AI Act: is AI training for your staff mandatory, and what should you actually do?
Yes. Article 4 of the EU regulation on AI requires any business whose staff use AI, even a free assistant, to take measures so that everyone knows how to use it properly. Since 27 July 2026, no specific level is required, but doing nothing is still a breach, and the enforcement rules have applied since 2 August 2026, even though Belgium has not yet named its authority. In practice: an inventory of uses, a one-page rule, an approved tool, short training suited to each role, and a written record.
What Article 4 says, in plain English
The EU regulation on artificial intelligence, often called the ‘AI Act’, contains a very short article that affects almost every business: Article 4, on ‘AI literacy’. The people who use AI on your behalf must know what the tool can do, and where it can get things wrong.
This article has applied since 2 February 2025. It was rewritten in 2026 by a simplification regulation, Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal of the EU on 24 July and in force since 27 July 2026. The change is real, but it does not remove the obligation, as the European Commission's questions and answers on AI literacy confirm: it makes it more reasonable.
- Before 27 July 2026: ‘ensure, to their best extent, a sufficient level’ of AI literacy, with no precise definition of that level.
- Since 27 July 2026: ‘take measures to support the development’ of AI literacy, with no specific level required of any individual.
- New: the Commission and the Member States must help businesses, SMEs in particular, and the Commission publishes practical examples.
Does this apply to your business?
Almost certainly, yes. The regulation covers those who build an AI tool, but also ‘deployers’: any organisation that uses an AI system under its own authority (Article 3 of the regulation). Only personal use, unrelated to work, is excluded.
So you are a deployer as soon as someone in your team uses AI for work. A few common situations:
- a PA who gets a consumer AI assistant to draft or translate a letter;
- an accountant or office manager who has a long document or contract summarised;
- a practitioner who uses software that transcribes the consultation and suggests a report;
- an email or office suite whose built-in AI feature is switched on for the whole team.
The Commission has confirmed it: a business whose employees use a consumer AI assistant to write or translate is covered. These people must at least know the risks, such as ‘hallucinations’, meaning wrong answers presented with confidence.
The obligation covers your staff, but also ‘other persons’ who use AI on your behalf: a freelancer, a subcontractor, a service provider. According to the Commission, these people must have the skills their task requires, just like your employees.
Key dates
| Date | What happens |
|---|---|
| 1 August 2024 | The EU regulation on AI enters into force |
| 2 February 2025 | Article 4 (AI literacy) applies, as do the prohibitions |
| 2 August 2025 | The rules on penalties apply; each country sets its own regime |
| 27 July 2026 | The new wording of Article 4 enters into force |
| 2 August 2026 | The rules on enforcement by national authorities apply; so do the transparency obligations |
| 2 December 2027 | Rules for ‘high-risk’ AI listed in Annex III (recruitment, credit, access to certain services…) |
| 2 August 2028 | Rules for ‘high-risk’ AI built into regulated products, such as certain medical devices |
Penalties: what can really happen
The headline fines you read about everywhere (up to €35 million or 7% of worldwide turnover) target prohibited AI practices, not Article 4. For AI literacy, the regulation sets no amount: the Member States decide the penalties, from a simple warning to a fine, in a proportionate way that takes the interests of SMEs into account (Article 99).
The Commission adds that a penalty becomes more likely if there is an incident caused by a lack of training or instructions. That is the real risk: not a surprise inspection, but a data leak or a serious mistake, followed by the question ‘what did you have in place?’
That leaves the question of who will enforce it. In Belgium, in early August 2026, the FPS Economy said it was preparing a preliminary draft law naming the competent authorities: not a single authority, but several depending on the sector, with the BIPT (the telecoms and postal regulator) as the central authority where no other is competent (RTBF, 2 August 2026, in French). This delay does not suspend anything: the EU regulation applies directly.
Example: a costly copy and paste
Example, made up for illustration. In a fictional medical practice, a secretary has to reply to a tricky letter from an unhappy patient. She pastes the whole exchange into a free online AI tool, with the patient's name and details of their treatment. The reply is well written, but it invents a refund deadline, and the patient's information now sits with a service whose terms nobody has read.
