AI literacy under the AI Act: what companies must do

AI literacy under Article 4 of the AI Act means that a company that develops or uses AI supports its people in using AI tools with understanding: they know what the tools can do, where they make mistakes and what risks they bring. The obligation has applied since 2 February 2025. The Digital Omnibus, Regulation (EU) 2026/1744, reworded it from 27 July 2026, but did not remove it. In practice, this means having an overview of the tools in use, clear internal rules and role-based training that you can document.

Verified as of 30 October 2026 directly in the texts of Regulations 2024/1689 and 2026/1744 on EUR-Lex.

What does Article 4 of the AI Act say?

The AI Act is Regulation (EU) 2024/1689 on artificial intelligence. As a regulation, it applies directly in all member states and does not need to be transposed into Czech law. Article 4 concerns AI literacy. Providers and deployers must take measures so that the people who work with AI systems on their behalf have the necessary knowledge and skills.

A provider is whoever develops an AI system and places it on the market. A deployer is whoever uses an AI system in their professional activity. The second group therefore includes an ordinary company whose sales team writes proposals with ChatGPT, whose developers use Copilot or Claude and whose HR team screens CVs with the help of AI.

What did the Digital Omnibus change?

The Digital Omnibus on AI is Regulation (EU) 2026/1744, of 8 July 2026, which was published in the Official Journal of the EU on 24 July 2026 and has been in force since 27 July 2026. It amends the AI Act in several respects.

Article 4 has a new wording. Its core: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and other persons operating AI systems on their behalf. This means:

• The obligation for providers and deployers to support the AI literacy of their staff remains.
• The obligation does not require guaranteeing any specific level of AI literacy of an individual.
• The Commission and member states are to support companies, especially SMEs, and the Commission will publish practical examples.

For companies, this does not mean they can ignore AI literacy. It means the emphasis shifts from “everyone must have a documented test” to a sensible programme that matches how you use AI in the company.

The Omnibus did not postpone the ban on certain practices or the obligations for general-purpose AI models (GPAI). On the contrary, it added two new prohibitions in Article 5(1)(ba) and (bb): AI systems that generate or manipulate realistic intimate images of an identifiable person without their explicit consent, and AI systems for child sexual abuse material. These prohibitions apply from 2 December 2026.

Which AI Act dates matter?

Date	What applies
2 February 2025	Article 4 (AI literacy) and Article 5 (prohibited practices)
2 August 2025	Obligations for general-purpose AI models (GPAI) and penalty provisions
27 July 2026	Digital Omnibus (Regulation (EU) 2026/1744) in force
2 August 2026	General application of the regulation; transparency obligations under Article 50
2 December 2026	New prohibitions (Art. 5(1)(ba) and (bb)); marking of outputs of generative AI systems placed on the market before 2 August 2026 (Art. 50(2))
2 December 2027	High-risk systems under Annex III (originally 2 August 2026)
2 August 2028	High-risk systems embedded in products under Annex I (originally 2 August 2027)

The dates from 2 December 2026 onwards reflect the changes made by the Digital Omnibus. For an ordinary company that only uses AI, the most important parts are Article 4, the prohibited practices and the transparency rules. If you use AI to make decisions about people, for example in recruitment or performance reviews, have it assessed whether it is a high-risk system. Considerably stricter rules apply there.

Who supervises in Czechia, and what are the penalties?

The government designated the Czech Telecommunication Office (ČTÚ), the Czech regulator for electronic communications, as the market surveillance authority and single point of contact. The Czech National Bank and the Office for Personal Data Protection (ÚOOÚ, the Czech data protection authority) also have a role. ČTÚ has set up a new department to supervise AI.

According to available sources, the Czech AI implementing act being prepared by the Ministry of Industry and Trade had not been passed as of 30 October 2026. Without it, according to the specialist press, ČTÚ does not have full sanctioning powers.

Article 99 of the AI Act sets the following maximum fines:

Breach	Maximum fine
Prohibited practices	EUR 35 million or 7% of worldwide annual turnover
Other obligations	EUR 15 million or 3% of turnover
Incorrect information to authorities	EUR 7.5 million or 1% of turnover

For small and medium-sized enterprises, the lower of the two amounts applies. For most companies, however, the real risk is not a fine under Article 4. It is a data leak into a public AI tool, a wrong decision based on unchecked output, or a dispute with a customer.

What does AI literacy mean in practice?

AI literacy is not one training session for everyone. The programme should reflect who uses AI, for what and with what data. A five-step approach works well.

1. Inventory of tools and uses

Find out which AI tools people actually use, including personal accounts. For each tool, note who uses it, for what and what data they put into it. You will often find that more tools are in use than IT has approved.

2. Breakdown by role

Different roles need different depth:

Role	What they need to know
All employees	What AI can and cannot do, hallucinations, what not to put into AI, when to verify output
Management	Risks and accountability, decisions about tools, company rules
HR and procurement	AI in decisions about people (recruitment, reviews), contracts with AI vendors
Developers and IT	Safe use of AI in development, protecting code and secrets, reviewing output

3. Internal AI policy

A short document that people will actually read. It should state:

• which tools are approved and for what purposes,
• which data must not go into them (personal data, trade secrets, credentials),
• when a human must review the output,
• how to label AI-generated content that leaves the company,
• whom to report a problem or suspicious tool behaviour to.

4. Training

Hands-on, using the tools people actually use, with examples from their own work. A hypothetical example: an accountant learns why AI can “fill in” an amount in an invoice summary that is not in the source documents, and how to verify the output.

5. Records and updates

Alongside the list of trained staff, keep the version of the policy and the date of each update. AI tools change quickly, so review the rules and training at least once a year and whenever you introduce a new tool.

We offer training, an AI policy template and training records as part of our AI Act and AI literacy service. For development teams, there is a separate AI-assisted development workshop with Claude Code, where safe work with AI is taught directly on code.

How do you demonstrate AI literacy?

If an authority, customer or auditor asks what you do for AI literacy, you should be able to show a few things:

• a list of AI tools the company uses, with an owner and purpose,
• the current version of the AI policy and the date employees received it,
• a training overview – who, when, what content and for which role,
• a review record – when you last updated the rules and why.

It does not have to be a complex system. For a smaller company, a shared spreadsheet and a folder of documents are enough. What matters is that the records reflect reality and are up to date.

What are the most common mistakes?

• A ban instead of rules. People often get around a total AI ban through personal accounts, and the company then has no overview at all.
• One generic training for everyone. A salesperson, an accountant and a developer need different examples and different rules.
• A policy nobody has read. A long legal document does not help. One or two pages with concrete examples work better.
• A one-off exercise. Tools change every few months. Without regular updates, the rules quickly become outdated.

What to do now

• Take an inventory of the AI tools people in the company use.
• Check whether you use AI to make decisions about people, for example in recruitment, where stricter rules may apply.
• Write a brief internal AI policy and appoint its owner.
• Plan role-based training, not one session for everyone.
• Keep records of training and policy versions.
• Check whether you label AI-generated content that leaves the company.
• Follow the progress of the Czech implementing act and ČTÚ guidance.

Start with the AI Act self-check, download the materials in Downloads, or write to us via the contact form and arrange a no-obligation consultation.