In short
Article 4 of the AI Act has applied since 2 February 2025; according to the Commission, the supervision and enforcement rules apply from 2 August 2026.
The Digital Omnibus (Regulation (EU) 2026/1744) rewrote Article 4: measures to support AI literacy are required, without guaranteeing a specific level for each person.
Italy's Legislative Decree 179/2026, in force since 23 October 2026, creates no new general obligation, but requires employers to inform and train workers on the specific risks of AI (Art. 42).
No certificate is needed: an internal training record, linked to the inventory of AI systems, is the simplest way to show the measures adopted.
An AI policy and ISO/IEC 42001 give training a method: defined competence, awareness and effectiveness checks.
Since 23 October 2026, Italy's Legislative Decree no. 179 of 7 October 2026 has been in force, following publication in the Gazzetta Ufficiale no. 234 of 8 October. The decree aligns Italian law with the AI Act on two fronts: the powers of national authorities and the use of artificial intelligence in training. It implements the delegation in Law no. 132 of 23 September 2025, Italy's AI law.
For businesses, the timing matters. The AI literacy obligation in Article 4 of the AI Act has applied since 2 February 2025 and, according to the European Commission, the supervision and enforcement rules apply from 2 August 2026. In July, the Digital Omnibus on AI rewrote Article 4 itself. In this guide we set out what the texts say, who must train whom, how to make training proportionate, how to document it and how to link it to an AI policy and ISO/IEC 42001. We rely only on official texts: where a rule does not say something, we do not assume it.
Not sure which risk class your AI systems fall into? Take our free AI Act risk class check: five questions, two minutes, with your obligations and deadlines.
What does Legislative Decree 179/2026 say about AI training?
Decree 179/2026 does not create a new general obligation of AI literacy for all businesses. Its structure shows this: 54 articles, most of them on authorities, supervision, penalties and regulatory sandboxes. Training appears in Chapter III, devoted to AI in education, the professions, work, healthcare and public administration.
For definitions, the decree refers to Article 3 of the AI Act and to Law 132/2025 (Article 1), and it applies to the same parties as the AI Act (Article 2). In practice, for a private company the AI literacy obligation remains the one in Article 4 of the EU regulation. The decree adds national rules in some specific areas, which we look at below.
Work and safety: Article 42
Article 42 is the provision closest to a company's daily life. Paragraph 2 states that the use of AI systems affecting work organisation, production pace, how work is performed or safety-relevant decisions is assessed in the risk assessment required by Article 28 of Legislative Decree 81/2008, the Italian health and safety code.
Paragraph 3 requires employers to ensure adequate information and training for workers on the specific risks of AI systems and on the prevention and protection measures adopted. This obligation adds to Article 4 of the AI Act, with a different focus: there, the skills to use AI in an informed way; here, health and safety. If your company uses AI in these areas, check with your health and safety manager how to combine the two programmes.
Employment decisions: Article 41
Article 41 concerns employers who use AI systems in decision-making on employment relationships. Final decisions on hiring, changing or ending employment, including disciplinary measures and performance assessments, cannot be based solely on automated processing: the final decision rests with a natural person with real and independent power.
Before processing starts, the employer must provide the information required by Article 1-bis of Legislative Decree 152/1997, already referred to in Article 11 of Law 132/2025. Workers can ask for an intelligible explanation of the decision that concerns them. This is where training matters: whoever signs off the final decision must understand what the system does, otherwise human control exists only on paper.
Professions, schools and public administration
The other articles in Chapter III concern specific groups. Article 47 provides that training run by professional bodies includes AI literacy and training on the use of AI, covering technical, legal and ethical aspects; national councils have six months to update their rules. Other articles cover schools, universities, adult education, justice, healthcare and the financial sector.
If professionals registered with a professional body work in your company, that training may also help your internal programme, but it does not replace it: it covers the profession, not the specific systems you use. The full text of the decree is available on Normattiva.
What does Article 4 of the AI Act require after the Digital Omnibus?
Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. This is the text in force after the Digital Omnibus on AI, Regulation (EU) 2026/1744, as shown by the Commission's AI Act Service Desk.
The measures take into account people's technical knowledge, experience, education and training, the context in which the systems are used and the persons on whom they are used. The new text adds a clear sentence: the obligation does not require guaranteeing any specific level of AI literacy of any individual.
