AI literacy is now a requirement: what Article 4 of the AI Act means for your business

The AI Act requires businesses that use artificial intelligence at work to ensure that the people using the tools understand what they are doing. The requirement is set out in AI Act Art. 4 and has applied in the EU since 2 February 2025. In July 2026 the wording was amended, so that the obligation is now to take measures, not to guarantee a particular level. For Norwegian businesses the requirement is not yet binding law, but it is on its way.

What does AI literacy mean under the AI Act?

AI literacy means the skills, knowledge and understanding that allow AI systems to be used on an informed basis, and that give awareness of the opportunities and risks of AI and the harm it can cause. The definition is in AI Act Art. 3(56) of Regulation (EU) 2024/1689.

The concept is therefore not about technical expertise. A caseworker who uses a language model to write drafts must understand that the model can invent facts, that the content may be stored by the vendor, and when the answer must be checked. A developer who builds a system for customers needs a different and deeper level of literacy.

Who must ensure AI literacy?

The obligation applies to both providers and deployers of AI systems. A deployer is any natural or legal person, public authority, agency or other body using an AI system under its authority, except where the system is used in the course of a personal, non-professional activity, see AI Act Art. 3(4).

This means that almost every business that lets employees use ChatGPT, Copilot or similar tools at work is a deployer. The Commission confirms in its guidance on AI literacy that the requirement also applies to the use of general-purpose language models, and uses the risk of hallucinations as an example of what employees need to be aware of.

The requirement covers the business’s own staff and others who use the systems on its behalf. The Commission mentions contractors, service providers and customers as potentially falling within this group. External consultants and temporary staff should therefore be included in the plan.

What did the Digital Omnibus change in Article 4?

The amendment turns the obligation into a duty of effort. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and rewrote Article 4.

For businesses, the practical difference is smaller than it may appear. The duty to act remains, and a business that has done nothing does not meet the new wording either. What has gone is the risk of being measured against an undefined “sufficient level”.

The requirement is not that everyone becomes an expert. The requirement is that the business can show it has done something sensible to ensure people understand the tools they use.

What should an AI literacy training programme include?

A good programme is tailored to the roles in the business, not a single course for everyone. The Commission recommends building the measures around four questions. What is a general understanding of AI within the organisation? Is the business a provider or a deployer? What risks arise from the systems actually in use? And which measures suit the employees’ background and the way the systems are used?

Training should also be repeated. AI tools change quickly, and new features such as access to email, documents or customer data change the risk. A short refresher when a tool gains new features achieves more than one long course. Many businesses succeed with short, practical sessions in which employees try the tool on their own tasks and see where it fails.

The Commission stresses that referring to the vendor’s instructions for use is not enough. Training should be linked to the business’s own AI policy for employees, so that the rules and the literacy work hang together. Where the tools process personal data, training should also build on the findings of the DPIA for the AI tool.

How is AI literacy documented?

Internal documentation is sufficient. Neither certification nor reporting to the authorities is required. The Commission notes that businesses may keep their own records of training and other measures.

In practice, the documentation should show which AI systems are used, who uses them, which measures have been taken for which groups, and when the programme was last updated. This is the record the supervisory authority will ask for, and it is what shows that the business has met its duty of effort.

Article 4 is not among the provisions with specific fine levels in AI Act Art. 99. Member States must nevertheless lay down penalties for infringements of the regulation, and the national market surveillance authorities enforce the requirement from August 2026. A lack of training may also be relevant when liability for an AI error is assessed under other rules, for example in a claim for damages or a data protection case.

Does the AI literacy requirement apply in Norway?

No, not yet. The AI Act has not been incorporated into the EEA Agreement, and it has not been implemented in Norwegian law. The government sent a draft AI Act for public consultation in June 2025, proposing that the Norwegian Communications Authority (Nkom) become the coordinating supervisory authority. Following the changes in the EU in July 2026, the government announced on 4 August 2026 that the act will be sent for a new consultation in autumn 2026, with a bill to the Storting (the Norwegian parliament) in spring 2027. Negotiations on EEA adaptations are ongoing.

There are two important caveats. Norwegian providers that place AI systems on the EU market are already covered, see AI Act Art. 2(1). The same may apply where the output of an AI system is used in the EU. Groups with companies in the EU must also meet the requirement there.

The requirement also has value independently of the regulation. Norwegian rules that already apply assume that those who use the technology understand it. The GDPR requires appropriate organisational measures to protect personal data, and a business that lets employees enter customer data into an AI tool without training is in a weak position if something goes wrong. The same applies to duties of confidentiality and the protection of trade secrets.

For most Norwegian businesses, the question is therefore not whether the requirement will come, but when. A programme built now can be adapted to the Norwegian act once it is in place, and at the same time provides a documented basis for the board’s oversight of AI use. Read more on the topic page on artificial intelligence.

What should the business do?

1. Map the use of AI. Make an overview of which AI systems are used, by whom and for what, including tools employees have adopted on their own initiative.
2. Clarify the role. Establish whether the business is only a deployer, or whether it also develops or adapts systems and may therefore be a provider.
3. Organise by role. Provide shorter basic training for everyone and more targeted measures for management, HR, procurement and IT.
4. Link the training to the rules. Make sure the internal AI policy and the training say the same thing.
5. Include external staff. State in consultancy and temporary staffing contracts who is responsible for the training.
6. Document it. Keep a simple record of measures, participants and dates, and update it when new tools are introduced.
7. Follow the Norwegian legislation. The consultation in autumn 2026 may bring Norwegian-specific rules on supervision and penalties.

Questions and answers

Next legal review: 1 December 2026