Key takeaways
- Since 2 February 2025, the EU AI Act has required businesses that use AI systems to ensure sufficient AI literacy among their staff.
- It can reach businesses outside the EU whose AI output is used in the EU.
- The 2026 omnibus deferred high-risk obligations, not the literacy duty.
- Proportionate, role-based training that you record is the practical answer.
Most of the coverage of the EU AI Act is about high-risk systems, which most smaller businesses will never build. The part that does apply to almost every business using AI in Europe is shorter and less discussed: Article 4, the AI literacy duty. If your staff use ChatGPT, Copilot, Claude or Gemini at work and you operate in the EU, it applies to you now.
What Article 4 says
Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other people dealing with AI systems on their behalf. What is sufficient takes account of their technical knowledge, experience, education and training, the context the systems are used in, and the people the systems affect.
A "deployer" is any organisation using an AI system under its authority in a professional capacity. A business that gives its staff a business AI assistant is a deployer.
Who it covers
- Businesses established in the EU using AI systems at work.
- Providers and deployers outside the EU where the output of the AI system is used in the EU.
If you are an Australian, UK or US business with EU staff, an EU office, or EU clients receiving AI-assisted work, check your position with an adviser.
What changed in 2026
The Digital Omnibus on AI, adopted in 2026, pushed back the main obligations for high-risk AI systems: to 2 December 2027 for stand-alone high-risk systems such as those used in employment and education, and to 2 August 2028 for systems embedded in regulated products. The transparency obligations in Article 50 have applied since 2 August 2026, with a grace period for some marking requirements.
The literacy duty was already in force before the omnibus and was not part of the deferral. If you have not acted on it, you are not early.
What proportionate looks like
The Act does not prescribe a course, an exam or a certificate. For a business using AI assistants, a reasonable programme covers:
| Topic | Everyone | Heavy users and managers |
|---|---|---|
| What AI tools do well and badly | Yes | In more depth |
| Your data rules: what can and cannot go in | Yes | Yes |
| Checking output before relying on it | Yes | Yes, with examples from their work |
| When not to use AI | Yes | Yes |
| Bias and decisions about people | Awareness | Yes, for anyone involved in hiring, assessment or pricing |
| Agents, connectors and approvals | Awareness | Yes, for agent owners |
How to show you have done it
- Write down what training each role receives.
- Record who attended or completed it, and when.
- Keep a copy of the materials and the usage policy they were trained on.
- Repeat or refresh it when tools or rules change materially, and at least annually.
- Include it in onboarding for new starters.
Useful side effect: literacy training that is built around people's real work is also the training that drives adoption. Compliance and return on investment point the same way here. See AI training for employees.
This page is a plain-language summary based on published sources as of October 2026, not legal advice. For Australian obligations, see the Privacy Act automated decision rules.
Frequently asked questions
Is AI training mandatory under the EU AI Act?
Article 4 requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others using AI on their behalf. It has applied since 2 February 2025. It does not prescribe a specific course or certificate.
Does the EU AI Act apply to businesses outside the EU?
It can. The Act applies to deployers located in the EU, and to providers and deployers outside the EU where the output of the AI system is used in the EU. A business elsewhere with EU operations or EU clients should check its position.
Did the Digital Omnibus delay the AI Act?
The Digital Omnibus on AI, adopted in 2026, deferred the main high-risk system obligations to December 2027 for stand-alone systems and August 2028 for product-embedded systems. Obligations already in force, including the prohibitions and AI literacy, were not deferred by that change, though you should check the final text for any amendments to their wording.
What counts as sufficient AI literacy?
It depends on the person's role, their technical knowledge, and the context the AI is used in. For a typical business using AI assistants, practical training on what the tools do well and badly, data handling rules, checking output, and when not to use AI is a reasonable basis, recorded so you can show it happened.
Get a straight answer for your business
The Clarity Package gives you a written business case and a detailed implementation plan for 500 USD. The Implementation Package does the whole build, live in 30 days, for a fixed 5,000 USD.