If your employees use ChatGPT, Copilot, or any other AI tool without formal training — your company has been in violation since February 2025.
This isn't a recommendation or a guideline. Article 4 of the EU AI Act mandates that every organization using or developing AI systems must ensure a sufficient level of AI literacy among its employees. The obligation entered into force on February 2, 2025 — over a year ago — and most companies still don't have even a basic program in place.
What Does Article 4 Say?
Article 4 of the EU AI Act (Regulation 2024/1689) states:
"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf."
Key phrases:
- "Providers and deployers" — applies to EVERYONE using AI, not just those who develop it
- "To their best extent" — proportional to company size and risk level, but doesn't mean "if you feel like it"
- "Sufficient level" — the regulator expects measurable, documented outcomes
- "Staff and other persons" — includes freelancers, consultants, and outsourced teams
Omnibus VII (March 2026) did not change this deadline. While high-risk system deadlines were pushed to December 2027, the AI literacy obligation has remained active since February 2025.
What "AI Literacy" Actually Means
Most companies think AI literacy means "our people know how to use ChatGPT." That's the wrong interpretation.
Under the EU AI Act, AI literacy includes understanding:
- Capabilities and limitations of the AI systems you use
- Risks — from hallucinations and inaccurate outputs to bias and discrimination
- Ethical considerations — data privacy, transparency toward users, fairness
- Regulatory context — what obligations your company has under the EU AI Act
- Proper usage — when to use AI, when not to, and how to verify AI outputs
In other words: an employee using AI to draft emails must understand why they shouldn't uncritically send AI-generated content, what can happen if the AI "hallucinates" incorrect data, and what the company's transparency obligations are.
5 Questions for Self-Assessment
Answer these 5 questions honestly to evaluate where you stand:
1. Do you have a formal AI literacy program?
| Your Status | Score |
|---|---|
| Yes, with regular updates | ✅ Full marks |
| We have something, but informal | ⚠️ Partial |
| No, employees figure it out themselves | ❌ 0 points |
2. How many employees use AI tools?
This question isn't scored — but it gives you context. If 80% of your company uses AI and 5% have been trained, you have a serious gap.
3. What percentage of employees have completed AI training?
| Percentage | Rating |
|---|---|
| > 75% | ✅ Good coverage |
| 25-75% | ⚠️ Significant gap |
| < 25% | ❌ Critically low |
4. Who is responsible for AI literacy in your company?
| Responsible Person | Rating |
|---|---|
| Designated person/team with a clear mandate | ✅ |
| IT/HR handles it "on the side" | ⚠️ |
| Nobody formally | ❌ |
5. Do you document AI literacy activities?
| Documentation | Rating |
|---|---|
| Yes, with records of who completed what | ✅ |
| We have some records | ⚠️ |
| No | ❌ |
If you have 3 or more ❌ answers — your company is not compliant with Article 4. And hasn't been since February 2025.
👉 Take the free AI Literacy Check for a detailed assessment with a score and recommendations.
How to Build an AI Literacy Program in 5 Steps
Step 1: Map AI tools across your organization
Before you educate people, you need to know WHAT they're using. Create an inventory of all AI systems — from ChatGPT and Copilot to AI features embedded in your CRM, HR system, or marketing tools.
Step 2: Assess risk per tool
Each AI tool carries different risk. ChatGPT for brainstorming is low-risk. An AI tool for screening job applicant CVs is high-risk (Annex III, category 4). The level of training must match the level of risk.
Step 3: Define role-based programs
Not everyone needs the same knowledge. We recommend three tiers:
| Tier | Who | Content |
|---|---|---|
| Basic | All employees using AI | Capabilities, limitations, risks, proper usage |
| Advanced | Teams integrating AI into processes | Bias, output evaluation, regulatory obligations |
| Specialized | AI developers, data scientists, compliance | Technical documentation, risk assessment, monitoring |
Step 4: Deliver and document
Conduct the training and — crucially — document who completed which program, when, and with what results. This documentation is your proof of compliance if an inspection occurs.
Step 5: Plan regular updates
AI evolves fast. A program from 6 months ago is already outdated. Plan quarterly updates — especially when introducing new AI tools or when the regulatory framework changes (as it just did with Omnibus VII).
Penalties: How Much Can Non-Compliance Cost You?
Article 99(4) of the EU AI Act prescribes penalties for violating Article 4:
- Up to €15 million or
- 3% of total global annual turnover (whichever is higher)
- For SMEs: the lower of the two amounts
For comparison: penalties for prohibited practices (Article 5) go up to €35M / 7%.
According to a report on r/FuturePrep, only 8 of 27 EU Member States have operational contact points for AI Act enforcement. This doesn't mean you can ignore the obligations — it means you have a narrow window to get compliant before the enforcement apparatus is fully operational.
As SecurePrivacy noted: "The fact that enforcement mechanisms are still being established does not exempt organizations from compliance — it merely means that early adopters of compliance frameworks will have a competitive advantage."
What's Next?
AI literacy isn't a project you complete once and forget. It's an ongoing process that requires ownership, budget, and regular updates. The good news: you don't have to start from scratch.
- Take the free AI Literacy Check — assess your readiness in 2 minutes
- Register on ComplianceForge — our compliance wizard generates a personalized AI Literacy Program (DOC-07) based on your specific AI tools and company size
- Read Article 4 in our Knowledge Base for the full legal text with explanations
The deadline passed over a year ago. Every day without a program is a day in violation.
This article is part of our EU AI Act compliance series. Also read: What Is the EU AI Act and Why Should You Care? and What Changed After Omnibus VII.