EU AI Act: AI Literacy Obligation for Companies in 2026

The AI literacy obligation in the EU AI Act is no longer a distant headline. Since 2 February 2025, Article 4 has required companies to give their staff a sufficient level of AI literacy. The next hard date is concrete: from 2 August 2026, national market surveillance authorities take over enforcement. Any company that uses AI day to day and has put this off now faces a date in the calendar, not a vague risk.

What Article 4 actually requires

The wording of Article 4 is short and still has teeth. Providers and deployers of AI systems must take measures so that their own staff, and other people operating AI on their behalf, have a sufficient level of AI literacy. The yardstick is the prior knowledge, experience and training of the people involved, plus the specific context in which the AI is used.

The key word is deployer. It means any organisation that uses AI systems professionally, not only those who build or sell them. A marketing team drafting copy with a language model, a finance function running an AI assistant over receipts, a sales team with Copilot in its Office suite: all of them fall under the duty. The requirement is also not limited to high-risk systems. As soon as AI shows up in daily operations, Article 4 applies. The text of Article 4 is worth reading once in the original, it is shorter than most tool licence agreements.

The deadlines: in force since February 2025, enforced from August 2026

The EU AI Act takes effect in stages, and those stages are the source of most confusion. The law entered into force on 1 August 2024. The bans on certain practices and the AI literacy duty under Article 4 have applied since 2 February 2025. There is no transition period for Article 4, a point the European Commission has stated explicitly.

What changes on 2 August 2026 is enforcement. From that date, national market surveillance authorities supervise compliance and can act. Several other pieces go live in parallel: the obligations for high-risk systems, the transparency rules in Article 50, and the penalty framework that member states apply. The duty itself is old, the teeth are new.

For the full timeline and the mapping into risk classes, see our EU AI Act compliance checklist. For how AI literacy fits into broader control, the article on AI governance for agentic AI gives the wider picture.

What “sufficient AI literacy” means in practice

There is no fixed curriculum, and that is intentional. Sufficient means the competence that matches the role, the systems in use and the risk. Someone who only drafts text with a model needs different knowledge than someone who wires an AI system into a decision process.

In practice three layers stand out. The first is foundational understanding: how generative AI works, where it hallucinates, where its limits are. The second is data handling, meaning which information may go into which tool, what the GDPR (the EU data protection regulation, known to German readers as DSGVO) requires, and where trade secrets begin. The third is governance: internal usage rules, the point at which a human must review, and the labelling of AI content under Article 50.

Evidence is what counts. Supervisors do not check intentions, they check records. Companies need to show that they took measures, for example through training materials, attendance records and a documented AI policy. The official Commission Q&A on AI literacy confirms this direction.

A pragmatic five-module plan for SMEs

A company of around 50 staff does not need an academy. Mittelstand firms, the small and mid-sized companies that form the backbone of the German-speaking economy, can cover the duty with an internal programme of five modules.

1. Fundamentals for everyone. One or two hours on how generative AI works, on hallucinations and on limits. Mandatory for anyone who uses AI.
2. Data protection and confidentiality. Which data may go into which tool, how the GDPR applies, and how trade secrets stay protected.
3. Role-specific depth. Concrete use cases and risks per function, from marketing through engineering to management.
4. Governance and sign-off. The internal AI policy, the human-in-the-loop step, and the labelling obligations from Article 50.
5. Refresher and proof. An annual update, inclusion in onboarding, and clean documentation of attendance.

The proof can stay lightweight. A short record per team or per person is enough, as long as it is traceable:

ai_literacy_record:
  unit: "team-marketing"
  modules: ["fundamentals", "data-protection", "role-specific"]
  completed: 2026-07-15
  format: "in-house-workshop"
  refresher_due: 2027-07-15

This is lived practice for us, not theory. EverBright runs its own processes with AI agents and human-in-the-loop controls, from research to content creation. The pitfalls that surface there feed straight into how we train teams. If your AI adoption is still at the very start, the article on AI for small companies is a good entry point.

Conclusion

The AI literacy duty has been law since early 2025, and from August 2026 it gets enforced. Handling it well is not a panic project but a manageable plan: build understanding, settle the data rules, write down the governance, document attendance. Companies that start now finish in time and gain teams that use AI more safely along the way.

For support with AI governance, internal policies and staff training, our AI consulting team can help. We bring the experience from running an AI-native operation ourselves.

Frequently Asked Questions

When does the EU AI Act AI literacy obligation apply?

The duty under Article 4 has applied since 2 February 2025, with no transition period. From 2 August 2026, national market surveillance authorities take over supervision and enforcement. The obligation already exists today, while official control begins with the August deadline. Companies should treat the duty as active right now.

Which companies are affected by Article 4?

Both providers and deployers of AI systems are affected. A deployer is any organisation that uses AI professionally, even if it only runs standard tools such as language models or AI features inside office software. The duty is not limited to high-risk systems, so it reaches almost every business that uses AI in practice.

What does sufficient AI literacy mean in concrete terms?

There is no fixed curriculum. Sufficient is the knowledge that matches the role, the systems in use and the risk. A sensible programme covers three layers: a foundational understanding of generative AI, safe handling of data and the GDPR, and internal governance with clear sign-off and labelling rules.

Are there fines for missing AI training?

Article 4 carries no dedicated fixed fine, but it is part of the enforceable framework. From August 2026, national authorities can investigate breaches and sanction them through the general penalty mechanism of the EU AI Act. More important than the fine question is usually the evidence that measures were actually taken.

How do we prove the AI training took place?

Through documentation. Training materials, attendance records and a written AI policy are usually enough. A short record per team works well, listing the modules, the date and the next refresher. Adding the foundational session to the onboarding of new staff keeps the proof current without extra effort.