What the model cannot know
Knowledge cutoffs, no access to internal systems, and the fact that a confident answer is not a checked answer.
Read the guide →In force since February 2025
The AI literacy requirement
This is the obligation most organisations are quietly failing without knowing it, and also the easiest one to satisfy.
This is information, not legal advice. Every rule below is cited to its source and reflects the position on 25 August 2026. This area is moving quickly, and a decision that matters for your organisation should be checked by someone with legal responsibility for it.
What it says now
Article 4 originally required organisations to ensure a sufficient level of AI literacy among staff and others using AI on their behalf. The wording changed on 27 July 2026. The duty is now to take measures to support the development of AI literacy, and the text states explicitly that nobody has to guarantee any particular level of ability in any individual.
That difference is real. This is an obligation of effort. You have to do something sensible and be able to show that you did. You do not have to prove that every employee reached a measured standard.
No certification is required. There is no mandated curriculum, no approved provider and no exam. Measures should be proportionate to the role, the person's technical background, and how much is riding on the particular use.
Who it covers
The duty covers staff, and in addition other people operating AI on the organisation's behalf, which can reach contractors and service providers. The breadth here rests on Commission guidance as reported by several legal practices rather than on text we verified directly, so confirm it against the primary source if it becomes decisive for you.
Practical
A programme that actually satisfies the duty
This is not an official template. It is a reasonable reading of an effort-based obligation, arranged so it is easy to evidence.
Map who uses what
Write down which AI tools are actually in use, in which roles, for which tasks. Shadow use through personal accounts belongs on the list too.
Train for the role
The marketing team needs something different from the engineers. A short internal session on what the tool is good at, how it fails, and what must never be pasted in covers most of the risk.
Write one page people will read
What is allowed, what must never go in, who to ask, and how published content gets marked.
Record that it happened
Date, participants, topics. Documentation is not itself required here, but it is the simplest way to show the duty was taken seriously.
Revisit when something changes
A new tool, a new model generation or a new use case are the natural triggers. Once a year is a reasonable baseline.
What the training should cover
The regulation says nothing about curriculum. Based on what actually goes wrong in practice, these topics return the most value.
What never gets pasted in
Personal data, passwords, keys, trade secrets and client material in tools with no agreement behind them.
Read the guide →How answers get checked
Source requirements, separating findings from inference, and a routine simple enough to actually run.
Read the guide →When content must be marked
Chatbots, images and published text. The duties start applying on 2 August 2026.
Read the guide →Untrusted content and agents
Why a web page or an email can hijack an AI tool that has been given access to something.
Read the guide →What is outright banned
Emotion inference on staff and students is prohibited, however well the tool appears to work.
Read the guide →Sources
- AI Act Service Desk, Article 4 — the Commission's reference, showing the original wording
- Regulation (EU) 2026/1744 — the amendment to Article 4, in force 27 July 2026
- European Commission: the AI omnibus enters into force — the Commission's summary