In the summer of 2026 a lot of managing directors breathed out: the Digital Omnibus deferred the rules for high-risk AI systems. Article 4 of the AI Act did not move, though. It has applied since 2 February 2025, and it applies to you too if your team uses ChatGPT, Copilot or any other AI tool at work. Here is what that means in practice for a 20-person company.

What Article 4 says, and what it does not

Article 4 of the AI Act (Regulation 2024/1689) is about AI literacy. It covers two roles: whoever develops an AI system and puts it on the market (the provider), and whoever uses it in their own activity (the deployer). The vast majority of companies with 10 to 250 employees fall into the second category.

The obligation itself is simple: your staff, and anyone operating an AI tool on the company’s behalf, should understand at an appropriate level what the tool does, where it gets things wrong, and who carries the responsibility. The regulation does not prescribe a course type, a number of hours, an exam or a certificate. There is no official „AI Act certificate“, and anyone selling you one is selling marketing.

What does have to be taken into account: the prior knowledge of the people involved, the type of system in use, and who is affected by how that system operates. A graphic designer and an HR officer do not need the same training. Article 4 also reaches beyond your own payroll: it covers anyone operating the tool on the company’s behalf, including subcontractors, freelance marketers and agencies.

What changed in the summer of 2026

The Digital Omnibus was signed on 8 July 2026 and entered into force on 27 July. What it brought:

• High-risk systems (Annex III): the deadline moved from 2 August 2026 to 2 December 2027.
• AI embedded in products (Annex I): 2 August 2028.
• Transparency rules (Article 50): unchanged at 2 August 2026, with the watermarking duty applying from 2 December 2026.
• Article 4: the wording was softened. Previously an appropriate level had to be „ensured“, now its development has to be „supported“. The duty became effort-based rather than result-based. It did not disappear, and its date did not move.

In practice this means you do not have to prove that everyone understands AI. You have to be able to show that you did something about it, regularly and traceably. In a 20-person company that is not months of work, it is a few working days, provided you do it in the right order.

Eight steps that are enough for a 20-person company

1. Tool inventory. One table: who uses which AI tool, with what account, with what data. This is the step most often skipped, and the source of most surprises.
2. Risk classification. Check whether any of them is a prohibited practice under the AI Act (Article 5), and whether any of them decides about people in HR, lending or access management.
3. An approved toolset. Decide what may be used: EU data processing, company accounts, data not released for training. Private-account use is the single biggest risk in a small company.
4. A two-page AI policy. What may be entered, what may not, what needs approval, and who to turn to when something goes wrong.
5. Basic training for everyone who touches it. Half a day is enough: what the tool is good for, where it hallucinates, how to check the output, and what must never be pasted into it.
6. Targeted training for the riskier roles. HR, finance, customer service, legal. They need another hour or two on their own cases.
7. Documentation. Date, participants, training material, the name of the person responsible. That is the evidence, not the good feeling.
8. A six-monthly review. Put it in the calendar. A tool list goes stale within half a year.

How much time and how much money

Take a 20-person company where 12 people touch an AI tool. The figures below are typical ranges based on industry experience, not guaranteed values:

Step	Effort	Note
Tool inventory and roles	2–3 hours	one person, one morning
AI policy (2–3 pages)	3–4 hours	faster from a template
Basic training for 12 people	3 hours × 12 people = 36 person-hours	one group, half a day
Documentation	1–2 hours	this is the evidence
Six-monthly review	2 hours per round	booked in the calendar

That is 44 to 47 person-hours in the first round. At an internal cost of 20 to 25 euros an hour, roughly 900 to 1200 euros, plus an external trainer’s fee if you do not run it in house. Our published price list shows what it costs with us.

The other side: if ten of those twelve people save 15 to 30 minutes a day on routine text work (correspondence, summaries, minutes), that is 550 to 1100 hours a year. You can run the same figures with your own headcount in the payback calculator.

Article 4 is not satisfied by everyone becoming clever. It is satisfied by the company doing something about it, regularly and traceably.

Who supervises in Slovakia and Hungary

Since 2 August 2026 the market surveillance authorities of the member states have held their formal powers.

• Hungary: the AI Market Surveillance Authority (MI Piacfelügyeleti Hatóság) acts, as an organisational unit of the Ministry of Science and Technology, on the basis of Act LXXV of 2025 and Government Decree 344/2025.
• Slovakia: MIRRI SR is the designated general market surveillance authority and the single point of contact. The national implementing act was still in the legislative process at the time of writing.

One detail worth knowing: the AI Act’s catalogue of fines (Article 99) does not list Article 4 separately, so there is no EU fine directly attached to it. The detailed penalty rules are set by the member states themselves, though, and a failure on Article 4 surfaces in every case where something went wrong: an incident, a customer complaint, an employment dispute, a public tender or a large-company supplier audit.

What training does not solve

Literacy does not replace control points. There are a few things a small company must not hand to a machine without human approval, even with a well-trained team:

• CV screening and pay decisions. This is the high-risk category under Annex III. The deferral buys time until 2 December 2027, not an exemption.
• Price, deadline, contractual term. AI may draft the proposal, a person sends it.
• Rejection, dismissal, closing a complaint. If a decision has to be justified to a person, a person has to make it.
• Personal or customer data in a private account. That is a GDPR question first, an AI Act question second.
• Publishing AI content unlabelled. The Article 50 transparency rules have applied since 2 August 2026, watermarking from December.

---

If you got stuck on the first of the eight steps, that is entirely normal: in most companies it is the tool inventory that produces the surprise. More practical articles on the blog.