What is AI literacy? AI literacy is the set of skills, knowledge and understanding a person needs to use AI systems in an informed way and to assess their opportunities and risks. The EU AI Act sets out this definition in Article 3(56) of Regulation (EU) 2024/1689 and, in Article 4, attaches an obligation to it for every organisation that uses or provides AI.
That obligation has applied since 2 February 2025. The penalty provisions of Article 99 have applied since 2 August 2025, but the Dutch implementing act that sets up supervision is not yet in force. The text of Article 4 was rewritten by the Digital Omnibus on 27 July 2026, shifting the emphasis from ensuring a level among employees to taking measures that support AI literacy.
AI literacy differs from digital skills. Digital skills are about operating software; AI literacy also requires insight into why an AI system arrives at a particular result and how reliable that result is.
In practice you see it in every employee who works with an AI tool: the marketer who has AI write a text and checks the sources personally, the manager who assesses an AI recommendation before adopting it. In healthcare, handling client data adds a further layer.
What does AI literacy mean under the EU AI Act?
Under the EU AI Act, AI literacy means the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems. The definition in Article 3(56) also explicitly mentions awareness of the opportunities and risks of AI and the possible harm it can cause. So it is about technical knowledge, but just as much about the social, ethical and practical side of using AI.
The law does not attach a fixed level of knowledge to that definition. What is sufficient depends on the technical knowledge, experience, education and context of the employee concerned, and on the risk of the system they work with.
What is the difference between AI literacy and digital skills?
The difference between AI literacy and digital skills lies in the understanding beneath the surface. Someone who works in Excel or a CRM every day is digitally skilled, without being able to judge why a language model gives a particular answer.
An AI-literate employee asks what data a result is based on and in which situations that result is wrong. Asking that question requires knowledge of how a model recognises patterns and of the cases in which that pattern recognition misleads, something that being handy with software does not cover.
Why AI literacy delivers more than a compliance tick box
AI literacy delivers more than a compliance tick box, because employees without that understanding cannot assess a result for reliability and bias. Anyone who adopts AI output without verifying it takes a risk they do not recognise as a risk.
Teams that take building their skills seriously adopt new tools faster and make fewer mistakes in the process. They know which questions to ask a supplier and which risk category a system falls into. It also reduces resistance on the shop floor, because uncertainty about what AI can and cannot do is a common reason for leaving tools unused. That is exactly where shadow AI otherwise appears, with employees choosing their own route outside the policy. AI training for teams with a certificate per employee also makes that development demonstrable.
Is AI literacy mandatory?
Yes, AI literacy is mandatory for every organisation that develops or professionally uses AI systems, under Article 4 of the AI Act. The obligation has applied since 2 February 2025 and makes no distinction by company size, so a sole trader who only uses ChatGPT or Microsoft Copilot falls under it just as much as a multinational.
The obligation rests with the organisation, not with the individual employee. An employer who arranges nothing cannot hide behind employees who have read up on the subject themselves.
What exactly does Article 4 require of an organisation?
Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and of other persons using AI systems on their behalf. Examples are contractors, service providers and clients who work with an AI system on your instructions.
The law does not prescribe a mandatory course, a fixed number of hours or a specific certificate. How you meet it is deliberately left open, as long as you can show that the measures you chose fit the employee’s role and the risk of the system. A course is therefore a means, not a requirement. LearnLLM’s online AI Literacy Course lays the foundation for each employee, with practical assignments on their own work and a certificate of completion. If you first want a short foundation for everyone, there is also AI Literacy Essentials, a two-hour basic course.
What did the Digital Omnibus change in Article 4?
The Digital Omnibus rewrote Article 4, a change that most sources on this subject have not yet taken on board. Regulation (EU) 2026/1744 was published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026.
Where the old text spoke of measures to ensure a sufficient level of AI literacy among staff, the new text speaks of measures that support the development of AI literacy. The regulation explicitly adds that the obligation does not mean a particular level has to be ensured for individual persons.
In practice, this shifts what you are judged on: not whether every employee demonstrably reaches a certain level, but which measures you have taken and why they fit your use of AI. The obligation itself has not been abolished and the date of 2 February 2025 is unchanged. What the Omnibus did postpone were the heavy obligations for high-risk systems, which now apply from 2 December 2027 and 2 August 2028.
Who does the AI literacy obligation apply to?
The AI literacy obligation applies to every provider and deployer of AI systems, which in practice means almost every organisation that uses AI. A provider develops a system or places it on the market; a deployer uses a system under its own authority.
The scope goes beyond your own payroll and extends to everyone who works with AI on behalf of the organisation. Organisations outside the EU are also covered as soon as their system or its output is used in the Union.
Does the obligation also apply to a freelancer or small firm?
Yes, the obligation also applies to a freelancer or a small firm, because Article 4 makes no distinction by company size. How you meet it may be proportionate, though: one person who knows which AI tools they use and which risks come with them has already covered a large part of the requirement.
Does the obligation apply if you only use ChatGPT or Copilot?
The obligation also applies if an organisation only uses off-the-shelf tools such as ChatGPT or Microsoft Copilot. Article 4 is aimed at whoever deploys an AI system, not at whoever builds it, and that makes almost every office-based organisation a deployer. The fact that you did not develop the AI yourself does not change that.
What level of AI literacy does your team need?
The level of AI literacy your team needs depends on each employee’s role and the risk profile of the application, not on a fixed number of hours. A compliance officer assessing a high-risk credit scoring model needs a different level of knowledge from an employee operating an AI scheduling tool.
