EU AI Act and AI literacy training: what companies must do

The EU AI Act, Regulation (EU) 2024/1689, doesn't require you to take a specific course or earn a certificate. What it does ask, in Article 4, is that businesses using AI take measures so their team understands it and uses it with good judgment. The Act calls this "AI literacy," and it has applied since February 2, 2025.

If you run a small business or work for yourself, here's what that means, which AI literacy training options you have and how to keep a record of what you do.

Note: this article is for information only and isn't legal advice. It's current as of September 2026. For your own situation, check the current text on EUR-Lex or talk to a professional.

What the EU AI Act says about training

Article 4 applies to two roles: providers, who develop AI systems or put them on the market, and deployers, who use them in their professional activity. Both must take measures to support the AI literacy of their staff and of other people who operate or use those systems on their behalf.

Those measures should take into account each person's technical knowledge, experience and training, the context the AI is used in and who it affects. Under the Act, AI literacy means being able to use AI in an informed way and being aware of its opportunities, its risks and the harm it can cause.

A recent change: Regulation (EU) 2026/1744 (the "Digital Omnibus" on AI), in force since July 27, 2026, rewrote Article 4. The original text spoke of ensuring, to the best extent possible, a "sufficient level" of AI literacy. The new text asks for measures that support its development, without requiring any specific level for each individual. The obligation is still there; the focus has shifted to effort you can demonstrate.

The Act doesn't set a specific fine for Article 4; each Member State lays down its own rules on penalties. And while the rest of the Act is being phased in, the AI literacy requirement already applies.

What it means for a small business or freelancer

If you use AI in your work, you're a deployer. It doesn't matter whether it's an assistant that drafts text, a tool that summarizes meetings or a customer service chatbot. Only personal, non-professional use is excluded.

• Who to train: the people on your team who use AI, plus anyone who uses it on your behalf, such as outside contractors.
• How much: in proportion to the use. Writing marketing copy is not the same as screening job applications with AI, which is a high-risk use with its own obligations.
• What isn't required: in its Q&A on Article 4, the European Commission clarified that you don't need a certificate or a formal assessment of each person. An internal record of training and other measures is enough.
• If you work alone: you have no staff to train, but understanding your tools well is what lets you use them wisely and explain to clients how you work.

Ways to comply: a comparison

The Act doesn't prescribe a format. These are the most common options for a small business:

What usually works best is a mix: a shared foundation for the whole team, a short internal session on your own tools and rules, and a refresher when they change.

What AI literacy training should cover

• What AI is and how it works, at a basic level: why it can be confidently wrong or reproduce bias.
• Human oversight: reviewing what it produces before using it, and knowing when not to trust it.
• Data: which personal or confidential information should never go into a tool.
• What the Act prohibits, such as manipulation that exploits vulnerabilities or emotion recognition in the workplace, except for medical or safety reasons.
• Transparency: when you need to tell people they're talking to an AI or that content was generated with one.
• Your internal rules: approved tools, permitted uses and who to ask when in doubt.

And don't forget the human side: judgment, critical thinking and communication. They're the same soft skills as always, applied to a new tool.

How to document your training

Since Article 4 asks for measures, what you want is to be able to show you've taken them. A simple record is enough to start:

1. Inventory of uses: which AI tools are used, what for and by whom.
2. Usage policy: one or two pages on what's allowed, what isn't and which data must not be shared.
3. Training log: who did what, when, with what content and in what format. Keep certificates of completion, attendance lists or progress reports.
4. Regular review: update everything when a new tool arrives or a use changes.

Tip: date every version of your policy and your log. If anyone asks, you'll be able to show what you did and when.

Where Game Strategies fits in

Our artificial intelligence courses include two games designed for the whole team, with no technical background needed:

• Innowear (40 minutes): you live through a crucial week for the marketing team at a textile company. You learn what AI is, how it's applied at work and why it needs human oversight and ethical use.
• Technocity (30 minutes): you're head of AI and digital ethics for a European city, deciding which proposals fit within the Act. It covers definitions, prohibited practices, each actor's obligations and the difference between general-purpose models and high-risk systems.

If your business handles personal data, Classified (90 minutes), in the safe workplace category, covers data protection. All of them are included in the annual catalog license: €299 per person (VAT included), one year of access to all 71 games, a certificate of completion for each course and an admin dashboard to assign courses and track progress, which helps with your records. What they won't do is write your internal rules: that quest is yours.