Do you use ChatGPT, Copilot or an AI assistant in recruitment? Then the AI literacy requirement in the AI Act applies to you, and it applies today. Article 4 is one of the few provisions that reaches ordinary companies without them building or selling AI. The short version of what it asks: you have to actively support the people using AI in your company in understanding what the tools do, where they fall down, and when a human has to look.
The requirement was not tightened this summer, it was loosened. On 27 July 2026 the so-called omnibus amendment came into force and rewrote Article 4. Many Swedish advisers are still describing the old wording. Here is what it says now, what changed again on 2 August, and what a company of ten or a hundred people should reasonably do.
What Article 4 requires
The AI Act is risk-based. The heavy requirements land on high-risk systems and on those who develop AI. Article 4 is different: it applies to anyone providing or using AI systems in their operations, whatever the risk class.
The requirement is aimed at people rather than at the technology. It covers your employees, and also consultants and others handling the systems on your behalf. Its content comes down to three things:
- Understanding what the tool does. What the system is built for, what it is not built for, and how reliable its answers are.
- Awareness of the risks in your particular use. An assistant suggesting marketing copy carries different risks from one ranking job applications.
- Fit to the person. A developer and a salesperson do not need the same thing. The requirement is proportionate.
Note what is not required: no certification, no particular training provider, no minimum number of hours. The Commission has been clear that the format is open.
What changed on 27 July 2026
Omnibus Regulation (EU) 2026/1744 gave Article 4 new wording. The difference matters legally.
Before: providers and deployers had to ensure a sufficient level of AI literacy among their staff. That was an obligation of result, a requirement that a given level was actually reached.
After: providers and deployers shall take measures to support the development of AI literacy. The legislator writes explicitly that the provision does not require anyone to guarantee a particular level of competence in an individual. It is an obligation of effort.
What that means in practice: the assessment is made against what you have done, not against what each employee can answer in a test. The duty remains all the same. Doing nothing is still a failure, and an effort nobody can evidence afterwards is hard to tell apart from no effort at all.
The Commission and the member states have also been tasked with making this easier specifically for smaller companies. Expect more free guidance.
What applies since 2 August 2026
Article 4 has applied since 2 February 2025, but in practice without supervision. The sanction rules in the regulation have existed since August 2025; what was missing was a working supervisory apparatus. On 2 August 2026 the market surveillance rules started to apply, and only now is there anyone able to check the provision.
Supervision sits with national market surveillance authorities rather than with the EU’s AI Office. In Sweden, IMY was appointed market surveillance authority in June 2026, with the Post and Telecom Authority and the Financial Supervisory Authority holding roles in their own fields. Sanctions are decided nationally and have to be proportionate, taking account of the nature and seriousness of the infringement, and of the company being small.
Our assessment: the chance of a Swedish smaller company being fined for AI literacy alone in the coming year is low. The realistic risk lies elsewhere. The question turns up in supplier questionnaires and tenders long before an authority knocks. The pattern is exactly the one we saw with customers’ security requirements: large customers push requirements down the chain, and whoever cannot answer loses the deal.
Does it apply to you?
Almost certainly yes, if any of the following is true:
- People use generative AI tools at work, free versions included.
- You have AI features built into business systems, support tools or your office suite.
- You use AI in recruitment, credit assessment or pricing.
- You build an AI model into something you sell on.
The first three make you a deployer, which is the usual role for a smaller company. The fourth can make you a provider, with considerably more obligations. If you are unsure which you are, start with our walkthrough of which parts of the AI Act reach your company.
One common misunderstanding is that shadow AI gets you off the hook. “We have not introduced any AI tools” is rarely true in practice. If people paste customer material into a chat tool on their own initiative, that is your use, and the risk exists with nobody steering it.
Building AI literacy in practice
Five steps that fit into a working week spread over a month, and that leave you with something to show.
- Map the use. Which AI tools are used, by whom and for what? Ask plainly, without blame, or you will get the wrong answers. The list doubles as your inventory under the regulation.
- Classify it roughly. Where does AI affect a person (recruitment, credit decisions, assessments) and where is it pure productivity (drafts, summaries, code)? The first category demands more.
- Write a one-page guideline. What may be put into which tools, what always has to be reviewed by a human, who to ask when in doubt. The same logic as the one-page security policy: short and read beats comprehensive and unread.
- Run a short session for everyone, a longer one for those concerned. Forty-five minutes for all staff on what the tools do, where they invent things and what must never be entered. A deeper session for those using AI in decisions that affect people.
- Document that you did it. Date, participants, content, the version of the guideline. That is the whole difference between an effort and an effort you can prove. Put the guideline in the Employee Handbook so it follows every new joiner.
Build it into onboarding and set a reminder to review the guideline twice a year. The tools change faster than your policies.
Three mistakes we see often
Waiting for perfect guidance. Many companies put the work off until the legal position “settles”. It has moved three times in eighteen months and will keep moving. A simple guideline that is updated beats no guideline at all.
Buying an expensive certification. There is a growing supply of AI literacy certificates marketed as a requirement. They are not one. For most smaller companies an internal session plus a documented guideline is fully sufficient and far cheaper.
Confusing the literacy requirement with data protection. AI literacy and the GDPR are two separate tracks that meet in practice. If you feed personal data into an AI tool you also need your record of processing and data processing agreements in order. An AI session does not replace that work.
Common questions
Does every employee have to be trained in AI? No. The requirement is proportionate and aimed at those who use or handle AI systems at work. If only the finance team uses an AI assistant, the whole company does not need the same session. Most companies still benefit from a short briefing for everyone, because AI tools are used more widely than management thinks.
What does breaching Article 4 cost? The article has no fine level of its own attached to it in the regulation. Sanctions are decided nationally and have to be proportionate. The practical cost lies more often in lost business when a customer or a buyer asks and you cannot answer.
Is having an AI policy enough? A policy is half the answer. The requirement is about supporting the development of competence, meaning that people actually know something. A policy nobody has read and nobody has been walked through is weak evidence.
We only use ChatGPT occasionally. Does this apply to us? Yes. The regulation does not distinguish between paid and free use. The scale of your measures can be adapted, though: occasional use of a general tool demands less than AI in recruitment decisions.
Does it apply retroactively to AI we introduced earlier? The requirement covers your current use. Tools you introduced in 2024 are covered today, whenever they were brought in.
What happened to the other AI Act dates? The omnibus amendment pushed several high-risk requirements back, to 2 December 2027 for standalone high-risk systems and 2 August 2028 where AI is a safety component in a product. Parts of the transparency requirements on synthetic content moved to 2 December 2026, and new prohibitions were added. The AI literacy requirement did not move.
Where Polaris comes in
Polaris keeps your guidelines, training sessions and evidence in one place, so that “how do you ensure AI literacy?” in the next supplier questionnaire takes five minutes to answer rather than five days. You also see which areas lack documentation before someone else finds the gap.
Want to know where you stand today? Take our Compliance Health Check: a position per area, no login.
This article is general guidance, not legal advice. The AI Act was last amended in July 2026 and interpretation keeps developing. Where you are unsure about your particular use, take legal advice.
