"Do we have to train our people on AI now?" I hear this question a lot at the moment, usually with an undertone somewhere between duty and uncertainty. The short answer: if your company uses AI, yes – to an appropriate extent. The longer answer is more relaxed than many providers of mandatory courses make it sound.
The essentials
- Anyone using AI at work must take measures for their team's AI literacy – even if it is "just" ChatGPT
- Since 27 July 2026 a new version applies: support instead of ensure
- No certificate and no minimum level for individual people
- What matters is that you visibly do something and can show it
A word up front: I am a developer, not a lawyer. I build AI into software, train teams and use it every day in my own business. What follows is an assessment from that practice, not legal advice.
What applies since July 2026?
Article 4 of the European AI Act requires companies that provide or deploy AI systems to look after the AI literacy of their staff. The obligation has applied since 2 February 2025. The so-called Digital Omnibus rewrote it, and the new version has applied since 27 July 2026:
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
— Art. 4(1) AI Act as amended by Regulation (EU) 2026/1744, Official Journal of 24 July 2026
What changed compared with the first version:
| Feb 2025 to July 2026 | Since 27 July 2026 | |
|---|---|---|
| Core obligation | ensure, to their best extent, a sufficient level of AI literacy of staff | take measures that support the development of AI literacy |
| Level per person | "sufficient level" as the goal | explicitly no specific level |
| What counts | prior knowledge, experience, training, context of use, people affected | unchanged |
| Support | – | Commission and member states help, the Commission publishes practical examples |
In practice this means: the obligation has not gone away, but it has become more realistic. It is not about exams, but about visibly doing something – and being able to show it.
Does this apply to my company?
Very likely, yes. A "deployer" of an AI system is anyone who uses AI under their own authority in a professional context. It is enough if your team uses ChatGPT, Microsoft Copilot, Claude or another tool for work. You do not need to develop AI yourself.
One point that is often overlooked: in many businesses, staff have long been using AI with private accounts to write emails or summarise documents – without it ever being officially decided. How that is to be assessed legally is best clarified with your legal advisor. In practice, this uncontrolled use is exactly where skills and rules are most lacking.
What does "appropriate" mean?
The regulation does not prescribe a format. It does say what the measures should be based on: prior knowledge, experience, training, the context of use and the people affected by the results. Translated into three questions:
- Which tools are used, and for what?
- How much risk is involved? Using AI for social media drafts needs less than using it to summarise contracts or process personnel data.
- What prior knowledge is there? A development team needs something different from accounting.
A uniform online course for everyone can be one building block. But it does not replace the question of how your team uses AI in its own day-to-day work.
What I recommend to companies
Five steps that are manageable without much effort in most businesses:
- Inventory: which AI tools are used – officially and unofficially? A short, honest survey in the team often brings surprises.
- Set rules: which tools are allowed? Which data may go into a chat window, and which never? Who checks results before they go outside? One page is enough to start.
- Train to fit the use: better to practise on real everyday tasks than on someone else's examples. It sticks, and the rules from step 2 are practised along the way.
- Document: who was trained when, on which content? An attendance list with date, duration and topics is good evidence. This is the step most often forgotten.
- Repeat when something changes: new tool, new department, new task – then a short refresher and updated rules.
This is what evidence can look like. No form is prescribed, but these four details make a measure traceable:
| Evidence: AI literacy training | |
|---|---|
| When | date, time and duration of the training |
| Who | participants with department or role |
| Content | e.g. basics, data protection with chat tools, checking results |
| Rules | which internal AI rules were discussed and handed out |
Best filed together with the training material and the current version of your AI rules. What such rules can look like in real life is described in my article AI in my own business: how I work with AI agents.
What you do not need
- No certificate. The regulation does not require an exam or a specific certificate. A certificate does no harm, but it is not a free pass either.
- No AI officer. A dedicated role is not required. What matters is that someone keeps an eye on the rules.
- No expensive platform. A document with rules, a suitable training and a clean attendance list are a solid start for most businesses.
When is e-learning enough – and when not?
Often enough: your team hardly uses AI and you mainly need a first piece of evidence. Then an inexpensive online course can be sufficient, and there are plenty of them.
Usually not enough: AI is really used day to day – for client communication, analysis, texts or with sensitive data. Then a training that starts from your tasks and clarifies what is allowed in your company is worth it.
Not legal advice: this article is an assessment from practice, as of November 2026. What exactly applies in your case should be clarified with your legal advisor or data protection officer.
FAQ
Do I have to train my employees on AI?
If your company uses AI tools professionally, you must take measures that support your team's AI literacy. Training is the obvious way, but no specific format is prescribed.
Since when does the AI literacy obligation apply?
Since 2 February 2025. An amended version entered into force on 27 July 2026: since then, companies must take measures that support the development of AI literacy, without having to guarantee a specific level for individual people.
Does the obligation apply if my team only uses ChatGPT?
Yes. Professional use of general AI tools such as ChatGPT or Copilot also makes your company a deployer within the meaning of the regulation.
Do my employees need a certificate?
No. The AI Act does not require a certificate. What matters is that you document which measures you have taken in a traceable way.
Is an online course enough?
For a first piece of evidence with little use, often yes. If AI is really used day to day, the training should fit your tools and tasks.
Top comments (0)