Quick take: AI literacy after the AI Act amendments. What SMEs actually have to do

If your staff use ChatGPT, Copilot or any other AI system at work, the EU AI Act already expects something of your business. The rule was rewritten this year, and the new version is more proportionate for small firms.

What changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced Article 4 of the AI Act. Providers and deployers of AI systems (a deployer is, broadly, an organisation using one) "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The new text adds: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." [1]

What didn't change

It is still an obligation. Article 4 has applied since 2 February 2025, and national market surveillance authorities supervise and enforce it from 2 August 2026 [2]. Ordinary use counts: the Commission's Q&A says a company whose employees use ChatGPT to write advertising text or translate should inform them about specific risks, such as hallucination [2].

What it doesn't require

No certificate: "Organisations can keep an internal record of trainings and/or other guiding initiatives." No AI officer or governance board is mandated [2]. Training should reflect people's existing knowledge and the context the system is used in. Simply asking staff to read a tool's instructions "might be ineffective" [2].

UK firms

The Act can apply outside the EU where an AI system is placed on the EU market, used in the EU, or its use has an impact on people in the EU [2]. If you sell into the EU, check where you stand.

Why it matters beyond compliance

In our research, a lack of relevant expertise was the reason most often cited by EU small firms that had considered AI but weren't using it (70.9%, Eurostat, 2025). In the UK, 38.3% of small firms using AI or unsure said no staff had received AI training (ONS, Wave 165) [3]. Training is both the legal minimum and the practical bottleneck.

What we'd do this month (our view, not a legal checklist)

1. List the AI tools in use, including personal accounts used for work.
2. Write one page of rules: approved tools, what data never goes in, where a person checks the output.
3. Run a short session per role, built on the Commission's starting questions: what AI is and what we use; whether we build AI or only use it; the risks of each tool; what each group needs to know [2].
4. Keep a dated record of who was trained on what, and repeat it when tools change.

Also in the amendments

High-risk obligations now apply from 2 December 2027 for stand-alone high-risk systems and from 2 August 2028 for systems embedded in products covered by EU safety legislation [4]. If you use AI in an area the Act treats as high-risk, check what applies to you and when.

This isn't legal advice. For your own obligations, speak to a qualified adviser.

Sources

[1] European Commission, AI Act Service Desk, "Article 4: AI literacy" (text based on the EUR-Lex consolidated version as at 27 July 2026, as amended by Regulation (EU) 2026/1744). https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 (accessed 30 Oct 2026)

[2] European Commission, "AI Literacy – Questions & Answers". https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers (accessed 30 Oct 2026)

[3] Mellekis, "The state of AI adoption in Irish, UK and EU SMEs, 2026". https://mellekis.com/research/state-of-ai-adoption-smes-ireland-uk-eu-2026

[4] European Parliament press release, "AI Act: EP approves simplification measures and 'nudifier' app ban", 16 June 2026. https://www.europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban (accessed 30 Oct 2026)