AI literacy and AI Act Article 4: what do you need to do?

In brief

Already applies: Article 4 of the AI Act has applied since 2 February 2025.
For almost everyone: it applies to every organisation that uses AI systems in its work, even if that is only ChatGPT, Copilot or AI built into existing software.
Measures, not an exam: the text was amended in July 2026. The AI Act asks organisations to take measures that support the AI literacy of their staff. A fixed level per employee is not required.
No certificate required: recording what you have done is sensible, though.
Supervision: under the EU timetable, national supervision should have been in place since August 2026. In the Netherlands, the supervisors have not yet been designated. The rules do already apply.

What is AI literacy?

The AI Act describes AI literacy as the skills, knowledge and understanding needed to use AI systems in an informed way. People need to know what the opportunities are, but also what the risks are and what harm AI can cause.

In practice, that means employees know what they should and should not put into an AI tool, they check what comes out, and they understand the limits of what AI can reliably do.

What does Article 4 require?

Article 4 asks organisations to take measures that support the AI literacy of their staff and of other people who work with AI on their behalf. Those other people might be temporary workers, freelancers or an external agency that uses AI on your behalf.

The law does not prescribe which measures these should be. What is appropriate depends on:

the technical knowledge, experience and training of the people involved;
the context in which the AI is used;
the people the AI is used on, such as customers, job applicants or patients.

So a marketing department that uses AI for draft copy needs something different from an HR department that uses AI to select job applicants. For everyday use of tools such as ChatGPT and Copilot, a general course is a good basis. People who work with AI that helps decide about people need more: knowledge of that specific system and of the human oversight it requires.

Who does it apply to?

The duty applies to providers (those who develop an AI system or place it on the market under their own name) and to deployers. A deployer is any organisation that uses an AI system under its own authority. So you do not need to develop anything yourself: as soon as employees use an AI tool for their work, your organisation is covered.

Only use for purely personal, non-professional purposes falls outside the AI Act. If an employee uses ChatGPT for a quote or a customer email, that is work, and so it is relevant.

What changed in 2026?

In July 2026, the AI Act was amended on a number of points through the so-called Digital Omnibus package: Regulation (EU) 2026/1744, which entered into force on 27 July 2026. As part of this, Article 4 was reworded:

Before: organisations had to take measures to ensure, to their best extent, a sufficient level of AI literacy.
Now: they must take measures that support the development of AI literacy, and they are expressly not required to guarantee any specific level for each person.

So the duty has become lighter: what counts is the measures, not the result for each person. The duty itself has not gone away, and the start date of 2 February 2025 has not changed. What counts is that you take appropriate steps. Record which ones, and you can show it too.

Is a certificate required?

No. The AI Act does not require a certificate, exam or accredited course, and there is no official quality mark for AI literacy training either. A certificate of completion is useful as part of your own records: it shows who completed which training and when.

So be wary of courses that promise an "official AI Act certificate". No such certificate exists. A certificate of completion does not prove that your organisation complies with the AI Act either: it shows which step you have taken.

Who supervises, and what if you do nothing?

Under the EU timetable, national supervision of the AI Act should have been working since August 2026. In the Netherlands, the supervisors have not yet been designated: the Dutch implementing act (Uitvoeringswet AI-verordening) is still being drafted. The government intends to give the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) a central role, together with the Dutch Authority for Digital Infrastructure (RDI). The AP is already the coordinating supervisor for algorithms and AI, supervises the GDPR and has published guidance on AI literacy. The rules of the AI Act already apply in the meantime.

It is hard to say yet how strictly Article 4 will be enforced. But if something goes wrong with your use of AI, for example a data breach because someone pasted customer data into a chatbot, you are in a much stronger position if you can show that you had prepared your employees.

How to tackle it in four steps

The Dutch Data Protection Authority describes AI literacy as a cycle that you keep repeating. For a small or medium-sized business, that can be simple:

Map it out. Which AI tools do you use, who uses them, and what for? Do not forget the AI that is "built into" software you already have, such as your email program, CRM or accounting package.
Set the goal. What do people in each role need to know? Everyone needs to know what not to enter; anyone who works with customer or applicant data needs more.
Put it into practice. Provide a short training session, agree an AI use policy and make sure new employees receive it too.
Review. At least once a year, check whether it still fits: new tools, new roles, new rules.

What should you record?

A simple record is enough. Make sure you can show:

which AI tools you use and what for;
which roles work with them and what they need to know;
who completed which training, when and with what result;
which AI use policy applies;
when you last reviewed all this.

You will find an example of such a policy in our free AI use policy template. To see what training can look like, try the sample lesson.

Sources

This information has been compiled with care, but it is not legal advice.