What it says
Article 4 of Regulation (EU) 2024/1689 asks providers and deployers of AI systems to take measures to support the promotion of AI literacy among their staff and others who use those systems on their behalf, taking into account their knowledge, their experience and the context of use.
The text in force adds a sentence worth reading slowly: this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
Source: Reglamento (UE) 2024/1689, artículo 4 (AI Act Service Desk, Comisión Europea) (dated 27/07/2026)
Who it binds
A “deployer” is whoever uses an AI system in a professional activity. The European Commission gives the example: a company whose staff use ChatGPT to write text or translate must inform those people of the risks, for example hallucination.
There is no exemption for small companies. What the article does say is that the Commission and the Member States must support them.
Sources: Comisión Europea, «AI Literacy – Questions & Answers» (dated 20/10/2026) · Reglamento (UE) 2024/1689, artículo 4 (AI Act Service Desk, Comisión Europea) (dated 27/07/2026)
Since when
Article 4 applies since 2 February 2025. Supervision by national market surveillance authorities starts on 2 August 2026.
In July 2026, Regulation (EU) 2026/1744, the “digital omnibus”, reworded the article. It did not repeal it: it changed “ensure a sufficient level” to “take measures to support the promotion”.
Sources: Comisión Europea, «AI Literacy – Questions & Answers» (dated 20/10/2026) · Cuatrecasas, «Se publica el Reglamento Ómnibus Digital sobre IA» (dated 24/07/2026)
What counts as a measure
There is no mandatory format. The Commission says organisations can keep an internal record of trainings or other guiding initiatives, and that the content should fit what each person does.
Training with content by job role, a test and a record of who took it and when is a measure, and it leaves a trace.
Source: Comisión Europea, «AI Literacy – Questions & Answers» (dated 20/10/2026)
What is not needed
A certificate. The Commission says so in as many words: “There is no need for a certificate”.
An official qualification or accreditation: none exists for this. Be wary of anyone selling you one.
Source: Comisión Europea, «AI Literacy – Questions & Answers» (dated 20/10/2026)
Fines
The Commission says national authorities could impose penalties for infringing Article 4 under each country’s law, and that any sanction must be proportionate.
In Spain, the bill that was going to set the penalty regime lapsed on 6 October 2026 when parliament was dissolved. Today there is no specific fine for Article 4.
Sources: Comisión Europea, «AI Literacy – Questions & Answers» (dated 20/10/2026) · Congreso de los Diputados, expediente 121/000096 (ficha de tramitación) (dated 06/10/2026)
What does have a date and will not wait: transparency
Article 50 applies since 2 August 2026: systems designed to talk to people must say they are an AI, and deepfakes must be identified as artificial. The omnibus only postponed, until 2 December 2026, the technical marking of content for generative systems already on the market.
Source: Economist & Jurist, «El ómnibus de IA ya es ley y la transparencia no espera» (dated 24/07/2026)
And personal data
This comes not from the AI Act but from data protection law, and has been in force for years. The Spanish data protection authority recommends not sharing personal data with AI, following each organisation’s information and security policies, and not including confidential information about the organisation, its staff or its clients.
At work, it adds: use only the assistants authorised by the organisation, and do not connect work email or documents to a personal AI account.
Sources: AEPD, decálogo «Cuidado con lo que le confIAs» (dated 27/01/2026) · AEPD, decálogo para delegar tareas en asistentes y agentes de IA (dated 27/10/2026)
How many already use it
33.6% of Spanish companies with 10 or more employees used artificial intelligence in the first quarter of 2026, according to the national statistics institute. Among those with fewer than 10, 21.4%.
And among employees, 82% use AI in their daily tasks with tools their company did not provide and without telling it, and only 44% have received training from their company.
Sources: INE, Encuesta sobre el uso de TIC y del comercio electrónico en las empresas (dated 22/10/2026) · Cegid y OpinionWay, «El momento de la verdad de la IA en la empresa» (Computing) (dated 31/08/2026)
What can be said and what cannot
Can be said
- The obligation exists since 2 February 2025 and is supervised since 2 August 2026.
- It applies to whoever uses an AI chat at work, small companies included.
- A course, a test and a named record are measures and leave a trace.
- No certificate is needed: an internal record is enough.
Cannot be said
- “Official certificate” or “accredited”.
- “With this you comply with the AI Act”.
- “Sufficient level guaranteed”.
- “Avoid fines of millions”.
This guide is for information only and is not legal advice.