AI literacy training in Ireland: what Article 4 of the EU AI Act asks of nonprofits and SMEs

If your organisation uses AI at work, Article 4 of the EU AI Act applies to you, and has done since 2 February 2025. It asks every organisation that uses AI systems, charities and companies limited by guarantee included, to take measures that support the AI literacy of its staff and of others who use AI on its behalf. It doesn’t prescribe a course, a certificate or a pass mark, but AI literacy training is the most practical way to meet it. This guide sets out what the article says since the Digital Omnibus changed its wording in July 2026, who checks it in Ireland, and what sensible measures look like in a small organisation, with a record you can copy.

What Article 4 says now

Article 4 sits in the first chapter of the AI Act, Regulation (EU) 2024/1689. As first written, it asked providers and deployers of AI systems to “take measures to ensure, to their best extent, a sufficient level of AI literacy” of their staff. The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced the article, and the new wording has applied since the Omnibus came into force on 27 July 2026. Its first paragraph now reads:

“Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”

The same paragraph adds that the duty does not require any specific level of AI literacy from any individual. The question is whether you took suitable measures, not whether each person passed a test.

The Act defines AI literacy in Article 3(56) as the “skills, knowledge and understanding” that allow people “to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause”. Put simply, the people who use AI for you should know what the tools do well and badly, what can go wrong, and what your rules are.

Two new paragraphs promise help: the Commission and the Member States must support organisations, “in particular SMEs”, with practical examples of how to comply on the Commission’s AI Act Service Desk, and the European AI Board will recommend common objectives.

Who it applies to

The duty falls on providers, who develop AI systems or have them developed and offer them under their own name, and on deployers: anyone “using an AI system under its authority”, except in a personal, non-professional activity (Article 3(4)). A charity whose staff draft appeals with Copilot, an SME that summarises meetings with an AI notetaker, a social enterprise that answers enquiries with a chatbot: each is a deployer. The Act has no exemption for small or not-for-profit organisations; Article 4(2) offers small ones support, not an exemption.

“Staff and other persons dealing with the operation and use of AI systems on their behalf” reaches beyond employees. In a nonprofit it can include volunteers, contractors and temporary staff who use AI tools for you.

If you have had an AI tool built and run it under your own name, a chatbot on your website for example, check whether you are also its provider. Providers have further duties, such as making sure people know they are dealing with an AI system (Article 50, from 2 August 2026).

What the Digital Omnibus changed, and what it didn’t

When the European Commission proposed its Digital Omnibus on 19 November 2025, it suggested replacing the duty on organisations with a duty on the Commission and the Member States to foster AI literacy. The Commission’s AI Act Service Desk still describes the proposal that way, so older summaries can mislead.

The law as adopted keeps the duty on providers and deployers. The European Parliament adopted its position on 16 June 2026 and the Council on 29 June; the regulation was signed on 8 July, published in the Official Journal on 24 July and came into force on 27 July 2026. The duty is lighter: “take measures to support the development of AI literacy” replaces “ensure, to their best extent, a sufficient level”. Recital 8 gives the reason: stringent obligations did not suit every organisation and added a compliance burden, “particularly for smaller enterprises”.

The start date did not move. Article 4 belongs to the Act’s first chapter, which has applied since 2 February 2025, and the amended Article 113 keeps that date.

A second Digital Omnibus, on data protection and data rules, is still a proposal. On 24 October 2026 the European Parliament’s Legislative Observatory listed it as “Awaiting committee decision”. It doesn’t change Article 4, and the GDPR applies as it stands, including to what staff paste into AI tools.

Is AI training mandatory in Ireland?

Article 4 is part of an EU regulation, so it applies in Ireland directly. The Regulation of Artificial Intelligence Act 2026, signed into law on 21 July 2026, sets up how the EU Act is supervised here, and the Department of Enterprise, Tourism and Employment says it “does not add to the obligations placed on regulated entities by the EU Regulation”.

So the answer has two halves. Taking measures to support your people’s AI literacy is a legal duty. A particular course, exam or certificate is not. The Commission’s AI literacy questions and answers say: “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” Its Service Desk adds that there is “no obligation for external training or external certification”. In practice, training is the obvious measure, because it is the easiest to plan and to show.

