Training

What the EU AI Act's AI literacy duty means once you roll out Copilot

By Matteo Garoli 7 min read

A white outline graduation cap on a frosted glass tile, with warm amber light and a small ice blue orb glowing behind it on a near-black background.

If your company has given staff Microsoft 365 Copilot, which Microsoft now calls Microsoft Copilot, you are almost certainly a deployer under the EU AI Act, and Article 4 applies to you, provided your organisation is established in the EU or, if it is based elsewhere, uses the system’s output in the Union (Article 2(1)). Article 4 is the AI literacy duty. It has applied since 2 February 2025, national authorities have been able to supervise it since 2 August 2026, and it was reworded in July 2026, so older write-ups quote wording that no longer applies.

I work as a Microsoft 365 Copilot Cloud Solution Architect, and I also train professionals and teams on AI. My view is that training is the main part of a Copilot rollout, so I plan it first, and the EU duty fits that approach. This is not legal advice, so check your own position with a lawyer.

Does the EU AI Act require AI literacy training?

Not training as such. It requires measures to support AI literacy, and the Commission accepts several formats. Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and of other people who operate or use AI systems on their behalf.

Regulation (EU) 2024/1689 first said they had to ensure, to their best extent, a sufficient level of AI literacy. The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced Article 4. It was published in the Official Journal on 24 July 2026 and entered into force three days later. The new text keeps the duty and the factors to weigh: people’s technical knowledge, experience, education and training, and the context where the systems are used. It adds that the duty does not require anyone to guarantee a specific level of AI literacy for any individual. The Commission and Member States must support companies, and the AI Board must adopt recommendations. The Commission’s Q&A confirms that no mandatory training is imposed.

Are you a deployer if your people use Copilot?

Almost certainly. The Act defines a deployer as any person or body, including a public authority, that uses an AI system under its authority, except for personal non-professional use. A provider is whoever develops an AI system and places it on the market under its own name, which for Copilot is Microsoft.

A generative assistant produces content from the input it receives, which is what the Act’s definition of an AI system describes. Article 4 names providers and deployers side by side and does not depend on the system being high risk. Microsoft’s duties as provider do not discharge yours. The Commission adds that the duty reaches people who are not employees but work under your remit, such as a service provider working for you.

Risk still shapes the programme. The Commission says to consider the risk of the systems you use, and a deployer of a high-risk system has a further duty under Article 26(2) to give human oversight to people with the competence, training and authority for it.

What does the European Commission expect you to do?

A documented effort matched to your people and context. There is no certificate and no required format.

The Commission’s Q&A on AI literacy, last updated on 20 October 2026, lists what to consider. Start with a general understanding of AI in the organisation: what it is, what you use, and what the opportunities and dangers are. Then decide whether you are a provider or a deployer, look at the risk of the systems, and build actions on those answers, adjusted for what each group already knows and the context of use.

The Q&A also settles several things companies worry about. You are not obliged to measure employees’ knowledge, and no AI officer or governance board is required. A certificate is not needed: organisations can keep an internal record of trainings or other initiatives instead. It says that telling staff to read the instructions for use can be ineffective, and that training can differ by group. For a company whose staff use a general chatbot to write advertising copy, it says they should be told about specific risks such as hallucination.

The Commission’s living repository of AI literacy practices has more than 40 examples, but copying one grants no presumption of compliance. The AI Board’s recommendations under Article 4(3) are still described as upcoming.

When can regulators act, and what are the penalties?

Article 4 has applied since 2 February 2025, and national market surveillance authorities supervise and enforce the Act from 2 August 2026. According to the Q&A, the Commission’s AI Office does not enforce Article 4.

Penalties come from national law. Article 99(3) to (5) sets EU-level fine ceilings for named provisions, and Article 4 is not among them. The figure that circulates, up to EUR 35 million or 7% of worldwide annual turnover, is the ceiling in Article 99(3) for prohibited practices under Article 5. What a breach of Article 4 costs depends on your Member State’s rules, which is a question for your lawyer.

The Commission says any sanction must be proportionate, and more likely where an incident can be traced to a lack of training and guidance. It adds that the Act creates no criminal offences and no right to compensation.

Why is a training-first Copilot rollout the practical way to meet it?

Because a rollout already makes you decide who gets the tool and for what, which answers much of what the Commission tells you to work out first: which AI you use, who uses it and in what context.

The programme should be role based. Finance, legal and operations use Copilot for different work, and the Commission asks you to fit measures to what people know and the context of use. When I outlined an enterprise training programme, I proposed building it by department, in half-day sessions of four hours, with no generic session for everyone. The AI courses I teach to employees of small and mid-sized companies run in four-hour sessions too, with attendance recorded on an electronic register.

On the record, the Commission accepts an internal log, so I would keep who attended which session, on what date, and from which version of the material. It costs little to write down at the time and a great deal to rebuild after an incident.

On refreshing, the Commission sets no cycle. I plan one every 90 days, because in my experience training goes stale in about a quarter as the product changes.

Why does shadow AI mean you should start now?

Because your people are probably using AI already, with or without a tool from you, and many have had no training. The most recent large survey I could verify is Deloitte UK’s GenAI Workforce Survey: 25,000 workers, fieldwork by Ipsos between 7 May and 10 June 2026, published on 16 September 2026. It found that 63% of UK working adults knowingly use GenAI for work. Of those users, 31% say they do so without their employer’s knowledge, and around half of UK workers who use GenAI at work say they have had no formal training.

That is UK data and self-reported, so it only suggests what an EU company would find if it looked. The Commission’s Q&A covers that position: staff using a general AI tool should be told its risks.

Banning the tools gives staff no information and gives you nothing to record. An approved tool with role-based training gives you both. If you’re planning a Copilot rollout and want a second opinion on the training plan, write to me.

Sources

If you are working on Copilot adoption, a training or a talk, or you are starting out in this world, write to me.