If someone in your business uses ChatGPT, Claude or Copilot for work, you’ve probably had an urgent-sounding email by now: «AI training is mandatory». There’s some truth in it. EU AI Act Article 4, on AI literacy, applies to businesses that use these tools, but in July 2026 the so-called Digital Omnibus rewrote the text, and today it asks for a good deal less than the adverts suggest. And if you also want your team to learn to use AI at work, there’s AI training for companies (in Spanish), from 5 people.

Here is what the law says before and after the change, whether it applies if you only use ChatGPT, and what I would do in an afternoon in a business with three to ten people. This is general information, not legal advice: if you use AI for something sensitive, such as choosing who to hire, talk it through with your adviser.

Is AI training mandatory in 2026?

There is an obligation, but no specific course you have to take. Article 4 of Regulation (EU) 2024/1689, the AI Act, has applied since 2 February 2025 to those who build AI systems and to those who use them at work. Since 27 July 2026 it asks you to take measures to support the AI literacy of your people, without having to guarantee any level.

The European Commission explains this in its questions and answers on Article 4, updated on 27 July 2026: it is still an obligation, but a «sufficient» level, or any other level, is no longer required. There is no mandatory format, no certificate is needed and, to document it, an internal record of what you’ve done is enough.

What EU AI Act Article 4 on AI literacy says, before and after the Omnibus

From 2 February 2025 to 26 July 2026, Article 4 said this:

Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]

Regulation (EU) 2026/1744 of 8 July 2026, known as the Digital Omnibus on AI, was published in the EU’s Official Journal on 24 July 2026 and came into force three days later. Since 27 July 2026, paragraph 1 reads:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

The Spanish version, which is just as official, says «apoyar la promoción», to support the promotion of AI literacy. In practice:

  • It applies to the same people. Those who build AI, the providers, and those who use it at work, which the law calls «deployers». If your team uses ChatGPT, that’s you.
  • Goodbye to the «sufficient level». You have to put measures in place, but nobody can demand that each person reaches a particular level.
  • The criteria haven’t changed. What each person already knows, their experience and training, what the AI is used for and on whom.
  • The Commission and the member states now have homework too. The new paragraph 2 requires them to support businesses, «in particular» SMEs, and the Commission has to publish practical examples of how to comply. Paragraph 3 asks the European AI Board for recommendations with common objectives.

The Omnibus explains why in its recital 8: strict obligations created a burden, «particularly for smaller enterprises», and AI literacy should be a strategic priority «regardless of regulatory obligations and potential sanctions».

Does it apply if you only use ChatGPT or Claude?

Yes. The AI Act calls a «deployer» any person or business using an AI system under its authority, except in a personal, non-professional activity. If your team uses ChatGPT to answer emails or Claude to summarise contracts, your business is a deployer, even though someone else built the tool.

The Commission gives an almost identical example: a company whose staff use ChatGPT to write adverts or translate text has to comply with Article 4 and tell them about specific risks, such as hallucinations, which is when the AI makes up a fact with total confidence.

Three details:

  • There’s no minimum size. It makes no difference whether you are three people or thirty.
  • People working on your behalf count too. The article covers your staff «and other persons», and the Commission gives contractors and service providers as examples. If a freelancer or an agency uses AI on your jobs, tell them your rules.
  • If you work alone, the text says nothing explicit about training yourself: it talks about your staff and whoever uses AI on your behalf. Even so, the rules in the template below work just as well for you.

And one boundary worth knowing. If you use AI to screen CVs or assess your employees, you are, in principle, dealing with «high-risk» systems, and there the law asks for more: whoever oversees the system must have «the necessary competence, training and authority». Those obligations apply from 2 December 2027. If that’s you, this is a job for an adviser.

What to do in an afternoon if your business has 3 to 10 people

This is what I would do. It follows the minimum points the Commission suggests (which AI you use, what your role is, what the risks are and what each person already knows), and it leaves you with a record that you’ve taken measures.

1. List which AI is used and for what (20 minutes)

Ask each person which tools they use, with which account, personal or business, and what for. It’s easy to find someone using their personal ChatGPT with client data. That list tells you what the training needs to cover.

