← Blog
AI Act

AI literacy under Article 4 after the Digital Omnibus: what a small company actually has to do

What Article 4 of the AI Act asks after the Digital Omnibus, who supervises it in Slovenia, and a training record template for firms of 10 to 50 people.

Tadej Fius · MediaAtlas 9 min read

This is not legal advice but an overview to help you find your way. Check the text of Article 4 in the Official Journal of the EU and talk to a lawyer about your own case.

Short answer: a company whose staff use AI tools at work must, under Article 4 of the AI Act, take measures that support their AI literacy. For a company of 10 to 50 people that means, in practice, a list of tools, a short training session and a record of who attended and when. The law asks for no certificates. The duty has applied since 2 February 2025; the Digital Omnibus softened it in July 2026 but did not remove it.

The question we have been asked most in recent weeks is a simple one: do we really have to send people on a course? No. But you do have to be able to show what you did.

What it was, what it is now

The original Article 4 of Regulation (EU) 2024/1689 said providers and deployers "shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf".

The Digital Omnibus, Regulation (EU) 2026/1744, replaced Article 4 in full (Article 1, point 5). It has been in force since 27 July 2026. Providers and deployers now "shall take measures to support the development of AI literacy" of their staff and others operating AI systems on their behalf, taking into account their technical knowledge, experience, education and the context of use. The new text adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

The difference is what gets judged. Before, the target was a level of knowledge, which is hard to prove. Now it is measures, which you can write down. The date did not change.

Who is still bound by it

Both roles: providers, who develop an AI system and place it on the market under their own name, and deployers, who use an AI system in their work. Only personal, non-professional use is exempt.

Most small companies are in the second role. If your accountant summarises contracts with ChatGPT, a salesperson writes offers with Copilot and your website has a chatbot, you are a deployer and Article 4 applies to you. It also covers outside contractors who work for you with AI tools.

If you commission a custom model, for example a fine-tuned model for customer support, and offer it to customers under your own name, you can also be the provider of that system. When that happens is explained in our note on the AI Act and 2 December 2026, in the section on providers and deployers. For literacy it only means the training also covers the people who maintain the model.

Supervision from August 2026: who supervises and what the real risk is

Under the Act, the supervision and enforcement rules apply from August 2026; the Commission confirms this in its AI literacy questions and answers. In Slovenia, the powers are assigned by the act implementing the AI Act (ZIUDHPUI, Official Gazette of the Republic of Slovenia No. 85/25). Article 4 is supervised by the Information Society Inspectorate (IRSID), as the overview of the act by the law firm Jadek & Pensa also summarises (in Slovenian).

Two things matter for a small company:

  • The Act itself sets no fine for Article 4; Article 99 does not list it. The Slovenian act, however, makes it a misdemeanour for a company not to take AI literacy measures (Article 25 of ZIUDHPUI). Check the amounts in the text of the act.
  • IRSID's 2026 work plan (in Slovenian) schedules no systematic inspections under ZIUDHPUI; the implementing regulations are still being drafted. Complaints are handled in the order they arrive.

So the real risk is not an inspector knocking on your door this year. The risk is something going wrong: someone pastes customer data into a public chatbot, an offer with an invented figure goes out, a customer complains. Then the question is what you did beforehand. One page with a date and signatures is worth more at that point than good intentions.

A minimal record for a company of 10 to 50 people

What follows is the least we would want to show a supervisor or a customer. We keep the same kind of policy for our own models and agents: one page and a record.

1. A list of AI tools. For each tool: name, what you use it for, who uses it, which data may go into it and which may not, and whether you are its deployer or provider. Ask people, not just IT. Free accounts, browser extensions and AI features inside software you already have, such as meeting summaries, are often the biggest part of the list.

2. Who uses them. By job, not by name. Sales staff writing to customers need different knowledge from a developer connecting an AI tool to the customer database.

3. A short training session. One session is enough for most people, as long as it is tied to the tools on the list and not to AI in general. It covers:

  • what the tool can do and where it goes wrong: invented facts, wrong figures, outdated information;
  • what never goes in: customers' personal data, health data, trade secrets, passwords;
  • that AI output is a draft, checked before use by a person who understands the content;
  • who approves what goes out in the company's name;
  • where to report a mistake or a data leak.

4. Date and confirmation. Who attended or read the policy, when and in what form. Plus the date of the next review: once a year and with every new tool.

Template to download: AI literacy measures record

We made the template a plain text file you can open in any editor, fill in and print: ai-literacy-record.txt. It has five parts:

Part What you fill in
Header company, responsible person, valid from, next review
AI tools tool, purpose, who, allowed data, forbidden data, role
Rules of use five to eight lines everyone knows
Record date, person or job, content, format, confirmation
Changes new tool, new rules, date

The template is a starting point, not a finished document. If the list includes a tool for hiring or evaluating staff, the template alone is not enough: that is an Annex III area with additional obligations from 2 December 2027.

When you don't need us

  • If nobody in the company uses AI. Write that down once, with a date, and check again when something changes.
  • If you have up to ten people and two or three tools. The template above and one meeting are enough.
  • If someone is selling you a certificate as a legal requirement. It is not one. A course can be useful, but the law does not require it.

You need a lawyer if you use AI in hiring, credit or education, or if you have already received a complaint or a question from a supervisory authority.

How we start

  1. A short call: which tools you use, how many people, whether you sell anything under your own name.
  2. A short anonymous questionnaire for staff, so the list also includes tools management does not know about.
  3. You get a tool inventory with the role and risk class for each tool, an AI-use policy with a literacy record and an outline of a staff presentation. On request we also run a staff workshop that counts towards the record.

The packages and prices are on the AI Act review page. A free indicative self-check is on the same page.

Frequently asked questions

Do we have to send staff to certified AI Act training?

No. Article 4 asks for no certificates or exams. The Commission's AI literacy Q&A says a company can keep an internal record of trainings and other measures.

What did the Digital Omnibus change in Article 4?

Before, providers and deployers had to ensure, to their best extent, a sufficient level of AI literacy. Since 27 July 2026 they must take measures that support the development of AI literacy, without guaranteeing any individual's level. The duty still applies from 2 February 2025.

Who supervises AI literacy in Slovenia?

Under the Slovenian implementing act ZIUDHPUI, the Information Society Inspectorate (IRSID). Its 2026 work plan schedules no systematic inspections under that act, but it handles complaints.

Does this apply if staff use ChatGPT on their own initiative?

If they use it in their work for the company, put it on the tool list and cover it in the training. Deciding that a tool is not allowed is also a measure, but write it down and tell people.

How often do we have to repeat the training?

The Act sets no interval. We refresh ours once a year and with every new AI tool, and write the date in the record.

Sources

We quote the new Article 4 from Regulation (EU) 2026/1744. Read it in the Official Journal before relying on it and, once available, in the consolidated text of the Act on EUR-Lex. This note is general information and does not replace legal advice.