Documenting AI literacy under the EU AI Act

AI transformation has a major impact not only on processes, value creation and roles. With the EU AI Act, the use of AI systems now also has a legal guardrail that can also be checked since August 2026. This applies not only to software companies, but to every company where artificial intelligence is in use. From our conversations we know that the following questions, among others, are currently on people’s minds:

• Do we need a certificate for AI literacy?
• Does the obligation also apply if we only use ChatGPT?
• Who in the company is responsible for AI literacy?
• In which practical cases does evidence of AI literacy help me?

For this, we read the text of the regulation and the European Commission’s answers. We do not give legal advice, we show the results of our research and our interviews with HR departments.

What AI literacy means under the AI Act

The AI Act defines the term in Article 3(56). It means the “skills, knowledge and understanding” that allow providers, deployers and affected persons “to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause”.

How concretely this is meant is shown by the European Commission with an example. If employees use ChatGPT to write advertising copy or translate texts, the obligation under Article 4 applies to the company. The employees should then know the typical risks, such as hallucinations.

What Article 4 requires from companies

L’article 4 has applied since 2 February 2025 to providers and to deployers of AI systems. A deployer is anyone “using an AI system under its authority” (Article 3(4)). If your company only buys and uses AI, it is therefore a deployer.

On 27 July 2026, the Digital Omnibus Regulation entered into force and amended Article 4. Before, companies were to ensure “to their best extent” that their staff have “a sufficient level of AI literacy”. Today, they take measures to support the development of AI literacy among their staff and other persons.

In doing so, they take into account the technical knowledge, experience, education and training of the staff and the context in which the system is used. Also new is the sentence that companies are not obliged to guarantee a specific level of AI literacy for any person. The European Commission adds that Article 4 remains an obligation, but no longer prescribes a specific or sufficient level.

The obligation extends beyond your own workforce. By “other persons”, the European Commission means people who work with the system on behalf of the company without being employed there, for example contractors, service providers or clients.

What Article 4 does not require

The European Commission updated its questions-réponses sur la maîtrise de l’IA on 27 July 2026. For HR, four clarifications in it matter:

• No certificate: Companies can keep an internal record of their training and other measures, a certificate is not needed.
• No obligation to measure: Article 4 does not require companies to test their employees’ AI knowledge.
• No prescribed training: There is no fixed format. The Commission warns, however, that it is often not enough to simply refer to the system’s instructions for use.
• No AI officer: Article 4 does not prescribe a dedicated governance structure.

Since August 2026, the national market surveillance authorities supervise Article 4, and they can sanction infringements under national law. However, the regulation does not set a fixed fine range for Article 4 in Article 99, as it does for other articles.

Stricter rules for high-risk AI from December 2027

As listed in Annex III , high-risk AI includes AI systems that companies use to recruit or select staff, for example to screen or filter applications. Deployers of such systems must assign human oversight to persons “who have the necessary competence, training and authority” (Article 26(2)).

According to the amended timeline in the Digital Omnibus , this obligation applies from 2 December 2027. Before, 2 August 2026 had been planned.

Why an overview per role still helps

As the European Commission points out, a sanction is more likely if an incident goes back to missing training. By then at the latest, you want to be able to show which role works with which system and what the employees learned for it.

The European Commission collects how companies handle this in a directory of practice examples. Two of them follow the logic you know from mandatory training.

At the Norwegian insurer Gjensidige , HR is responsible for basic AI training, and the training per role is the responsibility of the respective business unit management. All employees complete a mandatory e-learning, and new employees go through the same programme. Employees in claims handling also receive training on the AI systems used there, including their risks.

Our second example is the Ingka Group, the largest IKEA retailer, which only unlocks advanced generative AI tools once the basic training is complete. The company itself writes that mandatory training before access has proven to be a strong incentive.

If you transfer the Gjensidige example into our template, the row for claims handling looks like this:

Rôle	AI systems in use	Required AI literacy	Training measure	Due date	Evidence
Claims handling	AI systems in claims handling	Risks of AI in claims handling	Mandatory e-learning for everyone, plus training on the systems in use	on joining, then repeated at suitable intervals	internal record

How to fill in the template

It works best if you fill in the template together with the managers of each role, column by column:

• Role: Enter the title from your job or requirements profile.
• AI systems in use: List every system the role works with, including a general chat assistant.
• Required AI literacy: Describe what the role needs to know about these systems and their risks. Article 4 names as the benchmark the technical knowledge, experience, education and training and the context in which the system is used.
• Training: Enter the measure through which the role builds this literacy. According to the European Commission, this can also be a measure other than training.
• Due date: Set when the training should be completed, for example before first access to the system, as at Ingka.
• Evidence: Note where participation is recorded, for example in the learning management system.

How to describe the AI skills per role and capture the current state is explained in our article on AI skills in the company.

Frequently asked questions about AI literacy

Do we need a certificate for AI literacy?

No. The European Commission writes that a certificate is not needed. It is enough to keep an internal record of which training and other measures have taken place.

Does the obligation also apply if we only use ChatGPT?

Yes. The European Commissionnames exactly this case, using the example of employees who write advertising copy or translate texts with ChatGPT.

Who in the company is responsible for AI literacy?

The law does not assign a role, and according to the European Commission no AI officer is needed. At Gjensidige, HR is responsible for basic training and business unit management for training per role.

Training and certificates in Teammeter

In Teammeter, you store certificates with an expiry date and define for each unit which certificates are required. The overview then shows the status “Valid”, “Expiring soon” or “Expired” for each person. The training matrix lists a team’s training next to the people, each with its status. Book a demo and we will show you this with your roles.