What level a role requires
The level a role requires comes down to an employee knowing what an AI system does in their job, where the limits of its reliability lie and when they must not use a result without checking it. The law asks no more than that, and less than that is hard to defend.
Since Article 4 was rewritten, that level no longer has to be guaranteed per employee, but it remains the yardstick for designing your measures. An organisation that can show it has thought about the required level per role is in a stronger position than one that gave everyone the same general training.
What knowledge each job group needs
The knowledge each job group needs varies widely. Directors and management weigh risks and arrange governance and budget. HR and recruitment recognise bias in AI-supported recruitment and selection. IT staff understand how a system works technically and how its risks are managed. Customer-facing employees recognise when a result is unreliable and know what is and is not allowed with AI-generated answers.
What does enforcement from 2 August 2026 mean?
Under the European timeline, enforcement of Article 4 lies with national supervisory authorities from 2 August 2026, but in the Netherlands the implementing act that designates them is not yet in force. The obligation itself has applied since 2 February 2025, so an organisation that waits for supervision is already non-compliant.
An inspection rarely focuses on a one-off starting point and almost always on ongoing practice. Which AI systems does the organisation use, who works with them, what level of knowledge goes with that and is it recorded anywhere? The same burden of proof returns in the other parts of AI Act compliance for businesses, such as risk classification and transparency.
What fines apply for failing to comply with Article 4?
There is no separate fine category for failing to comply with Article 4, because the article is not mentioned separately in the penalty provisions of Article 99. Article 99(4) lists exhaustively which obligations fall under the maximum of 15 million euros or 3 percent of worldwide annual turnover, and Article 4 is not among them. For Article 4, only Article 99(1) applies, under which member states set the penalties themselves; the Dutch implementing act for this is not in force as of 5 November 2026.
The SME rule in Article 99(6), under which the lower of two amounts applies, concerns the maximums in paragraphs 3 to 5 and therefore plays no role for Article 4. More important than the amount is the moment the question arises. In a complaint, a data breach or a liability case, the absence of recorded measures is direct evidence against you.
Who supervises Article 4 in the Netherlands?
In the Netherlands, supervision of the AI Act, including Article 4, has not yet been fixed in law, because the Dutch AI Act Implementation Act (Uitvoeringswet AI-verordening) is not yet in force. The Dutch government’s proposal of April 2026 has existing supervisors oversee their own domains, proposes the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) as the supervisor where there is no clear one, and gives the AP and the Dutch Authority for Digital Infrastructure (RDI) a coordinating role.
How do you demonstrate AI literacy?
You demonstrate AI literacy with an overview of the AI systems you use, who works with them, which measures have been taken and the level of knowledge needed per role. A certificate for one employee proves participation, not an organisation-wide approach.
Where do you start if you want to improve your team’s AI literacy?
You start with an inventory of current AI use and the level of knowledge per role, before you settle on a training plan. Also map which systems are already running, including the AI features that sit unnoticed in existing software such as Teams, Outlook or a CRM.
Then decide for each role which level is needed and choose a format that fits. After that, record who has completed what, because without that record you cannot show during an inspection that you took the obligation seriously.
Which documents make up your file?
Your file consists of four documents that complement each other. A dated internal AI policy with the permitted tools, the input rules and the checkpoints. An overview per employee of training completed, with study load. A description of where in the work process a second person reviews the work. And a before-and-after measurement of the level of knowledge, because proof of participation shows no learning gain.
Proof of participation alone shows no learning gain.
What AI literacy means in each sector
What AI literacy means in each sector varies with the professional rules and liability that already apply there. The legal basis is the same everywhere; how you meet it is not.
Notary’s office
For a notary’s office, AI literacy means that employees understand which uses of AI touch on the rules for notaries (in the Netherlands, the Notaries Act, Wet op het notarisambt) and on deed practice. The core is knowing when a result needs an extra check before it influences the content of a deed.
Accountancy firm
An accountancy firm needs employees who assess AI-supported analyses within the frameworks of the Dutch professional bodies NBA and NVKM. In AI for accountants, questions about audit and liability become more pressing the deeper AI goes into the audit process.
Marketing agency
At a marketing agency, AI literacy is mainly about checking AI-generated content and analyses for factual accuracy and copyright risks before they go to a client. AI for marketing has its own trap here, because checking tends to slip just as the volume rises.
Independent professional
An independent professional falls under the same obligation, although meeting it may be proportionate. One person who knows which tools they use, which data must not go into them and where the output becomes unreliable has covered most of Article 4.
If you want to learn how to record this step by step, you will find the AI policy and the checkpoints in LearnLLM’s e-learning on this subject.
Frequently asked questions about AI literacy
On its website, the European Commission gives practical guidance on AI literacy that goes beyond the legal text.
Is it enough to follow the instructions for use of an AI system?
Following only the instructions for use of an AI system is usually not enough for AI literacy. In its questions and answers on AI literacy, the European Commission writes that relying only on the instructions for use, or having employees read them, may be ineffective in many cases. The firmer statement that the instructions are not sufficient and further measures are needed concerns deployers of high-risk AI systems. According to the Commission, employees who work with a system where a human checks the result need skills aimed at that specific system.
Where can you find examples of AI literacy measures?
You can find examples of AI literacy measures in the European Commission’s living repository, a collection of initiatives from organisations putting AI literacy into practice. The Commission warns that adopting such an example does not automatically mean you comply with Article 4. So use the examples as inspiration and adapt them to the roles and systems in your own organisation.
