If your company uses ChatGPT, Copilot or any other AI assistant, you may have heard that "the AI Act requires you to train your employees". It sounds like yet another mandatory course with an exam and a certificate. The reality is more reasonable, and since the latest reform it is more reasonable still. Here is what the text says, explained for the people who actually have to comply.

◢What is AI literacy under the AI Act?

The AI Act is the European regulation on artificial intelligence (Regulation (EU) 2024/1689). Its Article 4 covers "AI literacy", which simply means that people who work with AI systems should understand the basics of what they use: what it can do, where it fails and what the risks are.

The article is aimed at two roles: providers (who develop or place an AI system on the market) and deployers (who use it in their professional activity). A small business using an AI assistant to write emails or answer customers falls into the second group.

◢What changed with the Digital Omnibus?

It also adds an important clarification: this obligation does not require guaranteeing any specific level of AI literacy for any individual. Nobody will ask you to prove that every employee reached a particular score. You are asked to do what is reasonable to make sure your people are prepared.

◢Do I need a course or a certificate?

From what the text says, there is no official mandatory course and no required certificate. What is asked for is measures that fit each case. Those measures should take into account:

• ▹The knowledge and training of the people involved.
• ▹The context in which the AI is used.
• ▹The people or groups it is used on.

You don't train someone who types questions into a chatbot the same way as someone who connects it to the customer database, or an accountant the same way as a support team.

◢Who has to comply in a small company?

Anyone using AI systems in their professional activity, whether as a provider or as a deployer. What the reform does do is look out for SMEs. Paragraph 2 says the Commission and Member States must support and facilitate these efforts, especially for SMEs, and that the Commission will publish practical compliance examples on the AI Act's single information platform.

Paragraph 3 adds that the European AI Board shall adopt recommendations drawing on European competence frameworks, for example to set common objectives. Until those examples and recommendations are available, the sensible move is to document what you do.

◢What measures can your company take?

There is no official recipe, so what follows is my practical approach, not legal text. I would start with four steps:

1. ▹Find out which AI is really in use. List the tools and who uses them. There are often more than management thinks, which is what people call shadow AI.
2. ▹Write a short policy. Which data must never be pasted into a chatbot, which tools are approved and who to ask when in doubt. Two pages is enough.
3. ▹Train by role. One hands-on session for the whole team using examples from their own work, and something deeper for whoever connects AI to company data. For one of the most concrete risks, see what prompt injection is.
4. ▹Keep a record. Note dates, attendees and content. Since the rule doesn't ask for a guaranteed level, what protects you is being able to show that you took reasonable, proportionate measures.

◢Is a video enough?

A video on its own is a very weak measure, especially if your team handles customer data with AI. The rule talks about measures adapted to the context, and that points to something more than watching a generic recording once. I can't tell you where an inspector will draw the line, because that will be decided by national authorities and by the examples the Commission publishes. But a session built around real cases from your company is easier to defend than a generic slide deck.

◢What to check before acting

Two things. First, the text I quote is the consolidated version that the Commission's AI Act Service Desk publishes from EUR-Lex, but the only legally binding version is the one published in the Official Journal of the EU. Second, penalties and the way supervision works depend on each Member State, so if you have specific doubts, ask your legal adviser.

If you want to bring this to your team with examples from their daily work, my training sessions cover exactly that: cybersecurity and AI explained for non-technical people.