Since July 2026, the European AI regulation, the AI Act, no longer requires companies to ensure their staff have a sufficient level of AI proficiency. Many see this as an exemption, but the training obligation persists in another form, and the risk it aims to address has not disappeared.
- Since July 2026, the AI Act no longer requires a specific level of AI proficiency for staff.
- The training obligation remains, and companies must keep an internal record of their training actions.
- AI tools can give confident false answers, so employees must verify results and protect company data.
- Training should match each company’s actual uses and cover the practical risks of those uses.
Article 4 of the AI Act, applicable since February 2, 2025, required companies using AI systems to ensure their personnel had, “to the best extent possible, a sufficient level of AI proficiency.” No one knew precisely what constituted a sufficient level or how to prove it. European Regulation 2026/1744 of July 8, 2026, published in the Official Journal of the Union on July 24, rewrote this article. It now calls to “promote the development” of this proficiency, and the text specifies that no specific level must be guaranteed for each individual. The legislator acknowledges that the previous wording placed a burden on companies, especially smaller ones.
An Obligation That Changes Form
The European Commission reminds, in its updated FAQ on AI proficiency dated October 20, 2026, that the obligation remains for both providers and users of AI systems, with no imposed level. No certificate is required: an internal record of training and actions taken is sufficient. The “other persons” using AI on behalf of the company can be a service provider or subcontractor, not just employees.
Control falls to national market surveillance authorities since August 2, 2026, and sanctions must remain proportionate. A company that has done nothing and cannot present any record is therefore no better off than before. It can no longer merely cite the ambiguity of the text.
A Risk That Has Not Changed
The author of this analysis believes compliance should not be the primary reason for training. According to Insee (Insee Première No. 2120, July 2026), 18% of companies with 10 or more employees reported using at least one AI technology in 2025, compared to 10% a year earlier. Among them, 53% cite a lack of expertise as a barrier, and 43% express concerns about data protection.
An AI assistant, meaning software that generates text from questions asked in plain language, responds with the same confidence, whether it’s correct or inventing. The Commission cites the example of employees using it to write or translate and needing to be informed of the specific risks of such use, such as hallucinations, meaning false answers presented as true. Someone unaware of this risk copies the error, someone who knows it verifies it.
Data poses a comparable problem. According to the author, difficulties rarely stem from the tool itself, but rather from innocuous actions: pasting a client file into a personal account, sending a document containing personal data, or giving an assistant access to an inbox. These actions often stem from a lack of knowledge rather than malice.
What Training Could Cover
The new wording leaves it to each company to adapt training to its actual uses. For an SME or a professional firm, the author identifies four topics, approachable simply with the whole team. The first concerns the nature of the assistant, which produces plausible text, not truth, and can be wrong about a number, date, or rule without signaling it.
The second involves establishing a short list of data that must not leave the company: no personal accounts for professional data, no payslips or documents containing personal data, no AI connected to an inbox. The third concerns verifying answers before using them, since the answer commits the sender. The fourth defines authorized tools, accounts, and relevant tasks, as using an unapproved tool often indicates an absence of rules rather than an individual fault. Finally, the Commission acknowledges that needs vary: a manager does not have the same needs as a colleague who uses the tool daily. A table indicating who was trained, when, and on which topics is sufficient for keeping a record.