2. Write the use policy (30 minutes)

Use the template below and remove anything that doesn’t apply. One page, in plain language. If it doesn’t fit on one page, nobody will read it. If your team works in Spanish, the Spanish version of this article has the same template in Spanish.

3. Run a one-hour internal session

With laptops open and your own tools. I’d run it in this order:

  • What we use and what we don’t (10 minutes). The list from step 1 and the approved tools.
  • How it gets things wrong (15 minutes). Everyone asks for a summary of one of your own documents with no personal data, a contract or a quote, and checks three facts against the original. That explains hallucinations better than any slide.
  • Data (15 minutes). What never gets pasted in, which account to use and how to switch off training in personal accounts. It’s covered step by step in ChatGPT, Claude and GDPR.
  • What a person decides (10 minutes). What gets checked before sending, what doesn’t get delegated and when to say something was made with AI.
  • Questions (10 minutes). And who to tell if someone gets it wrong.

If someone on the team already knows a lot, let them run it. And for new starters, the policy on day one and the session in their first week.

4. Write it down (10 minutes)

A simple record. The template is further down.

Template: a one-page AI use policy

Copy it, change what’s in square brackets and delete what you don’t use. It’s designed for a business that uses ChatGPT, Claude, Gemini or Copilot for office work.

AI USE POLICY FOR [BUSINESS NAME]
Version 1, [date]. Person responsible: [name].

1. Approved tools
We use [tool and plan, for example ChatGPT Business, Claude Team or Gemini in Google Workspace] with the business account. Check any other tool with [person responsible] first.
If anyone uses a personal account: training switched off, and never with client or colleague data.

2. What we use it for
Drafts of emails, quotes and reports. Document summaries. Translations. Social media ideas. Excel formulas. [Add your own uses].

3. What never goes in
Passwords, access keys and bank details.
ID numbers (DNI, NIE), phone numbers, addresses or health data of clients and staff, except in [business tool with a data processing agreement] and only what is strictly needed.
Documents a client has given us in confidence, without asking [person responsible] first.

4. What a person always checks
Anything that goes out under our name is read by a person before it is sent.
Figures, dates, names and references to laws or contracts are checked against the original. AI sometimes makes things up, and it does so with great confidence.

5. What a person always decides
Prices, discounts, complaints, contracts and any decision about a client or an employee.
We don't use AI to screen CVs or assess anyone without discussing it with [person responsible] first.

6. When we say it's AI
If we publish an image, audio or video made or edited with AI that could pass for real, we say so.
If we put an automated chat on our website, it must say it is an AI.

7. If something goes wrong
If data slips in that shouldn't have, or you spot an AI mistake in something already sent, tell [person responsible] the same day. Nobody gets told off for speaking up.

8. Training
Everyone who uses AI in the business does the internal session when they join and whenever we change tools. It goes in the record.

Review: every six months or when something important changes.
Read by: [each person's name and date]

Keep it where everyone can find it and review it when you change tools.

How to keep a record without red tape

The Commission is clear: no certificate is needed, and organisations can keep an internal record of their training. With a sheet like this, kept next to the policy, you have a record of what you’ve done:

AI TRAINING RECORD
Date: [day]. Length: [1 hour]. Run by: [name].
Attendees: [each person's name and role].
What we covered: approved tools and what they're for; how AI gets things wrong and how to check it (exercise with [document]); which data never goes in; what a person always decides; when to say something was made with AI.
Material: AI use policy, version [1].
To do: [for example, move to business accounts by [date]].
Next review: [date].

Add a line whenever someone joins or you repeat the session. And there’s no need for a test: the Commission makes clear that Article 4 does not require you to measure what each employee knows, and since July 2026 the article itself says you don’t have to guarantee any level.

