The managing director of an installation company with eighty staff gets an email from a training provider: AI literacy is a legal requirement, the organisation has to demonstrably comply, and it can do so with a two-hour course, certificate included. She forwards the email to the privacy officer with one question: is this right?
The first part is. The second part is not, at least not in the form the email suggests. Article 4 of the AI Act has applied since 2 February 2025 and asks organisations to take measures towards a sufficient level of AI literacy among the people who work with AI systems on their behalf. There is no course in it, no certificate and no number of hours.
What does the law say?
Providers and deployers take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons using AI systems on their behalf. In doing so they take into account those people's technical knowledge, experience, education and training, the context in which the systems are used, and the persons on whom the systems are used.
That is the whole provision. It is deliberately open, because the same text has to apply to a maker of medical software and to an installation company with eighty people. The Digital Omnibus of July 2026 turned it into an obligation of effort: take measures that support the development of AI literacy. The obligation stayed, the form stayed free. What did and did not change is in the AI Act timeline after the Digital Omnibus.
Who does it apply to?
To whoever makes AI systems and to whoever uses them under their own responsibility. That second group is bigger than it sounds. A hospital with a triage system is a deployer, and so is an office where people use a chatbot for a quote or a report. And "on their behalf" extends to contractors and suppliers who work with the organisation's systems. What else the AI Act asks of an employer is in the EU AI Act for employers.
So the installation company is covered, with the thirty people who use Copilot for email and the five in the office who prepare quotes with a chatbot. Not because the company builds AI, but because it uses it.
What is not required?
The training provider's email mixes what the law asks with what a provider sells. Taken apart:
| What is often assumed | What the text says |
|---|---|
| Everyone has to take a course | Take measures, matched to role and context; a course is one possible measure |
| A certificate goes with it | No certificate and no formal test; your own records suffice |
| There is a minimum number of hours | No hour norm |
| One course for the whole organisation is enough | Sufficient differs per role; what is enough for one person is too little for another |
| It is about being able to program | It is about knowing what you use, what it cannot do, and when not to take an output at face value |
The European Commission confirms in its questions and answers on Article 4 that a certificate is not required and that an organisation records for itself which measures it took. The pillar article AI literacy in 2026 links to that page and goes further into what the Commission says.
What does sufficient mean?
Enough to use AI in your own role with understanding. For most people that comes down to three things: which tools the organisation has allowed and where to look that up, which data does not belong in a prompt, and that an answer from an AI tool is a draft you check. Anyone using AI in decisions about people, in recruitment or customer acceptance for instance, needs to know more: how the system reaches an outcome and when to deviate from it. Anyone assessing or buying tools needs something else again.
That difference per role is exactly what the organisation records. Not "we ran a course", but "this group needed to know this, this is what we did about it, and this is what was decided per tool". Which groups exist in an ordinary organisation and what each needs is in does every employee need AI training.
Who supervises it?
National supervisory authorities have had the power since 2 August 2026. Article 4 has no penalty provision of its own in the regulation; which sanction applies is for the member states to set. In the Netherlands that happens in the AI Act Implementation Act, which is not yet final. Who exactly supervises Article 4, and with which powers, is therefore still open. That is no reason to wait, but it is a reason not to write certainties into your own policy that do not yet exist.
In practice the question "can you show it" rarely comes from a supervisor first. It comes from a client in a tender, from the auditor, from the works council, or after a data breach in which an employee pasted a file into a chatbot. What you put on the table then, and why an attendance list is not enough, is in how do you demonstrate AI literacy.
What does that look like at the installation company?
The privacy officer writes back: mandatory yes, in this form no. She proposes something else. Fifteen minutes in the team meeting for everyone who uses Copilot, with the three basic rules. A short instruction for the five quote writers on what does and does not go from customer files into a prompt. And a register with the decision per tool, so people can look it up when they are unsure.
While drawing up that register, an inventory shows that ChatGPT, Perplexity and a meeting transcription tool are in use alongside Copilot. Nobody ever decided on the transcription tool. That is not an incident and no proof that the explanation is pointless. It shows that a course is one moment, and that the organisation's decision also has to be there at the moment someone opens a tool that did not exist on the day of the course.
