The EU AI Act Now Requires AI Training for Your Team. Here's What That Actually Means.

Since 2 August 2026, EU regulators can ask any business using AI tools professionally to show it took AI literacy seriously. This isn't a big-tech obligation. It applies from the first employee who uses ChatGPT, Claude, or Copilot at work. Here's what the law actually requires, what it doesn't, and what a proportionate response looks like for a 10-50 person business.

This is not legal advice. For a definitive read on your specific obligations, talk to a lawyer. What follows is a practitioner's plain-language summary and what a real response to it looks like.

Do I actually have to do anything about this?

Yes, if anyone at your business uses an AI tool professionally, even if that's limited to ChatGPT or Claude for drafting emails or summarizing documents. You don't need to build your own AI system to be covered. Article 4 of the EU AI Act has applied since February 2025; enforcement, meaning inspections and fines, started on 2 August 2026.

What the law does NOT require

No mandatory certificate. No fixed curriculum. No Chief AI Officer. The standard in the regulation is training "to their best extent," scaled to your size, your resources, and how you use AI. A 15-person architecture firm and a 15,000-person bank are not held to the same bar. This is the part most explainer content buries under legal hedging, and it's the most useful thing to know if you've been putting this off out of dread.

What "sufficient AI literacy" looks like for a small business

Concrete and role-based, not abstract. Your team should understand what the tool they use can and can't do, what kinds of data shouldn't go into it (client names, health data, anything under an NDA), and where a human needs to check the output before it goes out the door. It needs to be documented: informal training counts, but you need a record that it happened, what was covered, and when.

What a real session looks like

Not a slideshow. A useful AI literacy session works through the tasks your team already does: drafting a client email, summarizing a contract, structuring a report. Each person leaves having done the task once with the tool, not having watched someone else do it. That's the same format used in the workshops referenced in our case studies, and it produces the kind of concrete competence the law asks for, not a checkbox exercise.

The documentation part

What "proof you did this" needs to look like in practice: who attended, what was covered, and when. A structured session produces this automatically as a byproduct, because someone ran it and can describe it. "The team figured it out on their own" produces nothing to show an inspector, even if the team did figure it out.

If your team has been using AI tools for months without any structured session, that gap is the risk, not the tools themselves.