What AI literacy means
Article 3, point 56, of the AI Act defines AI literacy as the skills, knowledge and understanding that allow an informed deployment of AI systems and awareness of the opportunities, risks and possible harm. The definition applies to providers, deployers and affected persons, each according to their rights and obligations.
So it is not a programming course. For someone who uses a generative AI tool to write text, literacy means knowing it can produce invented but plausible answers, which data not to enter and when a human check is needed. For someone who develops a system, the technical level required is higher.
What changed with the Omnibus
According to the Commission's AI literacy Q&A, updated on 20 October 2026, AI literacy remains an obligation for providers and deployers, but a specific or "sufficient" level is no longer mandated. Paragraph 2 asks the Commission and Member States to support businesses, in particular SMEs, including by publishing practical examples. Paragraph 3 tasks the European AI Board with adopting recommendations setting common objectives.
The change shifts attention from outcome to measures. You do not have to prove that every person has reached a certain threshold, but you must be able to show which measures you adopted and why they suit your systems and your people.
Key dates
Article 4 has applied since 2 February 2025. The Commission's Q&A states that the supervision and enforcement rules apply from 2 August 2026 and that enforcement lies with national market surveillance authorities, not the European AI Office. In Italy, Decree 179/2026 names ACN, the national cybersecurity agency, as market surveillance authority for AI systems, with Banca d'Italia, CONSOB and IVASS competent for certain high-risk systems in the financial sector (Article 5).
Who must train whom in a company?
The obligation concerns your company if it develops or uses AI systems in its professional activity. The AI Act calls a provider whoever develops a system and places it on the market under its own name, and a deployer whoever uses a system under its authority. Most SMEs are deployers: they use tools developed by others.
The Q&A clarifies that "other persons" are not employees but people broadly under the company's organisational remit, such as contractors, service providers or clients. It also clarifies that staff using a generative chatbot to write advertising copy or translate are covered and should be informed about specific risks, for example hallucinations.
Who | What they need to know, in short |
|---|---|
Management | Which systems the company uses, for what purpose, what risks they carry and which internal rules apply |
People using generative AI tools | Limits of the tool, data not to enter, checking results, internal policy rules |
People deciding with AI support (HR, credit, quality) | How to read outputs, when not to trust them, how to document the human decision |
IT and development | Technical functioning, testing, security, managing AI suppliers |
External contractors using systems on your behalf | The rules that apply to the systems they use for the company |
The table is an example to adapt, not an official list. For high-risk systems, Article 26(2) also applies: deployers assign human oversight to people with the necessary competence, training and authority. The Q&A notes that additional measures may be relevant in these cases.
How do you make AI training proportionate?
The Commission's Q&A says there is no one-size-fits-all model and that no mandatory training is imposed. It does, however, suggest a minimum approach in four steps, useful as a guide for any company.
The first step is a general understanding: what AI is, how it works, which systems the company uses, with what opportunities and risks. The second is clarifying the role: does the company develop systems or use those of others? The third concerns risk: what people need to know about the specific systems they use, their risks and how to mitigate them. The fourth is tailoring everything to people's knowledge, experience and education, to the context and to those affected by the system.
In practice, proportionate means the salesperson using a writing assistant does not follow the same programme as someone using a system to screen candidates. The Q&A also notes that relying only on instructions for use may be ineffective: a document nobody reads does not support literacy. Short sessions, examples based on the company's real cases and an update whenever a new tool arrives work better.
You do not need to test employees' knowledge, because Article 4 does not require it. An effectiveness check is still good practice, and ISO management system standards require it for actions on competence. We cover this in our guide to competence, training and awareness.
How to document training: the internal record
According to the Commission, no certificate is needed: organisations can keep an internal record of training and other guidance initiatives. It is not a formal obligation, but it is the simplest way to show the measures adopted if an authority, a client or an auditor asks.
A useful record is short and up to date. For each initiative, note the date, participants, AI systems covered, content, format and materials, plus the result of any check. Link the record to your inventory of AI systems: if a system comes into use and the record shows no training on it, you have found a gap.
Also keep the reasons for your choices: why one group received a basic programme and another an in-depth one. This is the risk and context logic required by Article 4, written so that others can follow it. The same record can include the worker information required by Article 42 of Decree 179/2026, so you have a single point of reference.
AI policy and ISO 42001: where does training fit?
