Why AI literacy becomes mandatory for companies from 2026 (EU AI Act)

AI has already crept into many SMEs without anyone ever deciding on it. One employee pastes a client contract into a chatbot to quickly summarise it, another has an AI tool draft quotes. Handy, until someone asks where exactly that data ends up. That is precisely what the new AI literacy obligation in the EU AI Act is about.

No panic: this is not a heavy certification, nor a reason to ban AI. But it is an obligation that fully comes into play from 2026, and one many business owners do not yet have on their radar. Here is a level-headed explanation of what it involves.

What exactly does the law say?

Article 4 of the EU AI Act places a duty of effort on organisations around AI literacy. In concrete terms: whoever uses or offers AI systems must ensure that the staff involved have sufficient knowledge and understanding to use those systems responsibly. This provision has applied since early 2025, and 2026 is the year in which oversight and enforcement really get going.

Important to understand: AI literacy is not about technical depth. It is about your people understanding what an AI tool can and cannot do, where the risks sit, and which agreements apply at your company. Someone does not need to be a data specialist to handle AI sensibly, just as someone does not need to be a mechanic to drive safely.

Does this apply to my SME too?

Most likely yes, and much sooner than you think. The obligation does not depend on your size, but on whether AI is used in your organisation. And that is the case more often than owners suspect:

• Staff using ChatGPT, Copilot or another chatbot for texts, summaries or translations.
• AI features built into tools you already use, such as your mail program, accounting package or CRM.
• Smart assistants that suggest quotes, emails or client replies.
• Tools that automatically screen CVs, score clients or sort documents.

If you recognise one or more of these situations, you fall under the obligation. It does not matter whether you develop the AI yourself or simply use it: the use itself is enough.

Which first steps should you take now?

You do not need to set up a big programme. A handful of practical steps already put you well on the way and show that you take the obligation seriously:

1. Map out which AI tools are used in your company, including the ones that were never officially approved. You cannot steer what you do not know.
2. Put simple agreements on paper: which tools are allowed, which are not, and which data may never end up in an AI tool (think personal data, contracts and financial data).
3. Provide a short, understandable training for everyone who uses AI. Not a technical lecture, but practical examples from your own shop floor.
4. Record who is responsible for what, and where people can go with questions or doubts.
5. Repeat this periodically. AI tools change fast, so an agreement made today may be outdated next year.

The nice thing is that these steps pay off twice. You not only comply with the law, you also avoid sensitive company data quietly walking out through a free chatbot. AI literacy is therefore just as much sound risk management as it is an obligation.