Yes, since 2 February 2025. What Article 4 of the AI Act asks after the Digital Omnibus, what fits each role and what it does not require: no certificate or minimum hours.
Quick answer
Yes. Article 4 of the AI Act has applied since 2 February 2025 to every organisation that builds or uses AI systems, including an office where people work with a chatbot. Since the Digital Omnibus took effect on 27 July 2026, the duty is to take measures that support the AI literacy of staff and others who use AI on the organisation's behalf. No individual has to reach a guaranteed level. The law mentions no certificate, no compulsory course and no number of hours. What counts is being able to show what you did for each role.
01
Article 4 of the AI Act has applied since 2 February 2025 to every organisation that builds or uses AI systems
02
Since the Digital Omnibus of July 2026 it asks for measures that support AI literacy, without guaranteeing a level for any individual
03
No certificate, no minimum hours and no compulsory external training
04
Which measures fit differs by role and context, and that difference is what you record
05
The European Commission and the member states now have to help organisations with this, SMEs in particular
06
You are more likely to be asked to show it by a client, an auditor or the works council than by a regulator
The managing director of a building services company with eighty staff receives an email from a training provider: AI literacy is a legal requirement, the organisation must be able to prove it complies, and a two-hour course with a certificate will take care of that. She forwards the email to the privacy officer with one question: is this right?
The first part is. The second is not, at least not in the form the email suggests. Article 4 of the AI Act has applied since 2 February 2025 and asks organisations to take measures that support the AI literacy of the people who work with AI systems on their behalf. It says nothing about a course, a certificate or a number of hours. And since summer 2026 it says in so many words that the organisation does not have to guarantee a particular level for anyone.
#What does Article 4 say since the Digital Omnibus?
The Digital Omnibus on AI took effect on 27 July 2026 and rewrote Article 4. The article now has three paragraphs. In plain terms:
Providers and deployers take measures to support the development of AI literacy among their staff and others who deal with AI systems on their behalf. They take into account those people's technical knowledge, experience and training, the context of use and the people on whom the systems are used. The duty does not require them to guarantee any specific level of AI literacy for any individual.
The European Commission and the member states support organisations in meeting that duty, SMEs in particular. To that end the Commission publishes practical examples.
The AI Board, made up of the member states, adopts recommendations with common objectives to help the Commission and the member states do this.
The old text set a higher bar. It required organisations to ensure, to their best extent, a sufficient level of AI literacy. The word "sufficient" has gone, and with it the question of whether everyone in the organisation knows enough. What remains is the duty itself, for anyone who builds or uses AI, and the circumstances you take into account. What else the omnibus changed is set out in the AI Act timeline after the Digital Omnibus.
The amended text is published as Article 4 on the AI Act Service Desk of the European Commission, based on the consolidated version of 27 July 2026. Checked 29 October 2026.
To whoever makes AI systems and to whoever uses them under their own responsibility. That second group is larger than it sounds. A hospital with a triage system is a deployer, and so is an office where people use a chatbot to write a quote or a report. And "on their behalf" extends to contractors and suppliers who work with the organisation's systems. What else the AI Act asks of an employer is covered in the EU AI Act for employers.
So the building services company is covered, with its thirty people who use Copilot for email and the five office staff who prepare quotes with a chatbot. Not because the company builds AI, but because it uses it.
The training provider's email mixes up what the law asks with what a training company sells. Separated out:
What is often assumed
What the text says
Everyone has to take a course
Take measures that support AI literacy, matched to role and context; a course is one possible measure
You need a certificate
No certificate, no formal test and no compulsory external training
There is a minimum number of hours
No minimum hours
Everyone has to reach a set level
Since July 2026 the text says explicitly that no individual level has to be guaranteed
One course for the whole organisation is enough
Which measure fits differs by role; what is enough for one person is too little for another
It is about being able to program
It is about knowing what you use, what it cannot do and when not to take an output at face value
The European Commission states in the frequently asked questions on the AI Act Service Desk that there is no obligation for external training or external certification. Checked 29 October 2026. Our article on AI literacy in 2026 looks more closely at what the Commission said about Article 4 before the omnibus.
"Sufficient" is no longer in the law, but the question behind it is still the right one: what does someone need in order to use AI knowingly in their own role? For most people it comes down to three things: which tools the organisation has allowed and where to look that up; which data does not belong in a prompt; and that an AI answer is a draft to be checked. Anyone using AI in decisions about people, in recruitment or customer onboarding for instance, needs to know more: how the system reaches an outcome and when to override it. Anyone assessing or buying tools needs something different again.
Those differences between roles are exactly what the organisation records. Not "we ran a course", but "this group needed to know this, this is what we did about it and this is what was decided about each tool". The law does not ask for that overview, but without it you cannot show that you took measures. Which groups an ordinary organisation has and what each needs is covered in our article on whether every employee needs AI training.