Training works best when it is tied to written internal rules. An AI policy states which tools are allowed, for what uses, with which data and who approves a new system. Training explains that policy to the people who must apply it. Without a policy, courses stay generic; without training, the policy stays in a drawer.
ISO/IEC 42001 is the management system standard for AI and follows the harmonized structure common to ISO management system standards. Clauses 7.2 and 7.3 require you to determine the necessary competence, ensure it through training or experience, evaluate effectiveness, retain documented information and make people aware of the policy and their contribution. We cover the standard in our guide to ISO/IEC 42001.
ISO 42001 is voluntary and is not the same as compliance with the AI Act. It does, however, offer a method for keeping together the inventory of systems, policy, risk assessment, training and internal audit. For those using systems that interact with people or generate content, training should also cover the transparency obligations of Article 50.
What to do now: an operational checklist
If your company uses AI systems, these steps let you start in an orderly way. They are internal activities you can begin without waiting for new rules.
Build an inventory of AI systems in use, including generative tools adopted by individual departments.
For each system, note your role (provider or deployer), its purpose and who uses it.
Identify the groups of people to train, including external contractors using systems on your behalf.
Write or update your AI policy with permitted uses, prohibited data and rules for checking outputs.
Prepare a basic programme for everyone and targeted programmes for those who decide with AI or develop it.
Open the internal training record and link it to the inventory.
If AI affects work organisation or safety, involve your health and safety manager for the risk assessment and worker information.
What to do over the coming months
After the first round, AI literacy becomes an ongoing process. Every new system, change of supplier and new use should trigger a check: who will use it, what they need to know, what training is needed. Set a periodic review of the record, for example alongside the management review if you have a management system.
Keep an eye on official sources: Article 4 provides for the Commission to publish practical examples on the single information platform and for the AI Board to adopt recommendations. Professional bodies must update their rules within six months of the decree coming into force. If you use high-risk systems, check the specific AI Act obligations for your case; you can start from our AI Act service page.
Finally, check that your documents are consistent. Worker information, the risk assessment, the AI policy and the training record should tell the same story. An internal audit is the right moment to verify this.
How Complaion supports companies on compliance
Complaion works alongside companies with a dedicated Lead Auditor who follows your organisation over time and proposes the path that best fits your needs. We work on the AI Act, ISO/IEC 42001, ISO 27001 and the other main standards and certifications.
The Complaion platform collects evidence, manages documents, keeps the activity schedule and prepares the audit. The internal audit is carried out by the Lead Auditor, so you reach external assessments with a system that has already been checked. More than 1,000 clients have chosen Complaion for their compliance journeys: if you want to understand where to start, contact us.
Frequently asked questions about AI training in companies
Is AI training mandatory for all companies?
Article 4 of the AI Act concerns providers and deployers of AI systems, meaning those who develop them or use them in their professional activity. If your company uses AI systems, check how the obligation applies to your case. The Commission's Q&A clarifies that no specific courses are imposed: the obligation is to take appropriate measures to support the AI literacy of those using the systems.
Do employees need a certificate?
No. According to the Commission, no certificate is needed. Organisations can keep an internal record of training and other initiatives. A certificate issued at the end of a course can be useful evidence, but Article 4 does not require it.
Does Decree 179/2026 introduce new training obligations for businesses?
The decree does not create a general AI literacy obligation for businesses, which remains the one in the AI Act. Article 42, however, requires employers to provide adequate information and training to workers on the specific risks of AI systems and on the prevention measures adopted. Article 47 concerns training organised by professional bodies.
Who enforces Article 4?
According to the Commission's Q&A, enforcement lies with national authorities for market surveillance, and the relevant rules apply from 2 August 2026. In Italy, Decree 179/2026 names ACN as market surveillance authority for AI systems, with Banca d'Italia, CONSOB and IVASS competent for certain high-risk systems in the financial sector.
Are there specific penalties for a lack of AI literacy?
Article 23 of Decree 179/2026, which lists the financial penalties, does not refer to Article 4 of the regulation. The Commission notes, however, that national authorities may impose penalties and other measures under national law, in a proportionate way. The prudent choice is to be able to show the measures adopted with an up-to-date record.
Does someone who only uses a generative chatbot need training?
Yes. According to the Commission's Q&A, staff using a generative chatbot for work are covered and should know the specific risks, such as hallucinations. A proportionate programme is enough: limits of the tool, data not to enter, checking results and internal policy rules.
