Rules
What the European AI literacy rule asks of employers, what changed in summer 2026 and how to demonstrate the measures your organisation has taken.
Yes. Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures supporting the development of AI literacy among their staff and others working with AI on their behalf. The rule has applied since 2 February 2025. The law does not prescribe a course, examination or fixed knowledge level.
The AI regulation is Regulation (EU) 2024/1689, commonly called the AI Act. Article 4 is in Chapter I. Under Article 113, Chapters I and II apply from 2 February 2025, well before the remainder of the regulation.
The regulation defines it in Article 3(56). In brief: the skills, knowledge and understanding enabling providers, deployers and affected people to deploy AI systems in an informed way and become more aware of opportunities, risks and possible harm. It therefore involves more than knowing the controls. Someone must be able to judge when an outcome is wrong and the consequences for the people concerned.
The original text called for measures to ensure, “to their best extent”, a “sufficient level” of AI literacy. That wording was replaced by the digital omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026. It was published on 24 July 2026 and entered into force on the third day afterwards, 27 July 2026.
Article 4 now has three paragraphs.
The amendment's explanatory text says strict obligations ensuring a sufficient level proved unsuitable for all types of organisations and created additional regulatory burdens, especially for smaller businesses.
The obligation remains. The word “sufficient” has disappeared, along with the question of whether each employee reaches a particular standard. What remains is a duty to do something suited to your people and use. Doing nothing is therefore still not an option. The omnibus's other amendments, such as later dates for high-risk systems, appear in The AI Act in autumn 2026.
Read older explanations with this amendment in mind. Many articles and training offers predating summer 2026 still quote the old text.
Providers and deployers of AI systems. A provider develops an AI system or places it on the market. Most employers fall into the second group.
Under Article 3(4), this is a natural or legal person, public authority or other body using an AI system under its authority, except for personal non-professional activity. If employees use a chatbot for work, your organisation uses an AI system. Organisation size makes no difference: the rule has no lower threshold.
The European Commission's AI literacy Q&A explains that this means people who are not employees but fall within the organisation, such as a contractor or service provider. If a freelancer or agency worker uses the same AI tools at your organisation, include them.
An additional rule applies. Article 26(2) requires deployers of high-risk AI systems to assign human oversight to people with the necessary competence, training and authority. The Commission emphasises in its Q&A that this obligation remains unchanged. A document search function or writing chatbot does not automatically fall into that category. AI contributing to decisions about applicants, employees or credit may do so. That requires its own assessment.
The law does not specify which measures to take. The Commission and the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, have explained possible approaches.
The Commission's Q&A was updated after the omnibus. It identifies four points an organisation should at least consider.
The Commission further writes that Article 4 contains no obligation to measure employees' knowledge and that no qualification is required. Organisations may keep an internal record of training and other initiatives.
The AP has an AI literacy page and two guides: Getting started with AI literacy, dated 30 January 2025, and Building further on AI literacy, dated 23 October 2025. The first describes four steps: identify, set objectives, implement and evaluate. The second develops a multi-year action plan with practical examples.
The AP writes that the knowledge needed varies by situation and depends on context and risks, and that the law does not specify exactly which measures are needed. It recommends making AI literacy a priority and approaching it strategically. Remember these documents date from 2025, before Article 4 was amended. The step-by-step approach remains useful. Read the current legislation for the obligation's wording.
Not everyone needs the same knowledge. The table below is an example of classification by role, rather than a legal prescription. Adapt it to your own tools and risks.
| Role in the organisation | What someone needs to know | How you record it |
|---|---|---|
| Management or board | Which AI the organisation uses, its risks and what the rules require | AI policy decision and an annual discussion in the minutes |
| Managers | Which uses their team is permitted and how to handle a mistake or incident | Basic training attendance and additional instruction |
| Employees using a chatbot | What happens to input, which data is prohibited and how to check an answer | Training date per person, with the material's version |
| Employees working with client files | How to ask questions without names, what pseudonymisation does and does not do, and when to reread the source | Tool-specific training and refresher date |
| IT and application administration | Settings, access permissions, logging and supplier arrangements | Administration documentation and configuration changes |
| Privacy lead or data protection officer | The GDPR connection: register, DPIA and data breaches | Advice and the assessments themselves |
| Temporary staff and contractors | The same rules as the employees alongside them | Agreement in the assignment and training attendance |
Caution is appropriate here. This is the position on 13 October 2026.
