Is AI literacy mandatory? What you need to arrange

Is AI literacy mandatory?

Yes. Since 2 February 2025, businesses that use AI have had to work on the AI literacy of their people. That is set out in Article 4 of the European EU AI Act (in Dutch: AI-verordening).

In July 2026 that article was amended. The obligation remained, but it is now worded differently. You must take measures that support the AI literacy of your people. You do not have to make sure that every employee reaches a certain level. So it is an obligation of effort: you must do something about it, but the law does not require a fixed result.

This is an explanation in plain language, not legal advice. Unsure about your situation? Then ask a lawyer.

What does AI literacy mean?

AI literacy means that your people know enough and can do enough to work sensibly with AI. The law describes it as the skills, knowledge and understanding to deploy AI systems in an informed way, and to be aware of the opportunities, the risks and the possible harm. There is more explanation under the term AI literacy.

In plain language it comes down to three questions:

• Does your team know what AI can do, and what it cannot?
• Does it know where AI goes wrong?
• Does it know how to use AI safely, with customer data and company data?

An example of ‘going wrong’: a language model can give an answer that sounds convincing but is not correct. That is called a hallucination. Anyone who knows that checks the answer before using it.

What has Article 4 said since July 2026?

Since 27 July 2026, Article 4 requires you to take measures to support the development of AI literacy. That applies to your staff and to other people who use AI systems on your behalf. In doing so, you take into account their knowledge, experience and training, and the context in which they use AI.

The amendment comes from Regulation (EU) 2026/1744, also known as the Digital Omnibus on AI. It was adopted on 8 July 2026, published on 24 July 2026 and entered into force on 27 July 2026.

What is different from before?

• Before, you had to ensure a sufficient level of AI literacy among your people.
• Now, you take measures that support AI literacy. The law adds that you do not have to guarantee a certain level per person.
• New is that the European Commission and the member states must help businesses, especially small and medium-sized businesses. The Commission publishes practical examples for this.

The legislator explains the reason itself. Strict obligations to reach a fixed level did not suit every business. They created extra regulatory burden, especially for smaller businesses.

Note: so it does not say that AI literacy is no longer an obligation. The European Commission puts it the same way. It remains an obligation; the law just no longer prescribes a ‘sufficient’ level.

Who does the obligation apply to?

The obligation applies to every business that uses AI systems for its work, large or small. In the law, such a business is called a deployer. Businesses that make AI systems and place them on the market, the providers, have the same obligation.

The obligation also applies if your team only uses ChatGPT or Copilot. The European Commission writes that employees must then know what the risks are, for example hallucinations. How to use those tools safely is explained in Is ChatGPT safe for businesses?

The obligation covers your staff and other people who work with AI on your behalf. Think of a temporary worker or a freelancer who answers customer questions for you with an AI tool.

Don’t know exactly which AI tools your team uses? Then that is where you start. An overview of your tools is the first step, see below.

What is enough? Is a certificate mandatory?

A certificate is not mandatory. The law does not prescribe a course, an exam or a fixed number of hours. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) says so too: which measures you take exactly is not set out in the law.

What is appropriate depends on how you use AI. Someone who only uses AI for a first draft of an email needs less knowledge than someone who uses AI in decisions about people, such as with job applications. The greater the consequences for others, the more knowledge is needed.

Do record what you do. The European Commission mentions an internal record of training and other measures as a way to show this. For example:

• who has had which training or explanation, and when;
• which agreements on AI use are in place;
• which AI tools your business uses, for what, and who the owner is.

Who supervises, and from when?

Supervision lies with supervisory authorities in each EU country. According to the European Commission, the rules on supervision and enforcement of this article apply from August 2026.

In the Netherlands, the government put a bill out for consultation in April 2026: the uitvoeringswet AI-verordening (the Dutch act implementing the EU AI Act). In it, the AP and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) are given a central role. Which sanctions apply in the Netherlands will follow from that act. Check the AP website for the current state of affairs.

Don’t wait for it. The obligation has applied since February 2025, and the measures are very manageable for an SME.

What do you need to arrange as an employer?

You arrange four things: an overview of your AI tools, what people need to know per role, training with agreements, and a moment to look back. In its guide ‘Aan de slag met AI-geletterdheid’ (Getting started with AI literacy), the AP gives the same order: map out, set goals, implement and evaluate. Start small. For an SME it looks like this:

1. Map out which AI you use. Ask your team which tools they use, and for what. Put it in an AI register. Do you already have an overview of your processing of personal data for the GDPR? According to the AP, that is a good starting point.
2. Determine per role what people need to know. A colleague in the accounts department needs different knowledge from someone who uses AI to assess job applications.
3. Train and make agreements. Explain, let people practise on their own work and put the rules on one page. There is an example in AI policy on one page. What belongs in such an AI policy is also explained under the term.
4. Look back and update. Is there a new tool, or is your team using AI for different work? Then check whether your explanation and your rules are still correct.

How do you arrange it in half a day?

You can set up the basics in half a day. In my AI policy & training session we do three things:

• a training: what AI can do, where it goes wrong and how to use it safely;
• clear rules for AI use in your business;
• an overview of the AI tools your team uses.

I come to your business, anywhere in the Netherlands. Would your team then like to spend a full day practising with AI on their own work? Then there is the one-day team training, for up to 12 people. We discuss the cost in the first conversation, so you know where you stand in advance. Read more on AI training.

To be fair: half a day is a start, not an end point. AI literacy is something you keep up. Whether the basics are enough for your business depends on how your team uses AI. We look at that together in the first conversation. Book a call.

Frequently asked questions

Sources: Regulation (EU) 2026/1744 (Digital Omnibus on AI) (in Dutch), Official Journal of 24 July 2026, European Commission: AI literacy, questions and answers, AP: AI literacy (in Dutch), AP: Getting started with AI literacy (in Dutch) and AP: Supervision of AI is becoming concrete (in Dutch) (20 April 2026). Consulted on 7 October 2026.