If anyone in your company uses ChatGPT, Copilot, Gemini, Claude or any other AI tool for work, the EU AI Act requires you to train them. Company size and sector make no difference.
The short answer
- Yes, it’s mandatory. Article 4 of the AI Act requires companies that use AI to take measures so their staff have the AI literacy they need. It has applied since 2 February 2025.
- It hasn’t gone away. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) softened the wording, but the obligation still applies to every company that uses AI.
- It’s being supervised now. National market surveillance authorities can supervise and enforce it from August 2026.
- No official certificate or minimum number of hours is required. What counts is that you’ve taken reasonable measures and can prove it.
What Article 4 actually says
The original text, applicable since February 2025, said providers and deployers (any organisation using an AI system in a professional capacity) must take measures to ensure, “to their best extent”, that their staff have “a sufficient level of AI literacy”.
To judge what is sufficient, the Act asks you to consider:
- each person’s technical knowledge, experience, education and training,
- the context each AI system is used in,
- the people it’s used on (customers, candidates, patients…).
Article 3(56) defines AI literacy as the skills, knowledge and understanding needed to use AI in an informed way and to be aware of its opportunities, its risks and the harm it can cause.
What the Digital Omnibus changed
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and amended Article 4 in three ways:
| Before (Feb 2025 – Jul 2026) | After (from 27 July 2026) | |
|---|---|---|
| What’s required | Ensure a “sufficient level” of AI literacy | Take measures to support the development of AI literacy |
| Type of obligation | Closer to an obligation of result | Obligation of effort: reasonable, documented measures |
| Individual level | Not addressed | Explicitly no duty to guarantee a specific level for any individual |
| Who it applies to | Providers and companies using AI | Unchanged: nobody was exempted |
The Omnibus also asks the Commission and Member States to support SMEs with practical compliance examples. That means more help, but the obligation still sits with the company.
Key AI Act dates for SMEs
| Date | What happens |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | AI literacy (Art. 4) and the prohibited practices apply |
| 27 July 2026 | The Digital Omnibus enters into force with the new wording of Art. 4 |
| 2 August 2026 | National authorities start supervising and enforcing. Transparency obligations (Art. 50) apply |
| 2 December 2027 | High-risk obligations under Annex III, such as AI used in recruitment, performance evaluation or credit scoring |
| 2 August 2028 | High-risk under Annex I (AI built into regulated products) |
Does it apply to my company?
Almost certainly. All it takes is someone on your team using AI for work:
- Drafting emails, quotes or proposals with ChatGPT or Claude.
- Summarising meetings with Copilot, Gemini or a transcription app.
- Serving customers with a chatbot or a voice agent.
- Reading invoices or documents with an AI-powered OCR tool.
- Screening CVs or scoring leads with software that uses AI.
Details that are often missed:
- There’s no headcount threshold. A 5-person company is covered just like a 500-person one.
- It includes people working on your behalf. Freelancers, contractors and outsourced staff who use AI in your business.
- Shadow AI counts too. If your team uses personal ChatGPT accounts for company tasks, your company is using that AI, even if nobody approved it.
What happens if I don’t comply?
The AI Act doesn’t set a specific EU-level fine for Article 4. Each Member State sets its own penalties, and supervision started in August 2026. The real risk lies elsewhere:
- It makes other problems worse. If an employee makes a mistake with AI (personal data pasted into an unapproved tool, a discriminatory decision, false information sent to a client), being unable to show you trained them puts the company in a weaker position with regulators, courts and data protection authorities.
- Authorities will ask about it. It’s the easiest obligation to check: they just ask for your evidence.
- Larger clients already require it. More and more supplier questionnaires and public tenders ask about your AI policy and staff training.
Common myths
“The Omnibus scrapped it.” No. It softened it into an obligation of effort, but it still applies to every company that uses AI.
“I need an official certificate.” There’s no mandatory official certificate. The European Commission has said an internal record of the training is enough.
“A generic online course covers it.” It’s a good start, but the Act asks you to consider the context of use and each person’s background. Someone using AI to screen candidates needs something different from someone using it to draft emails.
