The short answer

Is AI literacy still mandatory?

Yes, that literacy is still a duty: since July 27, 2026, every business that uses AI must take measures to support its people’s knowledge of AI. What was dropped is the requirement to guarantee a particular level for everyone.

AI literacy is still mandatory; only the duty is worded differently. From February 2, 2025, the EU AI Act asked you to ensure a sufficient level for everyone who works with AI on your behalf. Since the July 2026 amendment, it asks you to take steps that support that level.

For small and mid-sized businesses this is good news and a trap at the same time. You do not have to run an exam or keep a certificate per employee. But anyone who reads that the rule was “softened” and then does nothing is still in the wrong.

The occasion

What changed in July 2026?

In July 2026, Article 4 of the AI Act was replaced by a duty to take measures, without a guaranteed level. That happened through Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on July 24 and in force since July 27.

The new text says that providers and deployers of AI systems take measures to support the development of AI literacy among their staff and other persons who operate and use AI systems on their behalf. It adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

The European legislator explains why in recital 8. A strict requirement to guarantee a level does not suit every business and weighs most on smaller companies. At the same time, the legislator writes that AI literacy should remain a strategic priority, regardless of what the law requires.

Many pages you find today date from 2025 and still describe the old requirement. So check the date before you copy a step-by-step plan.

Who it covers

Does the duty apply to my business?

The duty applies to your business as soon as someone there works with an AI system in a professional capacity, even if that is only ChatGPT or Copilot. The law then calls you a deployer: anyone who uses an AI system under their own authority, except for purely personal use.

So you do not have to build anything to be covered. An employee who has an AI program summarize quotes or write emails already makes your business a deployer. And the duty also covers others who work with AI on your behalf, for example a freelancer working for you.

Most businesses are already covered. According to the SME barometer of software maker Exact, a survey of more than 1,700 business owners, 70 percent of Dutch SMEs use AI, up from a third a year earlier.

My reading

What does AI literate mean in a small business?

In a small business, AI literate means your people know what they give to AI, what they get back, and who signs off on the result. Knowledge of models or programming is not part of it.

In my book I put it like this:

One caveat comes with it. The right answer for your situation needs more than the question alone: supplying context, checking what it says, and someone who ultimately signs off on it.Paul Hoffman

For me, that is the core of AI literacy. In the five levels of AI I work with, it belongs to the first level, together with a business license, agreements about your data and a person who checks what comes out. Everything after that builds on it.

Exact’s SME barometer shows where it chafes: 48 percent of owners still find it nerve-racking to let employees work with business data in AI. Clear agreements help against that, and so do people who know why those agreements exist.

What to arrange

Which measures suit a small business?

A few simple measures suit a small or mid-sized business, and you can arrange them within a month. They follow from what the law asks, and they also help with every AI program that comes along later.

  • Know what is being used: ask your people which AI programs they use, including on their own phone or with a private account.
  • Choose business accounts: with a business license and a data processing agreement, you know where your data goes.
  • Put the agreements on one page: which programs are allowed, which data never goes in, and what someone does after a slip.
  • Explain per role what AI can do: whoever writes quotes needs different examples from whoever does the planning.
  • Agree on who checks: for everything that goes to a customer, a person checks the result and puts their name under it.

None of this needs an outside agency. It does take your time as the owner, because the agreements must fit the way your team works.

In practice

What do you do this week?

Start with one hour-long conversation with your team: who uses which AI for what, and what goes wrong? What you hear becomes your one page of agreements.

Then set a fixed moment, for example every quarter, to update the agreements and the examples together. New programs and new colleagues then come along with it by themselves.

Want to know where your business stands? Read about the five levels of AI in a business and take the short check there. You will see right away whether your first level is in order.

Answered briefly

Frequently asked questions

Do my employees have to take an AI literacy course?

No, the law does not prescribe a course. It asks for measures that support your people’s AI literacy, and a course is one form of that. An hour spent going through the house rules together and looking at each other’s examples counts as well. Choose what fits the way your team uses AI.

Is what I read about AI literacy in 2025 still correct?

Partly. Many pages from 2025 say you must ensure a sufficient level for everyone who works with AI. That was in the original text of February 2025 and was replaced in July 2026. The tips on explaining and agreeing on rules are still useful; the requirement to guarantee a level is gone.

Who helps small businesses with this?

The European Commission and the member states. The new text of Article 4 says they support and help businesses in this, with an emphasis on SMEs. The Commission publishes practical examples on its single information platform for the AI Act. A European AI Board adopts recommendations with shared objectives.

When do the heavier rules for high-risk AI apply?

Later than first planned. With the same amendment of July 2026, the rules for high-risk systems in Annex III moved to December 2, 2027, and those for systems in products under Annex I to August 2, 2028. For most small and mid-sized businesses, which use AI for text, email and overviews, Article 4 is the rule that already counts.

Do I have to record what I have done?

The text asks for measures and does not name a separate document. A short note still helps: which AI your team uses, which agreements apply and when you discussed them with your people. If anyone ever asks what you have done, you have something to point to. It takes half a page.

Editorial note

Sources

The idea, the concept and the corrections of substance are Paul Hoffman’s. AI corrected the language, ordered the text and improved readability. The quote comes from his book De Informatiemotor (2026). The facts were checked on November 4, 2026 against the sources below. This article is not legal advice.

  1. Official Journal of the European Union (EUR-Lex), July 24, 2026: Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), Article 1, point 5, and recital 8
  2. Official Journal of the European Union (EUR-Lex), July 12, 2024: Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 3, point 4, and Article 4
  3. NicFab, July 2026: Digital Omnibus on AI: Regulation (EU) 2026/1744 Is Published in the Official Journal
  4. Exact (SME barometer 2026), via Accountancy Vanmorgen, August 3, 2026: AI use doubles among SMEs, strategic use lags behind (on Exact’s SME barometer) (in Dutch)
NEXT STEP

Start with a conversation.

You work with me. So a first conversation is with me as well. An hour, no obligation, at a moment that suits you.