Is AI literacy mandatory?
Yes. Article 4 of the EU AI Act requires organisations that provide or use AI systems to take measures for the AI literacy of their people. That duty has applied since 2 February 2025 and remains in place after the July 2026 amendment.
AI literacy means your people know enough about AI to use it responsibly: what a tool can do, where it goes wrong and which data should never go into it. If you use ChatGPT, Claude, Copilot or an AI feature in your CRM, the law calls you a deployer and your business falls under Article 4. The European Commission itself gives the example of a company whose employees use ChatGPT to write advertising copy or translate texts. According to the Commission, those employees also need to know the specific risks, such as hallucinations: invented answers that sound convincing.
Research by ABN AMRO and MWM2 among 777 Dutch organisations (June 2026) found that 78 percent of SMEs use AI. Only 9 percent have a formal policy for external AI tools.
This article covers Article 4 only. The full overview of the law, with all application dates and fines, is in the EU AI Act explained. This is general information as of November 2026. Run your own situation past a lawyer.
What changed in Article 4 after the Omnibus?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and rewrote Article 4. The duty remains. The requirement of a "sufficient level" of AI literacy is gone.
| Element | Old text (2024) | New text (since July 2026) |
|---|---|---|
| Core duty | Providers and deployers "shall take measures to ensure, to their best extent, a sufficient level of AI literacy" | Providers and deployers "take measures to support the development of AI literacy" |
| Level | A sufficient level, without further definition | No fixed level, and you do not have to guarantee a level for each individual |
| Role of the EU and Member States | Not in Article 4 | The Commission and Member States support businesses, including with practical examples (paragraph 2) |
| AI Board | Not in Article 4 | Adopts recommendations, based on European competence frameworks (paragraph 3) |
| Who it applies to | Providers and deployers | Unchanged |
Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 and the European Commission's AI Literacy Q&A. The new text is shown in the Commission's wording.
In practice the question shifts. Under the old text it was about an outcome: is everyone literate enough? Under the new text it is about your effort: which measures have you taken, and do they fit the tools and risks in your business?
If you start using high-risk AI from Annex III, for example in recruitment and selection, an extra duty applies from 2 December 2027. The people who carry out human oversight of such a system must be competent and trained for it. The Commission stresses that this duty remains in place after the Omnibus.
Do you need an AI literacy certificate?
No. The Commission states in its Q&A: "There is no need for a certificate." According to the Commission, organisations can keep an internal record of trainings and other guiding initiatives.
A certificate can serve as evidence in that internal record. It shows that someone completed a test or training on a given date. What it does not show: whether your measures fit the tools your team uses. You record that in the documentation below.
What should an SME document?
Record which AI you use, who needs to know what and which measures you have taken per role. The Commission names four minimum steps: ensure a general understanding of AI in your organisation, determine your role (provider or deployer), assess the risks of your AI systems and build your actions on that, tailored to your people's knowledge and the context in which you use AI.
For a small business that comes down to five documents. A spreadsheet will do.
1. An AI overview: who uses which tools? For each tool, note what it is used for, by whom, which data goes into it and whether customers deal with the output. Include AI features inside existing software too, such as your accounting package, email client or CRM.
2. Measures per role. Not everyone needs to know the same things. An example:
| Role | AI use | What they need to know | Suitable measure |
|---|---|---|---|
| Marketing | Creating copy and images | Hallucinations, copyright, when you must disclose AI content (Article 50) | Training plus house rules for publishing |
| Customer service | Drafting replies, AI agent on the website | Transparency duty, checks before sending, no customer data in loose tools | Work instruction and a fixed review moment |
| HR | Summarising CVs | Recruitment is a high-risk area (Annex III), bias in outputs, GDPR | In-depth training and a check with a lawyer |
| Management | Tool choice and policy | Roles and risk levels in the AI Act, who is responsible for what | Training on policy and risk classification |
3. A training register. For each person, note the date, topic, format (training, test, work instruction), who delivered it and, where relevant, the result or certificate. The Commission warns that simply asking staff to read the instructions for use is often ineffective.
4. Working agreements. Record what may and may not go into AI tools, such as customer data and confidential documents. With that policy in place you already belong to the 9 percent from the research above. What the GDPR asks of you here is covered in using AI in your business in line with the GDPR.
5. A fixed review moment. Review with every new tool and at least once a year. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) advises a strategic approach to AI literacy, for example with a multi-year action plan.
Who supervises Article 4 in the Netherlands?
According to the Commission, national market surveillance authorities supervise Article 4 from 2 August 2026. The Netherlands had not yet formally designated that authority in November 2026 (as of November 2026).
The Dutch government put the draft AI Act Implementation Act out for consultation from 20 April to 1 June 2026. According to the digital affairs planning letter, it plans to submit the bill to the House of Representatives in the second quarter of 2027. In the proposal, existing regulators supervise within their own domain, with the AP and the Dutch Authority for Digital Infrastructure (RDI) in a coordinating role.
The AP already acts as the coordinating supervisor for AI and algorithms. It published the guides Getting started with AI literacy (30 January 2025, in Dutch) and Building further on AI literacy, with examples and tips for organisations.
What this means for you: the duty already applies, even though no one in the Netherlands can yet impose an AI Act fine for it. According to the Commission, sanctions will have to be proportionate, taking into account the gravity of the infringement and whether it was intentional or negligent. What you record now, you will not have to reconstruct later.
How do you start on Article 4 this week?
1. Measure where your team stands. Have everyone who works with AI take the free AI literacy test: 55 questions, with a certificate for a score of 70 percent or higher. Add the results to your training register. 2. Build your AI overview. Go through which tools and AI features are in use with your team. 3. Choose a measure per role. Use the table above as a starting point. 4. Schedule the review.
If the baseline shows that someone lacks specific knowledge, you can address that in a 1-on-1 AI training built around that person's own tools and tasks.
Frequently asked questions
Is AI literacy mandatory for small businesses? Yes. Article 4 of the AI Act has applied since 2 February 2025 to every organisation that provides AI systems or uses them professionally, even if that is only ChatGPT or Claude. After the July 2026 Omnibus, the law asks for measures that support AI literacy, without a fixed level.
Do I need an AI literacy certificate? No. The European Commission states that no certificate is needed. You can keep an internal record of trainings and other measures. In that record, a certificate can serve as evidence that someone completed a test or training.
What is the difference between the old and new text of Article 4? The old text required measures to ensure, to the best extent, a sufficient level of AI literacy. Since Regulation (EU) 2026/1744, in force on 27 July 2026, Article 4 requires measures that support the development of AI literacy, without a fixed level per person.
What should I document for Article 4? Record which AI tools you use and who uses them, what each role needs to know, which trainings and work instructions you have provided, which working agreements apply and when you will review this. A spreadsheet will do.
Who checks AI literacy in the Netherlands? In November 2026 no authority had yet been formally designated in the Netherlands for the AI Act. The government plans to submit the AI Act Implementation Act in the second quarter of 2027. In that proposal the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure coordinate supervision.
Getting started yourself?
Start with the free AI literacy test as a baseline for yourself or your team. If you then want to build targeted skills with your own tools, you work with Tarik Eraslan in a 3-hour 1-on-1 AI training, on location in Amsterdam-Zuid or online via Microsoft Teams. Gevorderd (Advanced) costs €449 and Specialist €579 excl. VAT.
