AI literacy under Article 4 of the AI Act: what SMEs need to do now
Article 4 of the AI Act has applied since February 2025 and was rewritten in July 2026. What the AI literacy duty means for small companies, who enforces it and what to document.
Since 2 February 2025, every company that uses AI has a duty under the EU AI Act that many managing directors have not heard of: it has to look after the AI literacy of its people. It is Article 4 of Regulation (EU) 2024/1689, and it applies to the company where "only" the office uses ChatGPT, too.
In July 2026 the article was rewritten. The duty stayed. It is just phrased more realistically now. Here is what that means for a small or mid-sized company.
What does Article 4 actually require?
Providers and deployers of AI systems must take measures to support the development of AI literacy among their staff and other people who deal with AI systems on their behalf. In doing so they take into account technical knowledge, experience, education and training, the context the AI is used in, and the people it is used on.
A "deployer" under Article 3(4) is anyone using an AI system under their own authority, except in a personal, non-professional activity. If your team uses ChatGPT, Copilot or an AI workspace for work, you are a deployer.
"AI literacy" is defined in Article 3(56) as the skills, knowledge and understanding to deploy AI in an informed way and to be aware of its opportunities, its risks and the harm it can cause. Coding is not part of it.
What changed in July 2026?
Regulation (EU) 2026/1744, the Digital Omnibus on AI, rewrote Article 4. It has applied since 27 July 2026.
The old text asked companies to ensure, "to their best extent", a "sufficient level" of AI literacy. The new one speaks of measures that support its development, and adds that this does not require anyone to guarantee a specific level of AI literacy for any individual. An obligation of result became an obligation of effort, one you need to be able to show.
The European Commission sums it up like this: AI literacy remains an obligation for providers and deployers, but no specific or "sufficient" level is mandated any more. Reading that as "no longer needed" is reading it wrong. Doing nothing is still not a measure.
Who enforces it, and what is at stake?
Not Brussels. National market surveillance authorities are in charge, and according to the Commission they have been supervising and enforcing Article 4 since 2 August 2026.
The AI Act sets no fine bracket of its own for Article 4. Penalties are laid down by each Member State and must be proportionate. The Commission is clear about when it gets serious, though: when there is an incident that comes down to missing training and guidance. An employee who pastes customer data into a personal account because nobody told them not to is exactly that case.
What do SMEs need to do now?
No corporate programme, no new hire. The Commission requires neither an AI officer nor a governance board. For a company of ten to fifty people, five steps are enough:
- Find out which AI is in use. Which tools, who uses them, for what. If you do not know, start with the article on shadow AI in the workplace.
- Tell roles apart. The assistant drafting emails needs something different from accounts reviewing invoices with AI, or management deciding which tools to buy.
- Train what matters day to day. How to get useful results. Which data may go into which tool. That AI makes mistakes and important statements get checked. Which tools are approved.
- Document it. Who learned what and when, and which rules apply. The Commission says a certificate is not needed, an internal record is enough.
- Keep it current. New people, new tools, new features: training is not a one-off.
A note on step 3: AI literacy and data protection go together. People who know what the GDPR requires when using AI make fewer mistakes. The article Is ChatGPT GDPR-compliant for businesses? works well as material for that part of the training.
What belongs in the documentation?
A spreadsheet is enough. What matters is that someone keeps it up to date and that it is on the table within ten minutes if anyone asks. For each measure, record:
- date, length and format (workshop, online course, briefing by a team lead)
- who took part, with their role in the company
- what was covered, in a few keywords
- which AI tools were approved at the time
- which internal rule applies, with the date of the current version
- when the next refresher is due
Add each person's attendance record where there is one. The Commission asks for no more than that, and it should not be less.
What does training look like that actually sticks?
Most training does not fail on content. It fails on distance from the work. A talk about neural networks does not change how someone writes a proposal at nine tomorrow morning.
What works is practising on the team's real tasks. The proposal, the client email, the contract summary. With those examples, everyone learns how to ask, where the line on data is, and how to spot a made-up answer. At the end there is a short rule that everyone knows.
The Verselo workshop is built that way. Two to three hours, up to 15 people, on your own tasks: good prompting, safe handling of company data, checking results. Everyone gets an attendance record for your documentation. If you use Verselo, we then set up the prompts and assistants from the workshop in your workspace.
The workshop helps you meet the Article 4 duty. There is no guarantee, because the law does not offer one: whether your measures are adequate overall depends on which AI you use and for what.
Frequently asked questions
Does Article 4 of the AI Act apply to small companies?
Yes. Article 4 has no size threshold. It applies to any company that uses an AI system in the course of its professional activity, including an eight-person firm whose office uses ChatGPT for proposals. Only purely personal use is excluded. What changes with size is which measures are reasonable: a small firm does not need a corporate programme.
Do we need an AI literacy certificate?
No. The European Commission says in its questions and answers on Article 4 that no certificate is needed. An internal record of the training and guidance you provided is enough. In practice: who attended, when, what was covered, and which rules apply in your company.
What happens if we do nothing?
Since 2 August 2026, national market surveillance authorities can supervise and enforce Article 4. The AI Act sets no fine bracket of its own for this article; penalties are set by the Member States and must be proportionate. The Commission notes that sanctions become more likely where an incident can be traced to a lack of training.
Does the Verselo workshop fulfil Article 4?
The Verselo workshop helps you meet the duty, without a guarantee. In two to three hours, a team of up to 15 people learns to prompt well, to handle company data safely and to check results. Everyone gets an attendance record for your documentation. Whether your measures are sufficient overall depends on how you use AI.