AI Literacy Duty: What SMEs Must Do in 2026

"Our people have been using ChatGPT for ages. Do we have to do something now?" Many managing directors have been asking this since the EU AI Act introduced an AI literacy obligation. On top of that there is uncertainty, because the EU changed the rule in summer 2026 with the so-called Digital Omnibus. This article explains without scaremongering what Article 4 requires today, who it applies to and what a pragmatic training plan with documentation looks like.

Important up front: this article reflects the situation as of October 2026 and is not legal advice.

The short answer for managing directors

• Yes, the obligation applies to practically every company that uses AI systems professionally, regardless of size. That includes tools such as ChatGPT, Microsoft Copilot or AI features in your industry software.
• It has applied since 2 February 2025. Since 27 July 2026 it applies in a weakened form.
• A certificate is not required. What is required are measures that promote your employees' AI literacy, suited to their role.
• A practical start is a short role-based training plan, a usage policy and one page of documentation.

What Article 4 requires and who it applies to

The EU AI Act (Regulation (EU) 2024/1689) is the European law on artificial intelligence. It has been in force since 1 August 2024 and applies in stages. Article 4 covers AI literacy: the knowledge and skills people need to use AI systems competently and to assess their opportunities and risks.

The obligation applies to two groups:

• Providers, meaning companies that develop AI systems or offer them under their own name
• Deployers, meaning companies that use AI systems professionally under their own responsibility

Almost every SME whose employees use AI tools at work is therefore a deployer under the AI Act. There is no exemption for micro-enterprises in Article 4. Only purely personal, non-professional use is excluded.

In the original version, providers and deployers had to take measures to ensure, "to their best extent", that their staff had a sufficient level of AI literacy. Prior knowledge, training, the context of use and the people on whom the AI is used were to be taken into account.

What the Digital Omnibus changed

With Regulation (EU) 2026/1744 ("Digital Omnibus on AI") of 8 July 2026, the EU amended the AI Act in several respects. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. For Article 4, the regulation text means:

• Providers and deployers take measures to promote the development of their staff's AI literacy.
• The obligation explicitly does not require guaranteeing a specific level of literacy for any particular person.
• The European Commission and the member states are to support companies; the Commission publishes practical examples for this.

So the obligation was weakened but not removed. Doing nothing at all does not meet it. Training and informing staff in a traceable way puts you on the right track. The Omnibus also postponed other deadlines, for example for certain high-risk AI systems. For most SMEs that use AI in everyday office work, however, these high-risk rules are not the core issue.

A pragmatic role-based training plan

The regulation does not prescribe a particular format. It makes sense to distinguish by role, because an accountant needs different knowledge from a developer.

All employees who use AI tools

• How language models basically work and why they can make mistakes
• Which data does not belong in public AI tools, such as customer data, HR data or trade secrets
• Checking results: never adopt facts, figures and quotes without checking them
• Which tools are approved in the company

Teams using AI in customer contact (sales, customer service, marketing)

• Transparency towards customers, for example with chatbots or automated replies
• Handling AI-generated texts and images
• When a person has to decide

Managers and those responsible

• An overview of obligations under the AI Act and the GDPR
• Selecting and approving AI tools
• Responsibility for documentation and refresher training

Technical roles (if any)

• Limits and risks of the models used, testing and monitoring in operation

For most SMEs, one workshop per team is enough, supplemented by a short refresher when new tools are added. Our AI workshop is designed for exactly this, on site in Graz or remotely if you prefer.

Documentation: what you should record

The AI Act does not require a specific document for Article 4. Short documentation is still sensible, because it lets you show which measures you have taken. One page is usually enough:

1. AI tools in use: which systems does the company use, for what and in which departments?
2. Responsible person: who takes care of approvals and training?
3. Measures: which training sessions, guidelines or briefings took place, when and for whom?
4. Usage rules: a reference to your internal policy on using AI, for example which data is off-limits.
5. Refresher training: when is the status reviewed, for example annually or when new tools are introduced?

Keep attendance lists and training materials. A checklist for the other obligations under the AI Act is available in our EU AI Act checklist.

Four steps to meeting the obligation

If you have not done anything yet, there is no reason to panic. With these four steps you can reach a good position in a structured way:

1. Take stock: ask all teams which AI tools are actually being used, including privately created accounts used for work. The result is often surprising.
2. Set rules: decide which tools are allowed, with which accounts and for which data. Record this in a short policy that everyone understands.
3. Train: start with basic training for everyone who uses AI, and add content for roles with customer contact and responsibility.
4. Document and repeat: fill in the one-page documentation and set a date for the next review.

For a small team this is an effort of a few days spread over a few weeks, not months. More important than perfection is that you start and record your measures in a traceable way.

Transparency obligations under Article 50 (chatbots, AI content)

Besides Article 4, Article 50 affects many companies. It has applied since 2 August 2026 and covers transparency:

• Chatbots and AI in direct contact: AI systems that interact directly with people must be designed so that people are informed they are dealing with an AI, unless this is obvious.
• AI-generated content: providers of systems that generate synthetic text, images, audio or video must mark this content in a machine-readable way. For systems placed on the market before 2 August 2026, the Digital Omnibus sets a transition period until 2 December 2026.
• Deepfakes: anyone who publishes deceptively realistic AI-generated or manipulated images, videos or audio must disclose that they were artificially created.

In practice for an SME: if you run a chatbot on your website, label it clearly. If you use realistic-looking AI images in advertising, check the labelling. Find out more on our page about the EU AI Act.

Who provides information in Austria: the AI service centre of the RTR (KI-Servicestelle; RTR is Austria's broadcasting and telecoms regulator) offers information on the AI Act. It is a point of contact for questions, not a penalty authority. It is best to check the RTR website for which authorities currently take on supervision in Austria.

Your next step

In a free initial consultation we clarify which AI tools your team uses and which training scope makes sense. If you wish, we run the workshop for your team and help you set up the one-page documentation. Feel free to bring a list of the tools your team uses today and any existing internal rules. Our office is in Graz, and workshops take place on site or remotely.