AI literacy and the obligation under the AI Act

Article 4 of the AI Act has applied since 2 February 2025 and is short: anyone who provides or uses AI systems must take measures to ensure that their own staff, and others working with AI on the organisation’s behalf, understand enough about it. The measures must suit those people’s knowledge and training, the context in which the system is used and the people the system affects. The law does not prescribe a fixed level. The Digital Omnibus (Regulation 2026/1744 of 8 July 2026, published on 24 July) relaxed the wording: organisations must take measures that support the development of AI literacy, and the obligation requires no particular level of anyone. The duty to do something remains.

The European Commission has explained in a Q&A what this means in practice. Measuring knowledge is not required, and nor is a certificate; an internal record of training and other guidance is enough as evidence. The obligation reaches beyond the organisation’s own staff and also covers contractors and service providers working with AI on its behalf. Supervision lies with the national market surveillance authorities, and the rules on supervision and enforcement have applied since 2 August 2026. Penalties come from national law and must be proportionate; the Commission explicitly states that an incident resulting from inadequate training or guidance of staff will weigh in that assessment.

In the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is preparing for that supervision and published a second guidance document in October 2025. From its own call for input in April 2025, the AP concludes that AI use is growing faster than organisations’ approach to AI literacy, and that most organisations are still at the start-up stage. At a minimum, the AP expects an inventory of the AI systems in use, including their degree of autonomy; a picture of the risks; for each role, a picture of who works with which system and what that person needs to know; and the organisation’s ambitions with AI. The AP’s multi-year action plan has four steps: identify, set goals, implement and evaluate. And the AP falls in line with the Commission: an organisation that records what it does and why can show it later.

BCG shows how wide the gap is between the law and the workplace. Of nearly 12,000 employees, managers and leaders surveyed, 72 per cent say expectations about the skills they need have shifted, and 36 per cent consider the training their organisation offers adequate. Four in ten feel more mental pressure because of AI, and among leaders almost half.

TALIS 2024 shows how far education has got. This is the OECD study carried out in the Netherlands by the Kohnstamm Instituut and partners, which was sent to the Dutch House of Representatives on 7 October 2025. In the past year 26 per cent of primary teachers and 37 per cent of secondary teachers used AI, mainly to prepare lesson plans. Among primary teachers, 88 per cent say they lack the knowledge and skills to use AI effectively in teaching, and among secondary teachers 80 per cent, more than the international averages of 74 and 75 per cent. Almost half of primary teachers feel overwhelmed by the arrival of new technology in education.

How solid is this? The obligation is settled and enforcement has been possible since August 2026, but the track record is short. There are no fines yet, no Dutch enforcement practice and no second measurement of how organisations are handling it. The legal text, the Commission and the Dutch supervisor do already point the same way.