What the EU AI Act's AI literacy rule asks of your team

Buried in the EU AI Act is a requirement that quietly applies to far more companies than the headline high-risk rules: Article 4, the AI-literacy obligation. Since 2 February 2025, it has required providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff and the others who operate or use AI on their behalf, taking into account those people's knowledge, the context, and who the AI is used on. In plain terms, if your people use AI at work, the EU AI Act expects you to make sure they understand enough to use it sensibly and spot its risks. This isn't the heavy high-risk regime with conformity assessments; it's a baseline duty that lands on ordinary companies using ordinary AI tools, and a lot of firms don't realize it's already in force.

It's worth separating the literacy duty from the rest of the Act, because people conflate them and either panic or tune out. Most companies owe the literacy obligation now, but not the full high-risk stack.

Two points catch companies off guard. First, the obligation falls on both providers, who build and place AI systems on the market, and deployers, who use them under their own authority, and it's non-delegable: a vendor's training doesn't discharge your duty, and yours doesn't discharge theirs. It also covers not just employees but contractors and others using AI on your behalf. Second, the EU AI Act reaches beyond the EU. It applies where an AI system is used in the Union or its use affects people located there, so a US or other non-EU company with EU staff or EU users can be squarely in scope. If you assumed this was a European problem for European companies, that assumption is the risk. The practical question isn't whether the rule could apply to you; it's whether your people are literate enough that you could show you took it seriously.

The Act doesn't prescribe a curriculum or a certificate, and that flexibility is widely misread as permission to do the minimum. It isn't. The European Commission's own guidance is that there's no one-size-fits-all, that literacy should be proportionate to people's roles and how they use AI, and, pointedly, that distributing a user manual is not sufficient. The expectation is real understanding tied to actual use: enough to deploy AI in an informed way and to be aware of its risks and harms. Regulators also expect you to keep a record of what training you ran, for whom, and when, for as long as the systems are in use. So the bar isn't a slide deck filed away; it's capability you can evidence, refreshed as the tools change. That is the same thing good AI literacy training produces anyway, which is the point we'll get to.

A few facts to get right, because they're widely garbled. The literacy obligation has applied since February 2025, but the enforcement machinery, national authorities with formal supervisory and penalty powers, attaches on 2 August 2026, so there is a real window where the duty is in force but not yet actively enforced. Penalties for the literacy obligation specifically are left to each member state and will vary by country; the eye-watering figures you may have seen, up to tens of millions of euros or a percentage of global turnover, are the Act's ceilings for prohibited practices and other breaches, not a literacy-specific fine, so don't quote them as if Article 4 carries a €35 million penalty. There's also a live amendment package, sometimes called the Digital Omnibus, that reached provisional political agreement in 2026 and would soften the literacy wording and defer some high-risk deadlines, but it is not yet formally adopted, so treat it as a development to watch, not settled law. Even under the softened text, the duty to build AI literacy persists.

Here's the tempting counterargument: the rule is soft, the format isn't mandated, enforcement is uneven, and the wording may even be relaxed, so why not satisfy it with a cheap, documented e-learning module and move on? Because that path satisfies neither the law's intent nor your actual need. The lawyers' near-unanimous read is that a one-off course filed away doesn't meet a duty that scales with how much your people actually use AI, and the only world where the bare minimum is genuinely enough is one where your team's AI use is trivial. It isn't: surveys consistently show most knowledge workers already use AI, while almost none of their organizations have reached real maturity with it. You carry the literacy risk whether or not a regulator ever knocks, in the form of bad outputs, leaked data, and decisions made by people who don't understand the tool. Real training, scaled to each role and tied to the work, closes the compliance gap and the capability gap in one move, which is why compliance and capability are the same investment, not competing ones. Make it part of how you run AI for teams, not a separate legal errand.