ChatGPT, Microsoft Copilot, writing assistants, analysis tools, image generators: in many companies, artificial intelligence is already in use before any official policy has been defined. A question then keeps coming up among business leaders, HR directors and training managers: do you have to train every employee in AI to comply with the AI Act?
The short answer is more nuanced than many commercial headlines suggest. Article 4 of the AI Act keeps an obligation to develop the AI literacy of people who use or operate AI systems on behalf of an organisation. But it requires neither an identical programme for every company, nor individual certification, nor a universal number of hours.
The point is therefore not to tick a box with generic awareness training. It is to put in place measures that are proportionate to the tools used, the teams’ knowledge, the business context and the risks. Here is how to turn this requirement into a concrete skills-building plan.
Mandatory AI Training: The Answer in Three Points
- Yes, an AI literacy obligation exists. Providers and organisations that deploy AI systems must take measures to develop the knowledge and skills of the people concerned.
- No, the regulation does not require uniform certifying training for every employee. The European Commission specifies that Article 4 requires no specific individual level, exam or certificate.
- Yes, the company must be able to show a consistent approach. The content, depth and format must match actual uses, profiles and the level of risk.
This distinction is essential. Presenting the AI Act as a simple obligation to buy standardised training would be inaccurate. Conversely, assuming that a reminder sent by email is automatically enough would be just as fragile.
What Does Article 4 of the AI Act Really Ask For?
The European Commission organises the approach around four simple questions. They make an excellent basis for building an AI literacy programme.
1. Give a General Understanding of Artificial Intelligence
The employees concerned must understand what an AI system is, what it can bring and where its limits lie. For generative AI, this means in particular knowing that a fluent answer can be wrong, that a model can reproduce bias, and that a result must be checked before it influences a decision.
2. Identify the Organisation’s Role
A company that develops an AI system does not have the same responsibilities as a company that uses an off-the-shelf solution. Most very small businesses, SMEs and internal departments are deployers: they bring in tools such as ChatGPT, Copilot or AI features built into their software. That position does not cancel the AI literacy obligation.
3. Assess the Risks Linked to Each Use
Drafting a social media post and shortlisting job candidates do not have the same effects or the same risks. The company must look at the tool’s purpose, the data used, the people affected, the possibility of error and the degree of autonomy left to the system.
4. Adapt Actions to People and Context
Technical level, experience, initial education and tasks differ from one employee to the next. A salesperson who uses AI to prepare a proposal, an HR officer who summarises applications and a developer who integrates an API do not need the same path.
What the AI Act Does Not Automatically Require
The Commission’s official clarification helps avoid several common shortcuts.
- An individual certificate for each employee is not required by Article 4.
- A minimum AI literacy score is not set for each person.
- A mandatory duration and a single training format are not imposed.
- Creating an AI Officer role or a dedicated committee is not systematically mandatory to satisfy this article.
- The same training for the whole organisation is not necessarily the most relevant answer.
Particular vigilance remains for systems classified as high-risk. In that context, other provisions of the AI Act reinforce, among other things, the need to train the people in charge of human oversight. Simply reading the instructions for use may then be insufficient.
Who Should Be Trained in the Company?
The right scope is not limited to IT teams. The Commission refers to people who use or operate an AI system on behalf of the organisation. Depending on the situation, this can include employees, managers, contractors or subcontractors.
To organise the skills-building, it helps to distinguish five profiles.
- Occasional users: they use generative AI to search, translate, summarise or produce a first draft.
- Operational users: AI is regularly involved in their sales, communication, support, design or analysis process.
- Managers and validators: they check the results, make decisions or set the rules of use for their team.
- Technical profiles: they configure, integrate, supervise or develop AI systems.
- Control functions: HR, legal, the data protection officer (DPO), security, quality and management assess the risks, the data and the impacts.
This segmentation avoids two mistakes: training everyone too superficially, or reserving the subject for a few experts while uses spread across the whole company.
Why a Generic Webinar Is Not Always Enough
Shared awareness training can be a good starting point. It creates a common vocabulary and explains the essential rules. But it becomes insufficient when employees must apply these principles in complex professional situations.
Knowing that an AI can hallucinate is not enough: you also have to learn how to verify information, ask for a source, compare the result with reliable data and decide when use of the tool must stop. Likewise, reminding people not to share sensitive data is no substitute for an exercise in which participants learn to anonymise a request or choose an approved tool.
AI literacy becomes truly operational when employees know what to do before, during and after using the system.
A Six-Step Action Plan for the Company
Step 1: Map the Tools and Uses
List the officially deployed solutions, but also the informal uses. For each tool, identify the jobs concerned, the data involved, the expected result and the decision that may be influenced.
Step 2: Segment the Audiences by Exposure
Sort employees by frequency of use, complexity of tasks, decision-making power and risks. This analysis lets you scale the paths proportionately.
