AI literacy mandatory? What the law actually asks of you

Somewhere between two quotes, the email arrived: AI literacy is mandatory, enforcement has started, and the fine runs up to 15 million euros. Underneath it, a course costing a few thousand. The obligation is real — but that sentence gets three things wrong. The amount belongs to a different article. The duty itself was weakened in July 2026, not tightened. And there is an AI rule you can breach today, except it is not about your staff but about your chatbot. Below is what the law literally says on each point, and what you as a business owner should do with it.

What Article 4 has literally asked of you since July 2026

AI literacy sits in Article 4 of the European AI Act and has applied since 2 February 2025. It touches almost everyone: if you use ChatGPT for your email, if there is an AI button in your accounting package, if there is a chatbot on your site, or if your recruitment software screens CVs — you are a deployer and you fall under it. Company size does not matter, and neither does whether you built it yourself.

What changed recently has not made it into most articles online yet. The old text required organisations to “ensure” a sufficient level of AI literacy among their staff. On 27 July 2026 that text was amended by the EU Digital Omnibus — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and readable on EUR-Lex. The new text asks you to “take measures to support the development of AI literacy”, with this added literally after it: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Law firm Noerr calls that a downgrade to a best-efforts obligation.

AI literacy carries no fine. The chatbot disclosure does.

So where does that 15 million figure come from? From Article 99, the AI Act's penalty provision. That article lists exhaustively which articles are finable: Article 5 (the prohibited practices) in the highest band, and among others Articles 16, 22 to 26 and 50 in the band of 15 million euros or 3% of worldwide annual turnover. Article 4 appears in no band at all. That is not an interpretation — you can read the list yourself at artificialintelligenceact.eu/article/99.

One honest caveat belongs here. Article 99(1) allows member states to attach their own penalties where the regulation does not. The Dutch implementing act was still a draft bill in August 2026: the public consultation ran from 20 April to 1 June 2026 and the Council of State's legislative advice had not even started. So something may be added one day. Today it is not there, and nobody can tell you when it will be.

The AI duty you actually can breach

Since 2 August 2026, chatbots and phone assistants must explicitly tell users they are talking to AI. That is Article 50(1). The date did not move and there is no transitional regime — including the widely repeated “we still have until 2 December 2026”, because that extension covers the marking of AI-generated content, not the opening line of a conversation. The European Commission adopted the final guidelines on 20 July 2026 (document C(2026) 5054, press release IP/26/1653).

Those guidelines name a customer service chatbot explicitly as a system that communicates directly with people, and therefore falls under the disclosure duty. The exception for cases where “it is obviously AI anyway” is interpreted narrowly on purpose. Business use is no escape either: the guidelines count professional users among the people who must receive the notice. The Dutch Data Protection Authority sums it up in one sentence (9 July 2026): the information must be available at the latest before the first interaction with, or exposure to, the content.

There is a third requirement in the text that almost no checklist mentions: Article 50(5) requires the notice to meet the applicable accessibility requirements. Four things make it right, and they cost nothing:

• Real text, not an image. A screen reader has to be able to read it out.
• Enough contrast, and not only visible when you hover over something with your mouse.
• Included in the tab order, so people working with a keyboard run into it too.
• Before the first question. Not halfway through, and not only when someone asks.

And then the fine Article 50 does carry. The band is 15 million euros or 3% of worldwide annual turnover, but that is not what a small business risks: Article 99(6) provides that for small and medium-sized enterprises the lower of the two applies, and that the supervisor must weigh size and capacity to pay. At 2 million in turnover, 3% is sixty thousand euros — that is the ceiling you are talking about, not 15 million. Since the July 2026 amendment the same rule applies one size class higher, for companies that have just grown out of the SME definition.

What you can do this week, in roughly half a day

None of this requires a course, a certificate or an external agency. The law prescribes no fixed number of hours, no mandatory training and no quality mark. What it asks is that you make a demonstrable effort and can show that effort.

