AI literacy is the ability to use artificial intelligence with awareness: knowing what a tool does, what risks it carries and when a result needs checking. Article 4 of the AI Act, the European regulation on AI, asks companies that use AI to take measures that support it among the people who work there.
This guide covers what the rule says today after the July 2026 amendment, who it applies to, what happens if you do nothing and how a small business can move without wasting money. You will also find an example, the cases where a formal course is not needed and the most common questions. This text is informational and does not replace advice from a lawyer or your DPO (data protection officer).
What is AI literacy under the AI Act?
The AI Act is Regulation (EU) 2024/1689. It defines AI literacy in Article 3, point 56, and according to Format the definition stayed the same after the 2026 reform. In practice, for someone working in a small business, it means four abilities:
- knowing what an AI tool is for and what its limits are;
- knowing which data must not go into chats and external tools, for example personal, confidential or customer data;
- recognizing that an answer can be wrong or invented (these errors are called hallucinations) and checking it before using it;
- knowing when a decision must stay with a person.
What does Article 4 of the AI Act say today?
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal of the European Union on July 24, 2026 and entered into force on July 27, 2026. According to Format and aiconcreto, it replaced Article 4 in full.
The text is addressed to providers and deployers. A provider is whoever develops or places an AI system on the market. A deployer is whoever uses it in their own activity: a small business that uses a chatbot for work is almost always in this second group. Before the reform these parties had to take measures to ensure, to the extent possible, a sufficient level of AI literacy. Today they must take measures to support the development of that literacy. The text states that the obligation does not require guaranteeing a specific level to any person, as reported by aiconcreto and the law firm of lawyer Sangermano.
What really changed with the Digital Omnibus?
According to Format, the duty moves from an obligation of result to an obligation of means. In other words, what counts is the path the company sets up and can document, rather than a skill level to be reached. The changes and the confirmations, in short:
- The wording changes: from "ensure a sufficient level" to "support the development" of literacy.
- A new paragraph 2 appears: the Commission and Member States must support operators, in particular small and medium-sized enterprises, with practical examples.
- A new paragraph 3 appears: the European AI Board is tasked with drawing up recommendations on common objectives.
- The definition, the calibration criteria (knowledge, context, people involved) and the scope of who is covered stay the same.
On the starting date the sources are not entirely consistent. Format says the general starting date remains February 2, 2025, when Article 4 became applicable. According to aiconcreto, the new text applies from July 27, 2026 with no transitional period. Our cautious reading: if you have already started a training path, you do not need to start over, but it is worth reviewing it against the new wording.
One useful detail: according to Format, the European Commission's FAQs on AI literacy are dated November 19, 2025 and still describe the old wording. Read them with care.
Who does the obligation apply to?
According to Format and aiconcreto, Article 4 covers providers and deployers for their own staff and for other people who operate or use the systems on their behalf. That means employees, outside collaborators, consultants and suppliers who work for you with AI tools. The sources describe the scope by role and give no company-size thresholds.
The AI you do not see counts too: many everyday programs have built-in AI features. To find out what people really use, start from a list (you will find it in the five steps). For a closer look at a much-discussed category of tools, read AI agents for small businesses: when you need them and when you don't.
What happens if you do nothing?
According to Format, Article 4 does not appear in the list in Article 99, paragraph 4, so it falls outside the European ceiling of 15 million euros or 3% of turnover. The penalty framework is left to individual Member States, with supervision by national market surveillance authorities. For Italy, again according to Format, the authority named is the ACN (the National Cybersecurity Agency). According to aiconcreto, Article 4 never had a standalone penalty.
This does not make the matter optional. The law firm of lawyer Sangermano notes that a company with no measures at all struggles to show it did the minimum required. It adds that concrete problems, such as staff using ChatGPT without telling anyone, are handled under the GDPR, which existed before the AI Act. A small business faces exactly this kind of everyday risk: customer data pasted into an external tool, texts with mistakes published unchecked, no written rule to fall back on.
Those who use high-risk AI systems have a further obligation. According to Format, Article 26, paragraph 2, covers the training of staff who oversee these systems and carries penalties of up to 15 million euros or 3% of turnover. It applies from December 2, 2027 for Annex III systems and from August 2, 2028 for Annex I systems. For the Italian picture on offences and corporate liability, read Italy's AI Decree 160/2026: what small businesses should know.
How do you get in order, in five steps?
The guidance from Format and the Sangermano law firm points to a simple, proportionate path. Here it is, adapted to a small business:
- List your tools. A table with four columns is enough: tool, what it is for, what data it handles, who uses it. Include programs that have built-in AI features.