“It only affects tech companies.” It affects any company whose staff use AI at work, whether it’s a law firm, an estate agency, a hotel or a landscaping company.
A 5-step plan to comply (and get value from it)
The good news: doing this properly isn’t just about the legal requirement. A team that knows how to use AI saves hours every week. This is the plan we follow with our clients.
1. Take stock of the AI already in use
Ask each department which tools they use, what for, and with what data. Include the ones nobody approved. The result is a simple table: tool, who uses it, for which task, and what data goes in.
2. Set levels by role and risk
Not everyone needs the same training:
| Profile | Examples | What they need to know |
|---|---|---|
| Basic use | Drafting, summarising, translating | How language models work, errors and “hallucinations”, which data never to enter, checking before sending |
| Use with data or customers | Customer service, sales, finance | All of the above, plus data protection, bias, transparency with customers and when to hand over to a person |
| Decisions about people | HR, recruitment, evaluation, credit | All of the above, plus human oversight, discrimination and the high-risk obligations (December 2027) |
| Whoever sets up or buys AI | IT, management, process owners | Vendor risk, contracts, security, logging and the internal AI policy |
3. Train in two rounds: everyone, then each department
- One general session for everyone on what AI is, what it does well and badly, the risks, and the company policy.
- One session per department on their real tasks. This is where the return is: each team leaves with its own use cases working, not a list of ideas.
4. Write a one-page AI use policy
It should answer five questions:
- Which tools are approved (and with which accounts: company, not personal).
- Which data must never be entered.
- What a person must review before anything leaves the company.
- When customers must be told that AI is involved.
- Who to ask when in doubt.
5. Keep the evidence
If an authority asks, this is what you should be able to show:
- Inventory of AI tools and their uses
- AI use policy, signed or accepted by staff
- Content and materials of each training session
- Attendance records with date, duration and each attendee’s role
- Training record for new hires
- Date of the next review (AI changes fast: review at least once a year)
How we did it for a group with 8 departments
A group of companies in the Balearic Islands, working in waste management, urban furniture, landscaping and public services, felt it was falling behind on AI. We took this same approach:
- On-site discovery, one department at a time: 8 departments and 75 processes mapped.
- A general workshop for the whole office, From chatbot to agent, with a clear usage policy: company accounts only, read-only access to systems, and a person signs off everything that leaves the company.
- One session per department on their real processes: payroll checks with HR, quotes with sales, council reports with the technical office and invoice reconciliation with finance.
The result: a programme that covers Article 4 and, above all, more than 1,600 hours a year freed from repetitive admin work. You can read the full case study here.
Can the training be funded?
Often, yes. Many EU countries let companies fund staff training through national schemes. In Spain, for example, AI training can be paid for with the company’s annual FUNDAE training credit if it meets the scheme’s requirements. Check with your accountant or local training body before you plan the sessions.
Frequently asked questions
How many hours of AI training are mandatory? There’s no set number. The AI Act doesn’t specify minimum hours. A reasonable starting point for an SME is a 2–4 hour general session plus a hands-on session per department, with more depth for people who make decisions about others.
Can I just ban AI instead? In practice, no. If nobody uses AI there’s no obligation, but bans rarely work: AI ends up being used anyway on personal accounts, with no control and no training. It’s safer to approve tools and train the team.
Does it apply to freelancers? If a freelancer uses AI in their professional activity, they’re a deployer and the obligation applies. In practice, they comply by training themselves and anyone who works for them.
Who enforces it? The national market surveillance authorities each Member State has designated (in Spain, AESIA). Where AI processes personal data, the data protection authority is also involved.
Do I have to repeat the training? The Act doesn’t set a frequency, but the tools change every few months. Review the programme at least once a year and train every new hire.
Want it sorted in a few weeks?
At Aitomatik we design and run AI training for companies, tailored to each department, together with the inventory, the use policy and the evidence log. Your team meets Article 4 and learns to save time with AI in their real work. Book a free call and we’ll show you how we’d approach it for your company.
This guide is for information only and isn’t legal advice. Last reviewed: 14 October 2026.
