AI literacy at work: what the EU now expects, and what a useful training plan covers

Article 4 of the EU AI Act, the AI literacy rule, has applied since February 2, 2025. It covers companies that provide or deploy AI systems, which in practice means almost any company whose staff use AI tools at work and that operates in the EU.

The July 2026 AI Omnibus amendment softened the wording. Companies now have to "take measures to support the development of a sufficient level of AI literacy" among relevant staff, rather than ensure it, according to White & Case. The duty itself remains.

The European Commission published a question-and-answer guide on the rule in May 2025. Its answers are more practical than most training pitches.

What the Commission says

According to a summary by law firm Hunton Andrews Kurth, the Commission's Q&A makes these points:

• No certificate needed. External certification is not required. Companies should record and document the measures they take.
• Pointing staff at the manual is not enough. Referring people to the instructions that come with an AI system is generally not sufficient.
• One size doesn't fit all. What counts as enough depends on staff experience, the AI systems they use and the context, and is judged case by case.
• Cover the known risks. Training should cover the risks of common generative AI tools, such as hallucination.
• Contractors count. For third-party staff, a company can train them directly or set training requirements in contracts.

Supervision and enforcement powers apply from August 3, 2026. People who suffer harm they attribute to a company's failure to meet Article 4 can already seek redress through the courts.

What a useful plan looks like

The Commission's guidance lines up with what makes training useful anyway. A plan that will stand up to scrutiny can be short:

1. List the AI tools in use and who uses them. The training for a developer using a coding assistant differs from the training for HR staff screening CVs.
2. Set a baseline course for everyone. Cover what generative AI is, why it makes confident mistakes, what data must never be pasted into it, and when a person must check the output.
3. Add role-specific modules for higher-risk uses, such as hiring, credit decisions, customer communications and code that reaches production.
4. Keep records. Note who completed what and when. That record is your evidence.
5. Refresh it. The Commission expects training to be frequent and specific. Tie updates to new tools and new policy.

Companies outside the EU have no Article 4 duty, but the same plan reduces the most common AI incidents: leaked confidential data and unchecked wrong answers.