Step 3: Define Observable Skills
Replace a vague goal such as “understand AI” with verifiable abilities: recognise a hallucination, anonymise data, write a robust instruction, check a source, explain an AI-assisted decision or report an incident.
Step 4: Train From Real Work Situations
Exercises must reproduce the decisions the teams actually make. A sales department can work on preparing a meeting and validating a proposal. An HR team can analyse the bias in a candidate summary. A management committee can decide whether to deploy an AI agent.
Step 5: Set Boundaries and Document Practices
Formalise the approved tools, the prohibited categories of data, the human validations required and the reporting channel. The Commission indicates that a certificate is not necessary, but that an internal record of training and initiatives can be kept. The programme, the participants, the cases covered and the updates are useful evidence.
Step 6: Measure and Update
Tools, risks and rules change quickly. Plan an initial diagnostic, validation exercises, monitoring of uses and periodic updates. The goal is not just attendance at training: it is the ability to use AI effectively, critically and responsibly.
What Should Truly Useful AI Training Contain?
A consistent path can combine a common foundation with workshops adapted to each function.
- Understand the main families of AI and how generative AI works in general.
- Identify hallucinations, bias, limits and the risks of overconfidence.
- Protect personal, confidential and strategic data.
- Understand the issues around intellectual property and content traceability.
- Write effective instructions and check the quality of the answers.
- Define the situations in which human validation is essential.
- Apply the rules to use cases specific to the job.
- Know how to document, report and correct a problematic use.
The depth of each module depends on the role. An occasional user needs safe reflexes. A manager must also know how to weigh decisions, validate and organise oversight. A technical profile must master the risks linked to integration, data and the system’s behaviour.
Which Format Should You Choose?
There is no single regulatory format. A company can combine several approaches depending on its needs.
- Shared awareness training to share the concepts, risks and internal rules.
- Job-specific workshops to turn principles into operational practice.
- Manager paths for validation, governance and steering of uses.
- Blended learning to alternate human support, practice and resources available over time.
- Short updates when tools, procedures or risks change.
The deciding criterion is not the advertised length, but the fit between the path, the systems used and the decisions entrusted to the people trained.
How Marmignon Brothers Can Help
Marmignon Brothers designs AI training adapted to the jobs, the maturity level and the operational objectives of the organisation. Support can start with a diagnostic of uses, continue with a common foundation, and then branch into workshops for management, managers, HR, sales, marketing or creative teams.
This approach avoids training that is disconnected from the field. It lets you work on the tools actually used, the data handled, the internal rules and the situations in which a mistake would have an impact.
To discover the paths available, see Marmignon Brothers’ artificial intelligence training.
FAQ: Mandatory AI Training and the AI Act
Does Using ChatGPT at Work Fall Under This?
Yes. The European Commission gives precisely the example of a company whose employees use ChatGPT to write advertising copy or translate content. Users must be informed of the risks specific to this use, notably hallucinations and the need to check the results.
Must All Employees Take the Same Training?
No. Actions must be adapted to the people who use or operate the systems on behalf of the organisation. A shared foundation can be relevant, but the depth must depend on tasks, knowledge and risks.
Is a Certification Mandatory?
No, not under Article 4. A certification can serve the goal of recognising skills, but the Commission does not make it a general condition of compliance.
Can In-House Training Be Enough?
It can be relevant if its content is adapted to the uses, audiences and risks, and if the company can show the approach it followed. Bringing in a specialist provider can nonetheless make the diagnostic, the teaching structure and the practical exercises easier.
Is a Single E-Learning Module Enough?
It depends on the context. For simple, low-risk uses, a module backed by clear rules can be part of the answer. For frequent, complex or sensitive uses, job-specific workshops, exercises and reinforced oversight are generally more consistent.
What Does the Summer 2026 Application Phase Change?
The obligation to develop AI literacy already applies. From summer 2026, the oversight and enforcement mechanisms increase the value of a structured, documented approach. The precise enforcement arrangements are a matter for the competent national authorities.
Conclusion: Moving From Compliance to Competence
The AI Act should not be reduced to a regulatory box. Well-designed AI literacy protects the organisation, improves the quality of decisions and lets teams use the tools with more independence.
The right question is therefore not just “do we have to train?” but “which people must be able to do what, with which systems, and under what control?” From that map, the company can build a useful, proportionate and lasting programme.
Would you like to map your uses and build a path suited to your teams? Contact Marmignon Brothers to define a diagnostic and a tailor-made programme.
Sources and References
- European Commission: Questions and answers on AI literacy and Article 4: the main, up-to-date regulatory source.
- European Commission: Living repository of AI literacy practices
- European Commission: European regulatory framework for artificial intelligence
- Marmignon Brothers: Which AI training should you choose for your company?
