The deadline passed on 2 August 2026. Inspections are running.

Every company and every business whose people use AI at work. The regulation calls this a deployer and defines it as any natural or legal person using an AI system under its own authority. What you do with AI doesn't matter, and neither does your size. What matters is that you use it.

Yes. The scope is tied to your role, not your size. A natural person using AI in the course of business is a deployer too. The European Commission's official explanation explicitly states that freelance activity and regular economic benefit mean professional use. The only exception is purely personal, non-professional use, for example at home.

The AI literacy obligation has applied since 2 February 2025. Since 2 August 2026, national authorities have had the power to inspect compliance and hold companies accountable.

That's enough. You don't become a deployer by developing AI, but by your people using it at work. ChatGPT, Copilot or an AI translator used for work tasks means Article 4 on AI literacy applies to you.

With a training record. The law prescribes no specific format or certificate, but the European Commission directly recommends keeping an internal record of training and other measures. A measure you can't prove is, as far as the authority is concerned, a measure that doesn't exist. In practice that means a certificate of completion for every person and records you can export and show at any time.

A video from the internet is not a measure you can document. It gives you no test, no certificate and no record, so during an inspection you have nothing to put on the table. On top of that, training has to match what your people actually do with AI, and a generic video won't do that.

The regulation sets no fixed fine for Article 4 itself. Enforcement is in the hands of national authorities, and the European Commission states that penalties are most likely when an incident occurs and training was missing. Missing training then counts as an aggravating circumstance. So the real risk isn't a fine for skipped training, but full liability for the damage an untrained person does with AI.

The wording of Article 4 was adjusted by an amendment in July 2026, but the obligation stayed. Every deployer must take measures to support the development of AI literacy among their people. What changed is that you no longer have to guarantee a specific level of knowledge for a specific person. The Commission's recommendation to keep an internal record of training still stands. In other words, training and a record of it are still exactly how you meet the obligation.

Each EU member state designates its own market surveillance authority, and national authorities have had enforcement powers since 2 August 2026. In several countries the designation is still being finalised, but the obligations apply directly from the EU regulation either way. Data leaks are handled by data protection authorities already today.