What you don’t need to buy

Plenty of urgent offers of AI literacy training have appeared around this. Before you pay, bear this in mind:

  • AI literacy «certificates». According to the Commission, you don’t need one. A diploma may look good on someone’s CV, but it doesn’t certify that your business complies.
  • Long courses for the whole team. There is no mandatory format: it depends on the tools, the risks and what each person already knows. That said, the Commission warns that just telling people to read the tool’s instructions is often not enough.
  • An «AI officer» or a committee. No special structure is required.
  • Compliance seals or audits. The AI Act provides no seal for Article 4, and not even copying the examples in the Commission’s own repository of good practice gives you, for now, a presumption of compliance.
  • Fear of huge fines. If someone sells you a course by talking about €15 million fines, ask them where it says that for Article 4. More on that in the next section.

If your team needs to learn to use AI properly, a practical course may be worth it, and you may be able to fund it through FUNDAE. Buy it if it will help you work better, because Article 4 doesn’t require it. And if you’d rather start for free, there’s a 30-day plan in learn AI without coding.

Who enforces it in Spain, and are there fines?

In Spain, the authority is AESIA, the Agencia Española de Supervisión de Inteligencia Artificial (Spain’s AI supervision agency), based in A Coruña. Its 2023 statute already gives it supervision, inspection and sanctioning functions for AI, and the European Commission’s list of authorities names it as Spain’s point of contact. With an asterisk: the formal designation is still waiting to be adopted.

That designation is in the draft Organic Law on the proper use and governance of AI (in Spanish), which at the end of September 2026 is still in Congress, at the amendment stage. The deadline for amendments was 30 June 2026, but Congress has kept extending it, week by week since September, and for now it runs until 30 September 2026. The bill gives AESIA everything in the AI Act that isn’t assigned to another authority, and that’s where Article 4 falls.

And fines? The AI Act only sets figures for some infringements: up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for a closed list of obligations, and up to €7.5 million or 1% for giving incorrect or misleading information to the authorities. Article 4 is in none of those.

What the AI Act does say is that each country sets the penalties for any infringement, so Spain could attach one to Article 4. The bill the government sent to Congress doesn’t: Article 4 is not among its infringements, although amendments could change that. The Commission points out that national authorities can supervise it from 2 August 2026. It also says any penalty must be proportionate, and that one is more likely if there’s an incident caused by a lack of training.

In short: the AI literacy obligation exists, but as things stand there is no fine set in Spain for breaching it.

Can the training be funded through FUNDAE?

Yes, if you have employees and the course meets the conditions. FUNDAE is the state foundation for workplace training: businesses have a training credit each year, which they recover as a discount on their Social Security contributions (this is what people mean by «formación bonificada»). According to FUNDAE’s FAQ (in Spanish):

  • Businesses with 1 to 5 employees are guaranteed a minimum credit of €420 a year.
  • The course has to be related to the business’s activity, or be cross-cutting training, and last at least two teaching hours. Conferences, seminars and trade fairs don’t count.
  • It must be notified in FUNDAE’s application no later than two days before it starts, and you have to inform the workers’ legal representatives if there are any.
  • Only people who complete at least 75% of the hours count (or 75% of the learning checks, if it’s online).
  • With fewer than six employees you aren’t required to co-finance, meaning pay a percentage out of your own pocket. Anything above the credit, though, you pay yourself.
  • You can organise it yourself, with your own resources or by hiring a training provider.

Two warnings. The one-hour internal session doesn’t qualify, because it’s under two hours, and it doesn’t need to: it costs nothing. And if you are self-employed with no employees, FUNDAE says the conditions for funding your own training are still awaiting regulation; what you can do is take its free courses. If you’d rather not wrestle with the application, a training organiser (entidad organizadora) can handle it for you.

My advice

This week, do the list, the policy and the session, and keep the record. It takes an afternoon and leaves you with a record showing you’ve taken measures. And the most useful part: your team will use AI with more judgement, which is what really saves you trouble.

When the Spanish law is passed, or the Commission publishes its practical examples, some details here may change. The basics will still serve you: your people knowing which tools they use and where those tools get things wrong.

Sources, checked on 26 September 2026: Article 4 of the AI Act, the European Commission’s Q&A on Article 4, Regulation (EU) 2026/1744, AESIA, the draft law in Congress and FUNDAE’s FAQ.