Skip to content
Menu
EN

Article 4 AI Act: What does AI literacy require of small businesses?

Policy, training and inventoryLast updated 5 min read

Short answer

Article 4 has applied since 2 February 2025 and also covers small businesses that use, for example, ChatGPT, Claude or Copilot at work. You need to take concrete steps so that your staff understand the AI they use – matched to their tasks and the risk. Since the Digital Omnibus of July 2026, you no longer have to ensure a set level for every employee, but the duty to act remains. Write down what you have done; a course certificate is not required.

Who does Article 4 apply to?

Article 4 applies to two kinds of business: those that build AI (providers) and those that use AI at work (deployers). The second group is almost everyone. If your staff use ChatGPT, Claude, Microsoft 365 Copilot or another AI for work tasks, you are covered. There is no exemption for small businesses.

The duty covers not only employees but also others who use AI on your behalf – for example a consultant or a temp agency.

What does AI literacy mean?

The AI Act defines it as the knowledge and understanding needed to make an informed use of AI: being aware of its opportunities, its risks and the harm it can cause. In practice, it means your staff know:

  • that AI can be wrong and make up things that sound right
  • which data must not be shared with the AI
  • when a person needs to check or make the decision
  • who to ask when in doubt

How much depends on the use

The more that is at stake, the more the people involved need to know. Choose a use below and see how GoalCube AI Map assesses it.

GoalCube AI MapFictitious data
What will the AI be used for?
Minimal risk

Approved automatically under your rules. Staff need sufficient AI literacy (Art. 4).

Limited risk

Users must be able to see they are talking to an AI (Art. 50). GoalCube has ready-made wording you can use.

High risk

Recruitment is listed in Annex III. A person confirms the use before the AI gets any data, and decides each case (Art. 14 and 26; Art. 22 GDPR).

Prohibited

Emotion recognition in the workplace is prohibited (Art. 5). GoalCube won’t help with it.

The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.

What did the Digital Omnibus change?

The Digital Omnibus on AI (Regulation 2026/1744) entered into force on 27 July 2026. It did not remove Article 4 but adjusted it. Before, businesses had to ensure a sufficient level of AI literacy. Now they must take measures that support AI literacy – without having to ensure a set level for each individual. The Commission and the Member States must help with guidance and examples.

For a small business, it means the same in practice as before: do something concrete, make it fit the use, and be able to show it.

Date What happens
2 February 2025 Article 4 (AI literacy) and Article 5 (prohibited AI practices) apply
27 July 2026 The Digital Omnibus enters into force and adjusts Article 4
3 August 2026 National authorities supervise Article 4
2 December 2027 The rules for high-risk AI in Annex III apply, for example recruitment

What to do

  1. Make a list of how you use AI.Write down which AI tools you use and what for. That is the basis for everything else – and for being able to show a regulator what you have done.
  2. Assess the risk of each use.An email draft needs less than sorting job applicants. The higher the risk, the more the people involved need to know.
  3. Give everyone who uses AI a short introduction.What AI can and can't do, that it can be wrong and make things up, which data must not be shared, and who to ask. Asking people to read the provider's instructions is not enough.
  4. Give more to those working with high-risk AI.For example those who use AI in recruitment or HR decisions, and those who have to check the AI's output.
  5. Keep a record of what you have done.Who has had which introduction, and when. An internal overview is enough; a course certificate is not required, but it makes it easy to show.
  6. Repeat when something changes.When you start using new AI, take on new staff, or when the rules change.

What the law says

Article 4 AI Act – AI literacy
Providers and deployers of AI systems must take measures to ensure AI literacy among their staff and others operating AI on their behalf. Applies from 2 February 2025.
Article 3(56) AI Act – the definition of AI literacy
Skills, knowledge and understanding that allow people to make an informed use of AI and to be aware of its opportunities, risks and the harm it can cause.
Digital Omnibus on AI – Regulation (EU) 2026/1744
Adopted on 8 July 2026, in force from 27 July 2026. Adjusts Article 4: businesses must still take measures but no longer have to ensure a set level for each individual. The Commission and the Member States must help with guidance.

Questions and answers

Does Article 4 apply if we only use ChatGPT to write texts?

Yes. Article 4 applies to every business that uses AI at work, whatever its size and however low the risk. But the effort can be small when the use is simple – for example a short introduction explaining that AI can be wrong and which data must not be shared.

Do our staff need a certificate?

No. The Commission has said that a certificate is not required. An internal overview of who has had which introduction is enough. A course certificate just makes it easier to show.

When do the authorities start enforcing it?

The duty has applied since 2 February 2025. According to the Commission, national market surveillance authorities supervise it from August 2026.

What did the Digital Omnibus change?

Article 4 was not removed. Businesses must still take measures for AI literacy, but they no longer have to ensure that every employee reaches a set level. The measures must fit the tasks and the risk.

How much do we need to do?

It depends on what the AI is used for. The law has no fixed syllabus. The Commission points to a general understanding of AI, your role (deployer or provider), the risk of your use and your staff's existing knowledge.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.

Read next