Since 2 August 2026, national market surveillance authorities can supervise and enforce the rules. Ireland has chosen a distributed model: existing regulators such as the Data Protection Commission, the Central Bank and the Workplace Relations Commission supervise the Act in their own areas, and the new AI Office of Ireland (Oifig IS na hÉireann) coordinates them. The AI Office lists the authorities and asks organisations to contact the one that is relevant to them.

The Act sets no specific fine for Article 4. Each Member State lays down its own penalties and enforcement measures, which, under Article 99(1), “may also include warnings and non-monetary measures”. We know of no published enforcement decision on Article 4 so far. Whatever happens on penalties, the practical step is the same: be able to show what you have done.

What good measures look like

There is no single right approach. In the Commission’s words, it “depends on the type of AI system that the company deals with and the knowledge of the staff in question”. For a nonprofit or SME, five things go a long way:

1. Know what is in use. List the AI tools people use for work, including personal accounts and the AI features built into software you already pay for, and who uses each one, for what.
2. Train by role. Everyone needs the basics. People who draft, summarise or translate with AI need more on checking what it produces. People whose AI use affects service users, staff, volunteers or donors, such as caseworkers, fundraisers and HR, need the risks of their own work, including bias and personal data. Managers and trustees need enough to set the rules and ask good questions.
3. Cover the risks people actually meet. Confident answers that are wrong (the Commission says staff using generative AI should be told about risks such as hallucination), personal and confidential data, bias, over-reliance, and telling people when they are dealing with AI. Use the tools and accounts your team really uses, on real tasks.
4. Tie it to your AI policy. Training is easier when there are clear rules to train on: which tools and accounts are approved, what never goes into them, and who checks AI-assisted work before it leaves the organisation.
5. Keep it going. A first session is a start. Plan a short refresher when you add a tool, change the policy or the rules change. The Commission also warns that simply asking staff to read a tool’s instructions may not be enough.

You don’t need an AI officer: the Service Desk notes that the Act “does not require that companies designate AI Officers”. Someone should still own the record.

Public resources keep the cost down. In Ireland, AI Ready offers the Government’s short online courses, and CeADAR runs a fully funded introduction to AI and the EU AI Act, AI for You, under the European Digital Innovation Hub programme. The EU’s living repository of AI literacy practices shows what other organisations do. A general course builds awareness; your own tools, data and rules still need covering in-house.

Further ahead, the rules for high-risk AI bring a separate and stricter duty. From 2 December 2027, organisations that use high-risk systems, for example in recruitment, must assign their oversight to people with “the necessary competence, training and authority” (Article 26(2)).

An AI literacy record and policy clause to copy

The Commission’s answer points to the simplest evidence: an internal record. A spreadsheet is enough. For each training session or other measure, note:

• Who: the person and their role, or the group (for example, all fundraising staff and volunteers).
• When: the date.
• Which tools: the AI tools and accounts covered (for example, Copilot Chat in your work account).
• What: the topics, such as checking outputs, personal data, bias and your AI policy.
• How: the format: a live session, a recording, a one-page guide or a supervised task.
• Who delivered it: the trainer, from inside or outside the organisation.
• Evidence: the slides, the guide or the attendance list, and where they are kept.
• Next review: when it will be refreshed, or what will trigger it, such as a new tool or a change of policy.

Record other measures in the same place: the date your AI policy was issued, a guide sent to volunteers, a setting changed in a tool. Then give the record an owner with one clause in your AI policy:

Everyone who uses AI tools for [organisation] completes the introduction for their role before using them, and a refresher when we add a tool or change this policy. [Name or role] keeps the AI literacy record and reviews it at least once a year.

The record shows the measures you took. It doesn’t certify anyone, and it doesn’t need to.

Where to start

1. List the AI tools in use and who uses them.
2. Agree a short AI policy, or check the one you have.
3. Run a first session for each role, on your own tools.
4. Start the record and name its owner.
5. Decide what will trigger a refresher.

For how this fits into wider AI governance, see why civil society needs its own AI safety playbook. If you’d like help, our Your Own AI Starter includes staff training and a record of who was trained, and our AI consulting covers AI-literacy programmes for each role and EU AI Act readiness. Neither is legal advice or a certification. Or book an intro call: a 30-minute, no-obligation conversation with us about where your team’s time goes and whether we can help.

Frequently asked questions

---