According to the Commission's Q&A, supervision of Article 4 rests with national market surveillance authorities rather than the European AI Office. The supervision and enforcement rules apply from early August 2026. The Commission gives 2 August in one part of its Q&A and 3 August 2026 in another. Article 113 of the regulation gives 2 August 2026 as the general application date.
Article 99 instructs Member States to lay down rules on penalties and other enforcement measures, including warnings and non-monetary measures. They must be effective, proportionate and dissuasive. What an Article 4 infringement costs in practice therefore depends on national legislation. The Commission writes that enforcement should be proportionate and a sanction is more likely after an incident attributable to inadequate training or guidance. It also points out that someone suffering harm may bring a claim under national legislation.
On its AI regulation page, the AP writes that the government is working on a supervision proposal, multiple supervisory authorities are expected, and the extent of the AP's own supervision has not yet been established. The allocation of responsibilities will appear in Dutch legislation. On 13 October 2026, the AP's pages did not say that this legislation already applies. Therefore, assume neither that nothing can happen nor that a fine will follow tomorrow. The obligation itself has applied since February 2025. Follow the AP and Dutch central government for the latest position.
There is no prescribed format. According to the Commission, an internal record suffices. Ensure it answers questions a supervisory authority, client or accountant might ask.
A one-off presentation without an attendance list cannot be demonstrated afterwards. A signature under “I have read the policy” says little about understanding. And training detached from people's actual tools misses what the law requires: accounting for the context of use.
AI literacy concerns AI, not just privacy. In practice, the subjects strongly overlap. An employee understanding what happens to their input is less likely to put a client file into a chatbot. The rules by data type explain which data does and does not belong there.
PrivaSearch pseudonymises personal data in documents, has a colleague approve the result and then makes released text searchable, including by a connected AI assistant. That connection works with Claude, ChatGPT Business and Mistral Vibe. People working in such an environment need to understand what they are using. That is why the product includes training.
The page on how it works puts it this way: employees take brief AI literacy training, in line with Article 4 of the AI Act, with periodic refreshers. Without current training, the workspace does not open and the MCP connection also refuses access. Training is therefore an access condition rather than a separate part you can skip.
On the page about the GDPR and the AI Act, we call this built-in training with periodic refreshers instead of a prohibition employees circumvent. It also says actions in the environment are logged and you receive an AI policy starter document. That is a starter document rather than legal advice.
The boundary is equally clear. The training covers working with PrivaSearch and a connected assistant. It does not cover all AI use in your organisation or take over your Article 4 obligation. You decide which measures suit your people and tools. Read what a connected assistant can and cannot see on the page about AI chatbots and the GDPR.
To see how training and access are connected, book a demo.
Since 2 February 2025. Article 4 of the European AI regulation became applicable on that date. An amended text has applied since 27 July 2026: organisations take measures supporting AI literacy development and need not ensure a particular level per person. According to the European Commission, supervision by national authorities applies from early August 2026.
Yes. Article 4 makes no distinction by size. Every organisation using an AI system under its own authority for work falls within it, including an office with five people using a chatbot. You may tailor measures to your situation. The Commission and Member States must specifically support small and medium-sized enterprises, including through practical examples.
No. The law prescribes no course, examination or qualification. In its Q&A, the European Commission says a qualification is unnecessary and organisations may keep an internal record of training and other initiatives. A course can be a good measure, but so can work instructions, a team meeting or training within the tool itself.
That depends on national legislation. The AI regulation instructs Member States to establish penalties and other enforcement measures. According to the Autoriteit Persoonsgegevens, supervision had not yet been allocated in the Netherlands in October 2026. The European Commission writes that enforcement should be proportionate and a sanction is more likely after an incident caused by inadequate training. Consult a lawyer about your own situation.
The law does not prescribe registration, but without a record you cannot show what you have done. The European Commission identifies an internal record of training and other initiatives as a suitable format. Record which training each person took and when, and retain the material. Keep the record no larger than necessary: it is data about your employees.
An AI policy contains the arrangements: which tools, which data, who decides. AI literacy is the knowledge and skill to work with AI and recognise risks. Neither works without the other. Rules nobody understands are not followed, and knowledge without rules provides no guidance. In practice, you describe training in the policy.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →