As of 2 February 2025, any company that uses AI tools in their work (ChatGPT, Copilot or Gemini included) must implement measures to ensure that their team is aware of how to use them. This is the requirement of Article 4 of the EU AI Act. Since July 2026, after the Digital Omnibus reform, it is no longer about reaching a certain level, but about taking action and being able to prove it. In an SME, this can be as simple as a short training session, a written usage policy and a record of who was trained.
What Article 4 is about
What Article 4 is about is AI literacy: skills, knowledge and understanding that allow people to use AI systems with judgment, being aware of the opportunities, the risks and the harms they can generate (Article 3 of the regulation defines it that way).
The original text, as of 2 February 2025, required providers and deployers to ensure, "to their best extent", that their staff and those who use AI systems on their behalf have a sufficient level of AI literacy.
But the wording was amended by Regulation (EU) 2026/1744, Digital Omnibus, published on 24 July 2026 and in force since 27 July:
- Now a company must implement measures to foster AI literacy among its staff and those who use AI on its behalf.
- The article clarifies that it does not require a specific level to be guaranteed for each person.
- The European Commission and the member states must support these efforts, especially those of SMEs.
In other words, it is no longer a duty of results, but a duty of means. But it is still a duty.
Is your company affected?
Almost certainly. The regulation defines as a deployer anyone who uses an AI system under their own authority (except for personal, non-professional use). So, if you have someone on your team who uses an AI tool to write emails, prepare proposals or create images for a campaign, your company is the deployer of that tool.
There is no exemption based on the size of the company. A company with 5 people has the same duty as one with 500 people, even if the reasonable way to comply is much simpler. It also applies to people who use AI on your behalf, such as freelancers or contractors.
Who enforces it and what happens if you don't comply
Since August 2026, the national authorities can monitor compliance with Article 4. In Spain, the main authority is the AESIA (Agencia Española de Supervisión de la Inteligencia Artificial).
The penalties are determined by each member state. In Spain, the organic law bill to establish them lapsed on 6 October 2026, when the Cortes were dissolved, so a new text will have to be created. Currently, the most real risk is not a fine for Article 4, but the possibility of having an inspection, a customer complaint or a data leak, and not being able to show what you have done to ensure that your team uses AI carefully.
What training does your team need?
There is no official certificate, and there is no minimum number of hours. In the questions and answers on Article 4, the European Commission recommends that the training be adapted to what each person does with AI and what they already know, and that the risks of the tools used by the company be taken into account.
A practical way to organise it, by role (hours are indicative, not set by the regulation):
| Role | What they should know | Suggested time |
|---|---|---|
| The whole team | What generative AI is and what it gets wrong, what data is never entered, that every output must be reviewed before use, the company's policy | 1 to 2 hours, at the beginning and when joining |
| People who publish content (marketing, agencies) | Also: when you must disclose that an image, audio or video is artificial, image rights and copyright | 1 more hour |
| People who use customer or employee data | Also: GDPR applied to AI, why AI is not left to make decisions about people | 1 more hour |
| People who choose or configure the tools | Also: how to evaluate a provider, the data processing agreement, where data is processed | 2 more hours |
How an SME can comply in 5 steps
- Take stock of the AI tools you use. This includes those that people use on their own initiative: according to an OpenAI study of 1,000 Spanish SMEs, 70% of their executives say their staff already use AI on their own initiative.
- Determine which tools are authorised and for what, and put it in writing. An AI usage policy is the basis of the training: which tools, with which data, who reviews the output. 39% of Spanish SMEs still do not have one.
- Train each person according to their role, using the table above as a starting point.
- Record what you do. A simple record is enough: who was trained, when, with what content, and that they read the policy. This is what you can show if asked.
- Review it every year, and when the tools change or someone joins.
Common mistakes
- Thinking it only affects those who develop AI. Article 4 also applies to those who use it.
- Buy a certificate and call it a day. There is no official certificate; what matters is that the training is tailored to your company and documented.
- Banning AI. It rarely works: people continue to use it from personal accounts, and the company loses control of its data.
- Training once and forgetting about it. The tools change every few months, and so does the team.
How P30 can help you
Training is easier when the whole team uses the same authorised tool. In P30, the company works in its own workspace, with roles and permissions, instead of personal accounts. Your data is stored in the EU and never used to train models. And our team helps you roll it out.
For the rest of the AI Act (the calendar, the fines, what was delayed), check our guide to the EU AI Act in 2026.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 3 and 4.
- Regulation (EU) 2026/1744 (Digital Omnibus), which amends Article 4.
- European Commission: AI literacy questions and answers.
- AESIA, Spanish AI Supervisory Agency.
- Congress of Deputies: bill 121/000096 on the good use and governance of AI, lapsed on 6 October 2026.
- OpenAI study of 1,000 executives of Spanish SMEs, reported by Europa Press on 17 September 2026.