Enforcement of the AI Act started on 2 August 2026. The regulation sets no penalty specifically for Article 4; it is up to each member state to decide on sanctions and to designate the authorities that supervise. In the Netherlands, for example, the bill for this was open for public consultation from 20 April to 1 June 2026 and is not yet final. Checked 29 October 2026. Exactly who supervises Article 4, and with what powers, therefore still depends on where you operate. That is no reason to wait, but it is a reason not to write certainties into your own policy that do not yet exist.
In practice the question "can you show it?" rarely comes from a regulator first. It comes from a client in a tender, from the auditor, from the works council or after a data breach in which an employee pasted a file into a chatbot. What you put on the table then, and why an attendance list is not enough, is covered in our article on demonstrating AI literacy.
#What does that look like at the building services company?
The privacy officer replies: mandatory, yes; in this form, no. She proposes something else. Fifteen minutes in the team meeting for everyone who uses Copilot, covering the three basic rules. A short briefing for the five staff who write quotes on what can and cannot go from customer files into a prompt. And a register with the decision on each tool, so people can look it up when they are unsure.
While the register is being drawn up, an inventory shows that ChatGPT, Perplexity and a meeting transcription tool are in use alongside Copilot. Nobody ever made a decision on the transcription tool. That is not an incident, nor proof that the briefing is pointless. It shows that a course is a single moment, and that the organisation's decision also has to be there when someone opens a tool that did not exist on the day of the course.
AI register
AllowedUnder reviewNot allowedAll tools
Search by tool, vendor, domain or former name…
1,012 tools
🇨🇳
DeepSeek
Critical · 90/100
Not allowed
🇺🇸
Otter.aiNew
High · 68/100
No decision yet
🇺🇸
Grok
High · 67/100
Not allowed
🇺🇸
ChatGPT
High · 62/100
Allowed
🇺🇸
Perplexity
Medium · 55/100
No decision yet
🇺🇸
HeyGen
Medium · 53/100
No decision yet
Every tool, scored for risk
Over 1,000 AI tools, each scored from Low to Critical. Nothing is approved or blocked until someone decides.
BeeSensible links a catalogue of AI tools to the use it sees in the organisation. The organisation sets the status of each tool in an AI register, and every tool starts with the status "No decision yet". Anyone who opens a tool in the browser that the organisation has restricted or not allowed gets a notice with the condition or the alternative. The figures on how those notices land carry no user ID. Which tools are in use is covered on the AI tools page; more on the subject is under AI governance.
The training provider's email does not go in the bin, but the reply asks a different question: not "do we get a certificate?" but "what will our people in each role know, and how will they find the decision when they open a tool?"
FAQ
Common questions
Since when has AI literacy been mandatory?
Since 2 February 2025. On that date the first parts of the AI Act started to apply, including Article 4 on AI literacy and Article 5 on the prohibited practices. Since 27 July 2026 Article 4 has applied in the form the Digital Omnibus gave it. Most of the rest of the regulation followed on 2 August 2026; the obligations for high-risk systems have been pushed back to December 2027 and August 2028.
What did the Digital Omnibus change in Article 4?
The old text asked organisations to ensure, to their best extent, a sufficient level of AI literacy. The new text asks for measures that support the development of AI literacy, and adds that the organisation does not have to guarantee any specific level for any individual. It also now requires the European Commission and the member states to support organisations, and the Commission to publish practical examples. The duty itself remains.
Does every employee have to take an AI course with a certificate?
No. The AI Act does not mention a course, certificate, test or number of hours. The European Commission states on the AI Act Service Desk that there is no obligation for external training or external certification. A training course can be a good measure, but the law does not prescribe the format.
Does Article 4 also apply to a small business that only uses ChatGPT?
Yes. The provision is addressed to providers and deployers, and an organisation whose staff use a chatbot for work is a deployer. Which measures fit does differ between a small office and a hospital using AI for triage. Since July 2026 the Commission and the member states have to support organisations in meeting the duty, SMEs in particular.
Do you have to guarantee a certain level of AI literacy?
No. Since the Digital Omnibus, Article 4 states explicitly that the duty does not require the organisation to guarantee a specific level of AI literacy for any individual. What the organisation does have to do is take measures, taking into account people's knowledge, experience and training, the context of use and the people on whom the systems are used. What that means for each role is for the organisation to decide.
What happens if an organisation does nothing about AI literacy?
The regulation sets no penalty specifically for Article 4; member states set sanctions in national law, and in the Netherlands, for example, the AI Act Implementation Act is not yet final. In practice you are more likely to be asked to show it by a client in a tender, the auditor or the works council, or after a data breach in which someone pasted a file into a chatbot.
