AI training for staff - what Article 4 of the AI Act says

In recent months I have been hearing two extreme versions. The first: “since 2025 every employee needs an AI certificate, otherwise there are fines”. The second: “it is a dead letter, you can forget about it”. Neither is true. Below I set out what the rule says, what changed in July 2026 and what it means for a company that simply uses AI tools in its daily work.

A caveat first: I am not a lawyer and this article is not legal advice. I describe facts from the sources listed at the end, as they stand on the date of publication. If your company builds AI systems or uses them in high-risk areas, consult a lawyer about your situation.

Who Article 4 applies to

The AI Act, Regulation (EU) 2024/1689, distinguishes among others between providers, who build AI systems, and deployers - anyone who uses an AI system in the course of professional activity.

A company where a salesperson summarises calls in ChatGPT and the accountant uses an assistant in a spreadsheet is a deployer. Article 4 covers both kinds of organisation and applies to staff and to other people who operate AI systems on the company’s behalf - for example contractors.

The obligation has applied since 2 February 2025.

What changed in July 2026

In the original wording, providers and deployers had to take measures to ensure, “to their best extent”, a sufficient level of AI literacy of their staff.

The amending regulation known as the Digital Omnibus on AI - Regulation (EU) 2026/1744, published in the Official Journal of the EU on 24 July 2026 - rewrote the rule:

companies have to take measures to support the development of AI literacy of their staff, taking into account their knowledge, experience, education and the context in which they use AI,
the rule states explicitly that it does not require guaranteeing any specific level of AI literacy of any individual,
the European Commission and the Member States are to support companies in these efforts, with particular attention to small and medium-sized enterprises.

In practice the obligation has not disappeared. Its nature has changed: from an obligation of result to an obligation of means.

What the rule does not require

A certificate. In its questions and answers on AI literacy, the European Commission says plainly that no certificate is needed and that a company can keep an internal record of trainings and other initiatives.
One specific training. There is no mandatory format or curriculum. The measures should fit how the company uses AI and who uses it.
An exam for every employee. Since the 2026 change, the rule does not require guaranteeing the level of knowledge of any particular person.

A separate matter: if a company uses high-risk AI systems - for example to assess candidates in recruitment - further obligations apply, including preparing the people who oversee such a system. That is a topic for a conversation with a lawyer, not for this article.

Who supervises this in Poland

Application of the AI Act is supervised by national authorities. In Poland, the Act on Artificial Intelligence Systems, signed by the President in July 2026, establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) for this purpose. According to the Ministry of Digital Affairs, the Commission is due to start operating in autumn 2026.

As for sanctions, the European Commission stresses that they must be proportionate to the specific situation and take into account, among other things, the gravity of the infringement and whether it was intentional.

What a company can sensibly do

An obligation of means is a reason to be able to show what the company has done. In proportion to its size, without building procedures for their own sake:

List where the team uses AI. Which tools, who and for what. Without that list you do not know what to teach.
Match the measures to roles. A salesperson pasting call notes needs something different from a person preparing contracts.
Agree rules for checking answers and for what goes into the tool. This is the most practical part of AI literacy. I describe a simple approach in the article on checking AI answers.
Record what you have done. Date, topic, who took part, what materials stayed in the company. An internal note is enough.
Come back to it when the tools change. Instructions from a year ago do not cover tools the company did not have then.

AI literacy is not just a legal rule

Even if Article 4 did not exist, a team that does not know when AI answers cannot be trusted and what must not be pasted into a tool is a risk to the company - to client data and to the quality of what reaches clients.

That is why in team training I do not start from regulations but from the tasks participants do every day. The role-based instructions and the record of the workshop stay in the company - and can also become part of the record of measures that Article 4 refers to.

Sources

Legal status as of 13 September 2026.

AI training for staff: what Article 4 of the AI Act actually requires