• Write down which AI is running in your business. Including the AI buttons in software you have used for years — your accounting, your email, your recruitment tool.
• Decide per role what someone needs to know. Whoever has quotes drafted needs something different from whoever has invoices read in.
• Hold one one-hour session: what it can do, where it goes wrong, and what must never go into it. Customer data, personnel files and pricing agreements are the three you always name.
• Put the agreements on a single page and have people sign off. Including the freelancers working for you — the duty covers people using AI on your behalf.
• Put a date in the calendar to redo it in a year, and in between whenever a new tool arrives.
• Open your own chatbot and read the first line. Does it say it is AI? If not, you have just found your only real breach.

Why a course costing a few thousand rarely solves your problem

To avoid a misunderstanding: knowledge really is the brake. Statistics Netherlands asks companies why they do not use AI, and across all industries 8% name a lack of relevant experience in the business against 2% saying the costs are too high (CBS, ICT use by businesses 2025, companies with 10 or more employees). So knowledge holds people back about four times harder than money does. In specialised construction the gap is even wider. Anyone who thinks the budget objection is the real objection is looking at the smallest objection there is.

But which knowledge is missing? Research agency Dialogic looked into this for the Dutch Ministry of Economic Affairs (“AI use in SMEs: ambition or hesitation?”, 29 September 2025). At companies under fifty employees the barrier sits in knowing: they say they do not know which steps to take, have the wrong expectations of AI, or lack insight into what is possible. Only at larger companies does it shift to the business case and then to technology. Of the forms of support studied, sharing practical examples ranks highest — with the entrepreneurs and with the experts. Note the scale: this is qualitative research with 25 in-depth interviews, so read it as a ranking, not as a percentage of the market.

You can see that difference in how guidance works when it does work. On an AI vendor's case page (saixtech.com) a Japanese advertising agency is described that received weekly guidance for twelve weeks: a shared foundation in the first six weeks, then live questions about real bottlenecks from their own work. The agency reports no euro figures — it is about consistent quality between team members and less rework. It is a vendor claim without numbers, so take it as an illustration rather than proof. The pattern is recognisable though: what made the difference was practising on their own work. Not a certificate.

The subsidy that skews the picture

There is another reason a course automatically looks like the cheapest option: training is subsidised far more generously than having something built. The Dutch SLIM scheme run by the Ministry of Social Affairs covers 60% of eligible costs for an individual SME application, with a minimum of 5,000 euros in costs and a maximum of 24,999 euros in subsidy, for training and business reviews among other things. The second application window of 2026 runs from 19 August 09:00 to 7 September 17:00.

For having an automation built there is no national counterpart — only regional schemes with sector and postcode filters. That uneven playing field explains why training looks cheaper than building, regardless of which of the two solves your problem. Does a course answer your question? Do it, and take the subsidy. Is your question “how do I get rid of those forty emails a day that all ask the same thing” — then a course does not cover that, however good the deal.

And if you want to be sure

Since 8 July 2026 any organisation can have a free, confidential conversation with the Dutch Data Protection Authority about the AI Act. The supervisor reserves time every Wednesday, online or on location in The Hague, up to an hour per conversation; places are limited through August and allocated in order of arrival. The transparency obligations are literally on the list of topics. One limitation is stated just as literally: explanations from the supervisor are not legally binding positions. So you can say you discussed it, never that something was approved.

And enforcement itself? In the Netherlands it does not exist yet. In its letter to parliament on the supervisory system, the government writes that market surveillance authorities only formally hold that task after the implementing act is published and in force — and in the same letter that the obligations apply in the meantime anyway, because a European regulation has direct effect. So what builds up in the meantime is not fine risk but evidence debt: every month a customer-facing AI runs without a disclosure is a month you cannot document afterwards. That is a reason to build the notice in calmly, not a reason to wait.

In short

• AI literacy has been mandatory since 2 February 2025 and applies to anyone using AI professionally, regardless of company size.
• Since 27 July 2026 it is a best-efforts obligation: take measures, do not guarantee a level of knowledge.
• The regulation attaches no fine to Article 4 itself. The 15 million figure belongs to Article 50.
• Article 50 — telling people they are talking to AI — has applied since 2 August 2026, with no delay and no transitional regime.
• If things do go wrong, SMEs face the lower of the fixed amount or the turnover percentage.
• An hour of explanation, a page of agreements and a date in the calendar covers the duty. A certificate is nowhere required.