- Write a short rule. One page saying what can be done with AI and which data must never be uploaded to external tools: personal, confidential or customer data.
- Inform and train people. One session for everyone, with different depth for those who use AI every day, those who review other people's work and those who decide.
- Include the people who work for you. Collaborators, consultants and suppliers who use AI tools on your behalf fall within the scope.
- Document and repeat. Keep an internal record with dates, participants and contents. Update the path when new tools or new people arrive.
A concrete example of a firm getting in order
Hypothetical example. An architecture firm with six people finds out, while making the list, that two colleagues use a chatbot for report drafts, one uses machine translation on client emails and the rendering program has an AI feature switched on that nobody chose. In one afternoon the firm fills in the tool table. Then it writes a one-page rule: no client names or site data in external chats, and every generated text must be reread by the person who signs it. Finally it runs one session for the whole firm and keeps the attendance sheet. The path is documented and proportionate to the firm's reality.
What training formats exist?
AI training comes in three main forms. Asynchronous e-learning, meaning courses each person follows when they can, is the most practical option for people who work in shifts or across several sites. Classroom or video sessions let you work on cases brought by participants. The blended format combines an online path for everyone with a live session for decision makers.
On our AI Act training page at Sarabi.Cloud there are three modules: safe prompting (what not to put into public chats), bias and hallucinations (spotting wrong answers and checking sources), and privacy, data and ethics (GDPR and the AI Act applied to daily work). The basic modules take three to six hours per person, spread over a few weeks. Our page lists no prices: the written quote comes after a call of about twenty minutes.
Anyone who trains many people or wants to deliver courses independently can rely on an e-learning platform with automatic tracking of access and tests and named PDF certificates; with content already ready the launch takes one to two weeks.
Do you need a certificate or certification?
According to Format, no certificates are required: an internal record of initiatives is useful. An official AI literacy certification does not exist, so a named attendance certificate documents the path but carries no legal weight. Be wary of anyone selling a badge as a guarantee.
When is a formal course not needed?
In our view a structured course risks being wasted money in these cases:
- Nobody in the company uses AI tools, not even those built into everyday programs. Check with the list first, then decide.
- The group is very small and the tools are few. A written rule, an internal session and a record may be enough, because measures must be proportionate to the context of use, as the Sangermano law firm notes.
If, after the list, you find that customer data must stay inside your own systems, there is also the route of local AI and privacy: the model runs on the customer's infrastructure and sends no data to third-party services.
Which other AI Act dates are worth watching?
According to Agenda Digitale, the Digital Omnibus does not suspend the regulation: it mainly pushes back the obligations on high-risk systems. The dates reported by the sources consulted are these:
- August 2, 2026: transparency obligations of Article 50, for example telling people when they are talking to a chatbot (Namirial).
- December 2, 2026: machine-readable marking of AI-generated content for systems already on the market before August 2, 2026.
- December 2, 2027: new deadline for Annex III high-risk systems.
- August 2, 2028: new deadline for high-risk systems built into products already regulated, such as machinery and medical devices.
What are the most common mistakes?
- Stopping everything because the duty is softer. According to Format the obligation changed in nature but did not disappear.
- Running the course without leaving a trail. Without dates, participants and contents it is hard to show what was done.
- Relying on old material. The Commission FAQs date from November 2025 and carry the earlier wording.
AI literacy FAQ
Does AI literacy apply to a micro-business? The sources consulted describe the scope by role (provider or deployer), with no size thresholds. Small and medium-sized enterprises are mentioned in the new paragraph 2 as recipients of support and practical examples. For a specific case, ask a professional.
How much does training cost? There is no figure that fits everyone. With Sarabi.Cloud the cost per person falls for larger groups.
How often should it be repeated? We recommend repeating it once a year, with updates when new tools or new people arrive.
Want to know where to start in your company?
At Sarabi.Cloud we offer AI Act training as e-learning, in a classroom or in a blended format, with a platform to deliver and track it. If you want an opinion on your starting point, write to info@sarabi.cloud: tell us in two lines how many people use AI tools, which tools, and whether you already have a written rule. More guides on websites, automations and digital tools are in the blog index.
Sources: Format, Article 4 AI Act: literacy after the 2026 Omnibus; aiconcreto, Digital Omnibus AI Act: what changes; Studio Sangermano, AI Act delay 2026: practical guide for SMEs; Agenda Digitale, AI Act: the delay is a trap for SMEs; Namirial, AI Act after the Digital Omnibus: the new calendar.
Have a similar case or a doubt? Write to us at info@sarabi.cloud.