Nobody meant any harm. What was missing was a clear rule (‘no patient data in a consumer tool’), an approved tool and ten minutes explaining the mistakes AI makes. That is exactly what Article 4 asks for.
In a healthcare practice, this is the point that matters most. Health data is ‘special category’ data under the GDPR, and medical confidentiality applies. A patient's name, a report or an X-ray image has no place in a free online AI tool.
The five-step plan, to start on Monday morning
- Take stock. Ask everyone, without blame, which AI tools they use and what for. Also note the AI features already switched on in your software.
- Write a one-page rule. What is allowed, what is banned, and with which tools. Rule number one: no patient, client or staff data in an unapproved consumer AI tool.
- Provide an approved tool. Banning without offering an alternative pushes people to use AI in secret. Choose a tool whose terms suit you, and set it up properly.
- Train, by role. A short session for everyone, plus extra for those who handle sensitive tasks (health data, decisions, texts sent to patients or clients).
- Keep a record. Date, content, attendees, version of the rule. A simple spreadsheet will do.
The Data Protection Authority advises checking the default settings of these tools (chat history, use of your conversations to train the AI, automatic backups), which are often switched on without you knowing: a good habit to include in your internal rule.
What should the training cover?
There is no official syllabus. The Commission sets out a minimum: what AI is and how it works, which AI is used in your business, what it can do and its dangers, with content adapted to the risk of the tools and to each person's level. Simply asking people to read the tool's instructions is often ineffective.
| Role | What they need to know | Realistic format |
|---|---|---|
| The whole team | What AI is, what can and cannot go into it, common mistakes, the internal rule | 45 minutes to 1 hour, yearly refresher |
| Reception and admin staff | The data never to enter, checking before sending, spotting a made-up answer | Workshop on sample letters, with no real data |
| Practitioners and managers | The tool's limits in their profession, their responsibility for the final decision | Session on the tools actually used |
| Business owner | Choosing the tools and their terms, the rule, the follow-up | Half a day, once |
What you do not have to do
According to the Commission's questions and answers, here is what is not required:
- A certificate: an internal record of training and instructions is enough.
- An exam: nothing obliges you to measure your employees' level.
- An ‘AI officer’ or a committee: no particular structure is imposed.
- A programme specific to your sector: nothing specific for healthcare, but the context and level of risk do count.
One exception to be aware of: if you use AI classed as ‘high-risk’, the people in charge of overseeing it must also be trained for that specific task. Ask your supplier if a piece of software makes or prepares important decisions.
In short
AI saves valuable time, and Europe is not asking you to do without it, only to make sure your teams use it knowingly. In the EU, one in five businesses with at least ten people already used AI in 2025, and more than one in two among large businesses (Eurostat): the question is no longer whether your teams use AI, but how.
Frequently asked questions
Is AI training mandatory for my staff?
Yes: Article 4 requires you to take suitable measures, without requiring a specific level. Short training on the tools actually used, together with an internal rule, is usually enough.
What fine does an SME face if it has not trained its team?
The regulation sets no amount specific to Article 4: each country decides the penalties, from a warning to a fine, taking the interests of SMEs into account. The enforcement rules have applied since 2 August 2026; in Belgium, the competent authorities are still being designated. The real risk is an incident, followed by the question of what you had in place.
Do I need a certificate or an accredited body?
No. According to the European Commission, no certificate is needed: an internal record of training and instructions is enough. You can train your team yourself or get help.
My employees use a free AI assistant from time to time: does this apply to me?
Yes, the Commission has confirmed it. Your teams must at least know the risks, such as made-up answers, and which data never to enter.
Who enforces the AI Act in Belgium?
In early August 2026, the FPS Economy said it was preparing a preliminary draft law naming several authorities depending on the sector, with the BIPT as the central authority. The EU regulation nevertheless applies directly, without waiting for that law.