

"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf (...). This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

Translated: if your company uses AI tools (and it almost certainly has for years), you must demonstrably do something to help your people work with AI sensibly. You do not have to guarantee a set level. What you do must fit who uses the tools, for what, and who feels the consequences of the output.

Also new: the European Commission and the member states must help companies with this, SMBs in particular. The Commission will publish practical examples.

Who supervises, and what happens if you do nothing

According to the European Commission’s timeline, national authorities have supervised Article 4 since 2 August 2026. In the Netherlands, the implementing act that formally designates them still has to go to parliament. The Dutch government wrote in April 2026 that this act will enter into force later than the AI Act requires, and that the obligations apply in the meantime regardless, because the regulation has direct effect.

In the draft bill, the Dutch Data Protection Authority supervises Article 4, with the AFM and DNB for financial institutions. There is no fine attached. If the supervisor finds you falling short, it can impose an order subject to a penalty: a concrete instruction with a deadline, and only if you let that pass does it cost money. What else has applied since August is covered in our piece on 2 August 2026.

Who it concerns at your company

Not just your IT team. That is the crucial nuance missing from most summaries. Article 4 refers to staff and other persons dealing with AI systems on your behalf. In practice that means:

Everyone who uses ChatGPT, Copilot, Claude, Gemini or another AI tool for work. Everyone who uses a tool that has AI in it, even if the vendor does not call it that (think modern CRMs, Office Copilot, Outlook smart compose). Everyone who works with a supplier that uses AI and whose output reaches your customer. External contractors, freelancers and interns who work with your AI tools.

At a mortgage firm of 30 FTE, this probably means you touch almost everyone, not just "the IT people".

What AI literacy concretely involves

The law does not prescribe a specific course or certification. According to the European Commission’s questions and answers, no certificate is needed, an internal record of trainings and guidance is enough, and you do not have to appoint an AI officer. That is good news and bad news at the same time. Good, because you do not have to buy an 80-hour programme. Bad, because you have to determine yourself what is appropriate for your situation.

What is appropriate depends on three factors. The person's role (an owner-director does not need to know the same as a data engineer). The type of AI system (a customer-service chatbot calls for something different than a credit-scoring model). The context (sector, sensitivity of data, customer impact).

For an average SMB employee, an appropriate level is roughly this. Understanding what an AI tool can and cannot do. Knowing when output must be verified. Knowing which data must not go into public tools, and why not. Understanding what a hallucination is and how to recognise one (the European Commission names exactly this as an example for anyone working with ChatGPT). Knowing who is responsible if the AI gets something wrong.

That is not rocket science. That is two to three hours of training plus a short reference card.

What you can put on one page today

If you want to start tomorrow and only bring in an external party on Tuesday, you can already roll something out today.

One, a register. Which AI tools are running at our company (official and unofficial), who owns each tool, which departments use it. Two, a short guideline of two pages. What may be used where, with which data yes and with which never. Three, a training plan per role. Owner-director and management team in a 2-hour session, customer-facing employees in a 2-hour session plus an annual update, IT and compliance in a 4-hour session. Four, a review moment every six months. What has changed in the tools, in the law, in our processes.

This is not a watertight compliance programme. This is a reasonably demonstrable minimum if the Data Protection Authority comes knocking tomorrow. For an owner-led company of 15 to 75 FTE with an appropriate risk profile, this puts you in a defensible position in principle.

The part most compliance checklists skip

The new text of Article 4 sounds lighter, and it is. But it still says your measures must take into account your people’s knowledge and experience, the context in which they use AI and the people the output concerns. That means two things.

On the one hand, you do not have to put your whole team through the same generic training. A receptionist needs something different than a mortgage adviser who works with customer data and Wft requirements. On the other hand, you cannot hide behind "we gave everyone a general course". If the Data Protection Authority later asks why a particular adviser pasted customer data into ChatGPT, "he took the general training" is not an answer.

What is appropriate cannot be worked out in an hour. That requires an inventory.

How an AI audit connects here

Two things we do as standard during an AI audit touch Article 4 directly. We map all AI tools, official and unofficial, and categorise per role which employee needs which literacy. And in the report we deliver an appendix that sets out, per use case, which type of training fits, not as an assignment but as advice.

That means the report you get after 14 days is automatically a starting document for Article 4. Not because we are lawyers, but because the inventory the law asks for is virtually the same as the inventory you have to do anyway for effective AI deployment. If you want to anchor it structurally, an AIOS engagement is the logical next step, because there tooling, training and compliance are kept together in the same layer.

If you do one thing this month

Make the register. Without it, every further conversation about compliance is hard to have. With that register, you have already answered the first question from a supervisor and you see for yourself what is actually running at your company. Often that list is longer than expected, and that is where the work begins.

AI that works in your field starts with knowing which AI is at work in your company.

The first step

The obligation already applies, and Dutch supervision is being set up now. That makes this the right moment to get it in order: without panic, but also without postponing it another year. An audit, a report and a first round of training fit comfortably within a quarter.

Fourteen days later, you know which AI tools are running at your company, which employee needs which literacy and which three processes can become safer and faster at the same time.